# incident

plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:26:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:26:03 dovecot_login authenticator failed for H=(eB8sD2p) [77.83.39.61]:62924: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:26:20 dovecot_login authenticator failed for H=(KPk6asKKOF) [77.83.39.181]:56114: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:26:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.180
country_id: 2960313
description:
2026-02-02 19:26:13 dovecot_login authenticator failed for H=(rY2YqTxH) [37.46.113.180]:24723: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:26:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49862: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:27:06 dovecot_login authenticator failed for H=(4U3xpvG1U) [77.83.39.61]:62730: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2026-02-02 19:27:20 dovecot_login authenticator failed for H=80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:34524: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:27:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52152: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.16.97.90
country_id: 3469034
description:
2026-02-02 19:27:12 dovecot_login authenticator failed for H=mvx-187-16-97-90.mundivox.com [187.16.97.90]:43138: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:27:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:27:14 dovecot_login authenticator failed for H=(sqFIsgLL) [77.83.39.61]:62990: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:27:15 H=(185.93.89.63) [185.93.89.63]:53584 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <judy@rittercontracting.com>: The mail server could not deliver mail to judy@rittercontracting.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:27:09 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63104: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:27:16 dovecot_login authenticator failed for H=(d3WtAaIO3R) [77.83.39.181]:59860: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:27:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:28:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:28:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:28:12 dovecot_login authenticator failed for H=(ojcroKt0bt) [77.83.39.181]:63489: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:28:18 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58043: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.59.19.177
country_id: 1522867
description:
2026-02-02 19:28:30 dovecot_login authenticator failed for H=95.59.19.177.dynamic.telecom.kz ([127.0.0.1]) [95.59.19.177]:41615: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.167.3.172
country_id: 1814991
description:
2026-02-02 19:28:38 dovecot_login authenticator failed for H=([127.0.0.1]) [180.167.3.172]:34203: 535 Incorrect authentication data (set_id=khairul_aa)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:28:45 dovecot_login authenticator failed for H=(RSMDv0K) [77.83.39.61]:52907: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:28:06 dovecot_login authenticator failed for H=(4GTiu2) [77.83.39.61]:62677: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:29:04 dovecot_login authenticator failed for H=(D7sYzm8W2j) [77.83.39.61]:53151: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 19:29:05 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:29:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:29:08 dovecot_login authenticator failed for H=(NV7V0Ah) [77.83.39.181]:50999: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-02-02 19:29:58 dovecot_login authenticator failed for H=([207.188.158.216]) [207.188.158.216]:28752: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:29:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52462: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-02-02 19:29:49 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:51392: 535 Incorrect authentication data (set_id=sales@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:30:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63649: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 19:30:37 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:62911: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/img/demos/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:30:04 dovecot_login authenticator failed for H=(m13ZuF) [77.83.39.181]:55399: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:30:04 dovecot_login authenticator failed for H=(VZgZDSGu9) [77.83.39.61]:52929: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:30:12 dovecot_login authenticator failed for H=(UfuYyl) [77.83.39.61]:51565: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:30:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45554: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:30:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:31:07 dovecot_login authenticator failed for H=(IVtpTh) [77.83.39.61]:63096: 535 Incorrect authentication data (set_id=aipeng)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.149.82.49
country_id: 1694008
domain: pspoly.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:31563.pspoly.com.my||ServerName:pspoly.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cd3c427d7d7dc3ecfd19c9609de6e4b3a36c6e20||Title:0x480a6a6a||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:31:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:31:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:31:09 H=(185.93.89.63) [185.93.89.63]:54397 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rvukas@bvtc-online.com>: The mail server could not deliver mail to rvukas@bvtc-online.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:31:48 dovecot_login authenticator failed for H=(GP2X3qS) [77.83.39.61]:53776: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:31:18 dovecot_login authenticator failed for H=(QTz3bd) [77.83.39.181]:61632: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-02-02 19:31:20 dovecot_login authenticator failed for H=([152.52.227.94]) [152.52.227.94]:50886: 535 Incorrect authentication data (set_id=test)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.171.26.160
country_id: 1562822
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/services.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.190.91.99
country_id: 1269750
description:
2026-02-02 19:31:12 dovecot_login authenticator failed for H=([103.190.91.99]) [103.190.91.99]:48578: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:31:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53998: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:32:07 dovecot_login authenticator failed for H=(bQA8POWW) [77.83.39.61]:52986: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:32:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:32:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62923: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:32:14 dovecot_login authenticator failed for H=(wVAAkBjly) [77.83.39.181]:51372: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:32:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:32:18 H=(185.93.89.63) [185.93.89.63]:54577 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rloetterle@crja.com>: The mail server could not deliver mail to rloetterle@crja.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:33:01 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:56298: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:33:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:33:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60175: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:33:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:33:19 dovecot_login authenticator failed for H=(maW9zfX7w) [77.83.39.61]:50791: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:33:06 dovecot_login authenticator failed for H=(oz0kAV67) [77.83.39.61]:58299: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:33:09 dovecot_login authenticator failed for H=(1eH5uCu) [77.83.39.181]:57445: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:34:05 dovecot_login authenticator failed for H=(iSCehgJB) [77.83.39.181]:62754: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:34:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62294: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:34:52 dovecot_login authenticator failed for H=(kIdEdY) [77.83.39.61]:53652: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:34:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:34:06 dovecot_login authenticator failed for H=(vHgoBFcmZC) [77.83.39.61]:55640: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:34:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.93
country_id: 690791
description:
2026-02-02 19:34:38 H=([77.83.39.93]) [77.83.39.93]:52043 F=<Vanessa.Wang@skf.com> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.93 is not allowed to send mail from skf.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:35:06 dovecot_login authenticator failed for H=(G78u7h2N) [77.83.39.61]:53369: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:35:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59125: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.7.42.225
country_id: 2017370
description:
2026-02-02 19:35:52 dovecot_login authenticator failed for H=([185.7.42.225]) [185.7.42.225]:34384: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2026-02-02 19:35:18 dovecot_login authenticator failed for H=80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:34526: 535 Incorrect authentication data (set_id=contacto@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.158.39.201
country_id: 690791
description:
2026-02-02 19:36:01 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [95.158.39.201]:41162: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:35:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:35:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.57.123.166
country_id: 2510769
description:
2026-02-02 19:35:19 dovecot_login authenticator failed for H=166.red-195-57-123.staticip.rima-tde.net [195.57.123.166]:3468: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:35:19 dovecot_login authenticator failed for H=(rM9yOyQjBV) [77.83.39.181]:52070: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.96.62.29
country_id: 1269750
description:
2026-02-02 19:35:28 dovecot_login authenticator failed for H=([59.96.62.29]) [59.96.62.29]:52818: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:35:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:37230: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:36:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.183.74.177
country_id: 6252001
description:
2026-02-02 19:36:15 dovecot_plain authenticator failed for H=c-73-183-74-177.hsd1.pa.comcast.net (wannadelly) [73.183.74.177]:57352: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:36:24 dovecot_login authenticator failed for H=(zRT0gug) [77.83.39.61]:54433: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.50.119.110
country_id: 1814991
description:
2026-02-02 19:36:33 dovecot_login authenticator failed for H=(aire-fresh.com) [61.50.119.110]:39908: 535 Incorrect authentication data (set_id=nologin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:36:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54415: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:36:47 H=(185.93.89.63) [185.93.89.63]:55441 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <deborah.rickard@duluth.k12.mn.us>: The mail server could not deliver mail to deborah.rickard@duluth.k12.mn.us.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:36:15 dovecot_login authenticator failed for H=(N4y4qQTHL) [77.83.39.181]:57168: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:36:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:36:10 dovecot_login authenticator failed for H=(SsGeljyT52) [77.83.39.61]:52760: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:37:50 dovecot_login authenticator failed for H=(jq9ysHi32) [77.83.39.61]:55913: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:37:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:37:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50475: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:37:05 dovecot_login authenticator failed for H=(3qT4HQME) [77.83.39.61]:50060: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 19:37:17 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:37:11 dovecot_login authenticator failed for H=(GRexGs83) [77.83.39.181]:63497: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:38:07 H=(185.93.89.63) [185.93.89.63]:55960 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jake.daw@progressive-medical.com>: The mail server could not deliver mail to jake.daw@progressive-medical.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:38:08 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63157: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:38:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aipeng has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:38:07 dovecot_login authenticator failed for H=(Gt039U) [77.83.39.181]:53377: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 19:38:27 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:63310: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:38:08 dovecot_login authenticator failed for H=(0uPKZlBj8) [77.83.39.61]:64933: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:38:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:42080: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:39:06 dovecot_login authenticator failed for H=(Yan9N6WxA) [77.83.39.61]:55322: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:39:28 dovecot_login authenticator failed for H=(wStW2hF) [77.83.39.61]:60137: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:39:03 dovecot_login authenticator failed for H=(JmaYZaYOB) [77.83.39.181]:58048: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:39:06 H=(185.93.89.63) [185.93.89.63]:56125 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <dsouzama@wesley.edu>: The mail server could not deliver mail to dsouzama@wesley.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:39:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59018: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.12.5.211
country_id: 3996063
description:
[2026-02-02 19:39:15 +0800] info [whostmgrd] 85.12.5.211 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:39:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:40:17 dovecot_login authenticator failed for H=(LMfSjZrAX) [77.83.39.181]:65226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 19:40:28 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:60799: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:40:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:40:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:39470: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:40:44 dovecot_login authenticator failed for H=(36rMiA) [77.83.39.61]:55157: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:40:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61542: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:40:03 dovecot_login authenticator failed for H=(Apr8Vt) [77.83.39.61]:61536: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.224.147
country_id: 1880251
domain: printspecsolution.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/printspecsolutio/public_html/wp-admin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 19:41:09 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:41:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54747: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:41:13 dovecot_login authenticator failed for H=(e9fdOZAR) [77.83.39.181]:53944: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:41:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:41:04 dovecot_login authenticator failed for H=(AwFNxuOc) [77.83.39.61]:52019: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:41:44 dovecot_login authenticator failed for H=(lvf7Yj1Gp) [77.83.39.61]:59698: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:42:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:42:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 138.124.73.114
country_id: 2921044
description:
[2026-02-02 19:42:25 +0800] info [cpaneld] 138.124.73.114 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:42:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51784: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:42:38 H=(185.93.89.63) [185.93.89.63]:56576 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <rdimariano@porticosys.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:42:04 dovecot_login authenticator failed for H=(PbMEo5) [77.83.39.61]:49629: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:42:08 dovecot_login authenticator failed for H=(tLakdE9) [77.83.39.181]:59262: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-02-02 19:42:40 H=([45.144.212.52]) [45.144.212.52]:61231 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<riazshahid@gearbulkshipping.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.52 is not allowed to send mail from gearbulkshipping.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:42:57 dovecot_login authenticator failed for H=(qRzw5bQ8R) [77.83.39.61]:52014: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:43:04 dovecot_login authenticator failed for H=(Huv8Gsg) [77.83.39.181]:63943: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:43:24 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54016: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-02 19:43:31 308425 [Warning] Aborted connection 308425 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.41.40.10
country_id: 3625428
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17361516783572 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:43:58 dovecot_login authenticator failed for H=(TkpPphQ0) [77.83.39.61]:58524: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:43:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:43:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin@agsaintifik.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:43:16 dovecot_login authenticator failed for H=(p4POUmNy) [77.83.39.61]:51848: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:43:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52197: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:44:12 dovecot_login authenticator failed for H=(c9nQGAio) [77.83.39.61]:56907: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.150.125.51
country_id: 6252001
description:
[2026-02-02 19:44:53 +0800] info [cpaneld] 73.150.125.51 - kendekcom "GET /login/?login_only=1&user=kendekcom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kendekcom (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:44:17 dovecot_login authenticator failed for H=(AFlO2w) [77.83.39.181]:54709: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:44:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.207.46.44
country_id: 6252001
description:
[2026-02-02 19:44:55 +0800] info [cpaneld] 75.207.46.44 - kende "GET /login/?login_only=1&user=kende&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kende (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 162.201.121.81
country_id: 6252001
description:
[2026-02-02 19:44:57 +0800] info [cpaneld] 162.201.121.81 - kend "GET /login/?login_only=1&user=kend&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user kend (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:44:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:44:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64875: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 68.49.174.12
country_id: 6252001
description:
[2026-02-02 19:44:44 +0800] info [cpaneld] 68.49.174.12 - global "GET /login/?login_only=1&user=global&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user global (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.62.45.59
country_id: 6252001
description:
[2026-02-02 19:44:46 +0800] info [cpaneld] 170.62.45.59 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.96.227.160
country_id: 6252001
description:
[2026-02-02 19:44:50 +0800] info [cpaneld] 191.96.227.160 - kendek "GET /login/?login_only=1&user=kendek&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 19:44:51 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:45:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 216.126.227.194
country_id: 6252001
domain: smartcable.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/img/photos/index.php||SC:/home/smartcable/public_html/img/photos/index.php||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 19:45:09 308489 [Warning] Aborted connection 308489 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:45:13 dovecot_login authenticator failed for H=(pEkHwfo) [77.83.39.181]:60188: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.2
country_id: 1269750
description:
2026-02-02 19:45:52 dovecot_login authenticator failed for H=([61.246.205.1]) [125.19.218.2]:44306: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:45:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47106: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:45:07 dovecot_login authenticator failed for H=(ptYowLU4vD) [77.83.39.61]:50091: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:45:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:45:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59892: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.50
country_id: 6252001
description:
2026-02-02 19:45:12 308492 [Warning] Aborted connection 308492 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.50' (This connection closed normally without authentication)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:45:08 dovecot_login authenticator failed for H=(pWJGcRTe) [77.83.39.61]:60747: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 164.92.215.178
country_id: 2750405
description:
Feb  2 19:45:30 sv3 pure-ftpd[2156451]: (?@164.92.215.178) [INFO] New connection from 164.92.215.178


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:46:08 H=(185.93.89.63) [185.93.89.63]:57408 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <diane@bethanyseacoast.com>: The mail server could not deliver mail to diane@bethanyseacoast.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:46:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:46:02 dovecot_login authenticator failed for H=(nLNntb) [77.83.39.61]:52752: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:46:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-02-02 19:46:21 dovecot_login authenticator failed for H=(nsg-corporate-38.230.187.122.airtel.in) [122.187.230.38]:35499: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:46:06 dovecot_login authenticator failed for H=(j6LWw4g) [77.83.39.61]:62334: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:46:09 dovecot_login authenticator failed for H=(2VcVT8E) [77.83.39.181]:49226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-02-02 19:46:33 dovecot_login authenticator failed for H=(abts-north-dynamic-014.127.163.122.airtelbroadband.in) [122.163.127.14]:52904: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.43.137.90
country_id: 1835841
description:
2026-02-02 19:46:03 dovecot_login authenticator failed for H=([14.43.137.90]) [14.43.137.90]:35280: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:46:07 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56267: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:47:06 dovecot_login authenticator failed for H=(shOcCPa) [77.83.39.181]:53945: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:47:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:47:17 dovecot_login authenticator failed for H=(zjbMIV) [77.83.39.61]:52549: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:47:09 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (3BmfgFy) [34.101.116.145]:62287: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:47:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51932: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:47:16 dovecot_login authenticator failed for H=(d43KQMLHs) [77.83.39.61]:53915: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-02-02 19:47:40 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:59785: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-02 19:47:24 308555 [Warning] Aborted connection 308555 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-02-02 19:47:58 dovecot_login authenticator failed for H=([27.123.94.66]) [27.123.94.66]:48944: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:48:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65283: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:48:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:48:11 dovecot_login authenticator failed for H=(gvC76BuPz) [77.83.39.61]:59379: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:48:15 dovecot_login authenticator failed for H=(yFHXOkt7) [77.83.39.61]:50670: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:48:16 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (mp2Usi) [34.101.116.145]:63782: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:48:20 dovecot_login authenticator failed for H=(NLZdS8lxI) [77.83.39.181]:59795: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:48:35 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41682: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:49:39 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.114.243.83
country_id: 3625428
description:
2026-02-02 19:49:53 dovecot_login authenticator failed for H=([190.114.243.80]) [190.114.243.83]:39496: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:49:27 dovecot_login authenticator failed for H=(21C8M6RapN) [77.83.39.61]:55146: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:49:07 dovecot_login authenticator failed for H=(xcA7rTEBv) [77.83.39.61]:55870: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:49:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61738: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:49:16 dovecot_login authenticator failed for H=(ynsgyxkHde) [77.83.39.181]:63581: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:49:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:49:06 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (XioWOL) [34.101.116.145]:65069: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.98.91
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48331514886497 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 19:50:59 +0800] info [cpaneld] 185.204.54.153 - mail "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mail (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:50:59 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:38376: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:50:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:50:03 dovecot_login authenticator failed for H=(19WX71) [77.83.39.61]:65043: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 46.151.182.187
country_id: 2750405
description:
2026-02-02 19:50:03 308646 [Warning] Aborted connection 308646 to db: 'unconnected' user: 'unauthenticated' host: '46.151.182.187' (This connection closed normally without authentication)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:50:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:50:24 dovecot_login authenticator failed for H=(BULgVsuyHS) [77.83.39.61]:55842: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:50:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-02-02 19:50:03 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:36296: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:50:14 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (MrsB0H) [34.101.116.145]:51454: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:50:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58104: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:50:11 dovecot_login authenticator failed for H=(dtonv19) [77.83.39.181]:51263: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 19:51:52 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:51:15 H=(185.93.89.63) [185.93.89.63]:58418 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <ffournier@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:51:36 dovecot_login authenticator failed for H=(r6LYS4sV) [77.83.39.61]:53300: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 19:51:45 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:51:08 dovecot_login authenticator failed for H=(40V3HRNNy) [77.83.39.181]:55940: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:51:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:51:16 dovecot_login authenticator failed for H=(GVxYwye) [77.83.39.61]:63064: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:51:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54225: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:51:05 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (VTTZx0Sa) [34.101.116.145]:54864: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:51:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:51:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:52:13 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (r7VQeIxt79) [34.101.116.145]:58501: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:52:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53322: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:52:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:52:24 H=(185.93.89.63) [185.93.89.63]:58570 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mshifrin@customcandydesign.com>: The mail server could not deliver mail to mshifrin@customcandydesign.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:52:33 dovecot_login authenticator failed for H=(bi2Oa6O) [77.83.39.61]:56575: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 35.233.95.0
country_id: 2802361
description:
Feb  2 19:52:36 sv3 pure-ftpd[2161453]: (?@35.233.95.0) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:52:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:52:12 dovecot_login authenticator failed for H=(rdhFKGHAD) [77.83.39.61]:64103: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/scripts/logo.dat||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-02-02 19:52:06 dovecot_plain authenticator failed for H=(phionch) [24.187.213.29]:50166: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:52:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:52:03 dovecot_login authenticator failed for H=(36szF6YKWE) [77.83.39.181]:60497: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:53:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59440: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:53:04 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (gBZ4vK) [34.101.116.145]:60543: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:53:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:53:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:53:18 dovecot_login authenticator failed for H=(UZOm2keU) [77.83.39.181]:51811: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.51.49.90
country_id: 3508796
description:
2026-02-02 19:53:20 dovecot_plain authenticator failed for H=(perbok) [38.51.49.90]:58539: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:53:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50763: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:53:44 dovecot_login authenticator failed for H=(4IknkYHDYQ) [77.83.39.61]:56002: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.193.51.205
country_id: 2077456
domain: masaakisb.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/masaakisb/public_html/wp-includes/images/wp-login.php||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:53:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:53:07 dovecot_login authenticator failed for H=(rI5YDacrB) [77.83.39.61]:55169: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysctl.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.35.19.230
country_id: 2658434
description:
2026-02-02 19:54:00 dovecot_plain authenticator failed for H=dhclient-212-35-19-230.flashcable.ch (agreatenes) [212.35.19.230]:52036: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 19:54:06 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.170.218.142
country_id: 1835841
description:
2026-02-02 19:54:07 dovecot_login authenticator failed for H=([121.170.218.142]) [121.170.218.142]:49421: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:54:14 dovecot_login authenticator failed for H=(G3CiT9oERl) [77.83.39.181]:56988: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:54:03 dovecot_login authenticator failed for H=(kSv5EQ93Ut) [77.83.39.61]:58247: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:54:07 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (jK1LUsK) [34.101.116.145]:63189: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:54:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 19:54:34 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:64229: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:54:42 dovecot_login authenticator failed for H=(JXfJrQ) [77.83.39.61]:58741: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:54:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 19:54:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:54:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64557: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/libuser.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:54:03 H=(185.93.89.63) [185.93.89.63]:59116 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <joe.swain@chemicalbankmi.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:54:13 dovecot_login authenticator failed for H=(uCWo75rksl) [178.16.52.139]:57463: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.82.97.51
country_id: 1814991
description:
2026-02-02 19:54:22 dovecot_login authenticator failed for H=([223.82.97.51]) [223.82.97.51]:34625: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:55:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:55:23 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60888: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:55:53 H=(185.93.89.63) [185.93.89.63]:59400 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <roush_j@westcler.org>: host lookup did not complete


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sudo.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:55:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.78
country_id: 1733045
description:
2026-02-02 19:55:10 dovecot_login authenticator failed for H=([49.125.201.78]) [49.125.201.78]:45414: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:55:08 dovecot_login authenticator failed for H=(dL27Ksp3wQ) [178.16.52.139]:57480: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:55:10 dovecot_login authenticator failed for H=(8i57JE) [77.83.39.181]:61557: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-02-02 19:55:11 dovecot_login authenticator failed for H=([197.219.228.242]) [197.219.228.242]:41480: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.152.225.154
country_id: 6251999
description:
2026-02-02 19:55:24 dovecot_login authenticator failed for H=s75-152-225-154.ab.hsia.telus.net [75.152.225.154]:14076: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.129.90.215
country_id: 2921044
description:
2026-02-02 19:55:54 dovecot_login authenticator failed for H=ns3241969.ip-57-129-90.eu [57.129.90.215]:33918: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:55:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (eUUzTq) [34.101.116.145]:50169: 535 Incorrect authentication data (set_id=cofreth@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.100.159.2
country_id: 1835841
description:
2026-02-02 19:55:25 dovecot_login authenticator failed for H=([222.100.159.2]) [222.100.159.2]:54946: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:55:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51574: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:55:54 dovecot_login authenticator failed for H=(sKsU7zG4FP) [77.83.39.61]:50149: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 19:55:57 H=(185.93.89.63) [185.93.89.63]:59420 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jfadler@privatenursing.biz>: The mail server could not deliver mail to jfadler@privatenursing.biz.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:55:17 dovecot_login authenticator failed for H=(VO4ussz) [77.83.39.61]:64503: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:56:06 dovecot_login authenticator failed for H=(7zepVKu) [77.83.39.181]:49756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:56:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:56:15 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56814: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.69
country_id: 6251999
description:
2026-02-02 19:56:38 dovecot_plain authenticator failed for H=([10.30.18.249]) [212.56.49.69]:38372: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 19:56:36 +0800] info [cpaneld] 185.204.54.153 - mssa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user mssa (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:56:06 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (8k4pFf) [34.101.116.145]:52105: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:56:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/named.root.key||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:56:51 dovecot_login authenticator failed for H=(5K8ceK) [77.83.39.61]:54967: 535 Incorrect authentication data (set_id=aipeng@fimco.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:56:06 dovecot_login authenticator failed for H=(phGnnz9KH) [178.16.52.139]:63138: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:56:13 dovecot_login authenticator failed for H=(QcTa8p4yn) [77.83.39.61]:54902: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.56.49.69
country_id: 6251999
description:
2026-02-02 19:57:03 dovecot_login authenticator failed for H=([10.30.18.249]) [212.56.49.69]:8634: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:57:03 dovecot_login authenticator failed for H=(B7fpmwxXAc) [77.83.39.181]:54442: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:57:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (FTt7NNVz5) [34.101.116.145]:54421: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cpbackup-exclude.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:57:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:57:07 dovecot_login authenticator failed for H=(tuU0rzffr) [178.16.52.139]:49715: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:57:08 dovecot_login authenticator failed for H=(WdACAjxUL) [77.83.39.61]:64435: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:57:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53489: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:57:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 80.82.70.133
country_id: 241170
description:
2026-02-02 19:57:25 309018 [Warning] Aborted connection 309018 to db: 'unconnected' user: 'unauthenticated' host: '80.82.70.133' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:58:03 dovecot_login authenticator failed for H=(Dbn0Umy) [77.83.39.61]:60364: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 19:58:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55744: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.46
country_id: 1269750
description:
2026-02-02 19:58:14 dovecot_login authenticator failed for H=([182.95.85.181]) [182.95.123.46]:60498: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:58:03 dovecot_login authenticator failed for H=(F0SrBMBw) [77.83.39.61]:60356: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:58:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib64/cracklib_dict.pwd||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:58:05 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (GK8hSgM1yJ) [34.101.116.145]:56906: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.44.40.82
country_id: 2017370
description:
2026-02-02 19:58:23 dovecot_login authenticator failed for H=([46.44.40.82]) [46.44.40.82]:60810: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 19:58:43 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:58:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.47.83.115
country_id: 732800
description:
2026-02-02 19:58:53 dovecot_plain authenticator failed for H=(comintanin) [46.47.83.115]:58099: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:58:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64894: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:58:09 dovecot_login authenticator failed for H=(GdgeGFj) [178.16.52.139]:62557: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:58:20 dovecot_login authenticator failed for H=(0cqb0d) [77.83.39.181]:61262: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 19:59:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 19:59:16 dovecot_login authenticator failed for H=(nz4mb9S) [77.83.39.61]:57654: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 19:59:16 dovecot_login authenticator failed for H=(UidfbyH0) [77.83.39.181]:49811: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sestatus.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 122.128.107.48
country_id: 1819730
description:
[2026-02-02 19:59:08 +0800] info [whostmgrd] 122.128.107.48 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 19:59:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57474: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 19:59:13 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (zFGKDl) [34.101.116.145]:59368: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 19:59:10 dovecot_login authenticator failed for H=(jwOpBQ) [178.16.52.139]:61707: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 19:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:00:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:00:07 dovecot_login authenticator failed for H=(vdzC0Offv) [178.16.52.139]:50146: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:00:11 dovecot_login authenticator failed for H=(m0ztnQBZtw) [77.83.39.61]:58961: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:00:13 dovecot_login authenticator failed for H=(Br4E9esRuJ) [77.83.39.181]:55122: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:00:30 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:00:10 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (ggwlj8) [34.101.116.145]:61509: 535 Incorrect authentication data (set_id=yin-jian.lim@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:00:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54228: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:00:52 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:59266: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:00:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:00:08 H=(185.93.89.63) [185.93.89.63]:60291 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <svargo@fpfc.net>: The mail server could not deliver mail to svargo@fpfc.net.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.93.204
country_id: 1168579
description:
2026-02-02 20:00:56 dovecot_login authenticator failed for H=([127.0.0.1]) [163.223.93.204]:48802: 535 Incorrect authentication data (set_id=inf@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:00:04 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (LGiijyK) [34.101.116.145]:61131: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:01:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:01:04 dovecot_login authenticator failed for H=(9sxGCM) [178.16.52.139]:50264: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:01:04 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51041: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:01:07 dovecot_login authenticator failed for H=(GhyT7k) [77.83.39.61]:51399: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.97.131.248
country_id: 1605651
description:
2026-02-02 20:01:09 dovecot_login authenticator failed for H=ppp-171-97-131-248.revip8.asianet.co.th ([127.0.0.1]) [171.97.131.248]:40178: 535 Incorrect authentication data (set_id=inf)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:01:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:01:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:01:10 dovecot_login authenticator failed for H=(hquXk8) [77.83.39.181]:60432: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:01:07 dovecot_login authenticator failed for H=(OISyk8Z) [77.83.39.61]:58792: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:01:12 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (6SgKy1j6) [34.101.116.145]:64330: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.221.233
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?size=1000x1000&src=img/photos/6197804691.jpg HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 20:01:54 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:55050: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:02:05 dovecot_login authenticator failed for H=(2xyG77) [77.83.39.181]:64554: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:02:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:02:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account admin has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:02:47 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60048: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:02:03 dovecot_login authenticator failed for H=(zzqc1ZZOUM) [77.83.39.61]:54607: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:02:03 dovecot_login authenticator failed for H=(DIkvj6o) [77.83.39.61]:54211: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:02:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:02:13 dovecot_login authenticator failed for H=(XzPvY8Oz) [178.16.52.139]:52450: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:02:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (V25kOXjbm) [34.101.116.145]:50060: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:03:43 dovecot_login authenticator failed for H=(LknTOCba) [77.83.39.61]:55220: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:03:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60048: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:03:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:03:16 dovecot_login authenticator failed for H=(G4ncmWO) [178.16.52.139]:63413: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:03:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:03:26 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43538: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 20:03:33 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:57798: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.149.43
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/index.php/c-bible/images/resource/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:03:06 dovecot_login authenticator failed for H=(g7otriZc5z) [77.83.39.61]:51875: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:03:11 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (tR91ZJk) [34.101.116.145]:53048: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:03:19 H=(185.93.89.63) [185.93.89.63]:60768 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <lwoodcox@plastictrends.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:03:20 dovecot_login authenticator failed for H=(sgvpeh) [77.83.39.181]:54379: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:03:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:04:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:04:16 dovecot_login authenticator failed for H=(Dno6FGJ1Id) [77.83.39.181]:58482: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:04:02 dovecot_login authenticator failed for H=(PXD7qWl) [178.16.52.139]:56259: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:04:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:04:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53377: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:04:02 dovecot_login authenticator failed for H=(JTUXJyyD) [77.83.39.61]:55470: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:04:02 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (WoaJ1lA) [34.101.116.145]:55856: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:04:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:04:39 dovecot_login authenticator failed for H=(Rhjct9Yl) [77.83.39.61]:65335: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:05:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:05:20 dovecot_login authenticator failed for H=(qCn5PnwKD) [178.16.52.139]:57556: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:05:30 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49249: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:05:39 dovecot_login authenticator failed for H=(UYi9T2J) [77.83.39.61]:53772: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:05:47 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:05:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:05:10 dovecot_login authenticator failed for H=(Sb8rAM9) [77.83.39.181]:62245: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:05:10 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (2rGZdC) [34.101.116.145]:58581: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:05:11 dovecot_login authenticator failed for H=(nk8brlPz) [77.83.39.61]:50281: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:05:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info@oxbold.com has been temporarily locked by Imunify PAM(77.83.39.181)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:05:20 H=(185.93.89.63) [185.93.89.63]:61294 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <cdgrace@csborbisonia.com>: The mail server could not deliver mail to cdgrace@csborbisonia.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:06:06 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (aYKS2nq) [34.101.116.145]:60656: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:06:55 dovecot_login authenticator failed for H=(8Xa9LXhQH) [77.83.39.61]:61272: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-02-02 20:06:56 dovecot_plain authenticator failed for H=(triels) [88.149.153.106]:55654: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:06:06 dovecot_login authenticator failed for H=(1kmclj97) [77.83.39.181]:50532: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:06:05 dovecot_login authenticator failed for H=(ORW1mK9v) [178.16.52.139]:51155: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:06:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:06:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61200: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.192.69.5
country_id: 2635167
description:
2026-02-02 20:06:35 309488 [Warning] Aborted connection 309488 to db: 'unconnected' user: 'unauthenticated' host: '185.192.69.5' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.121.76.190
country_id: 732800
description:
2026-02-02 20:06:54 dovecot_plain authenticator failed for H=(ampulper) [87.121.76.190]:43397: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:06:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yin-jian.lim has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:06:11 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:06:10 dovecot_login authenticator failed for H=(ONZghZ) [77.83.39.61]:53560: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:06:07 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33912: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 20:07:24 H=([141.98.10.106]) [141.98.10.106]:52700 F=<mselhime@drake-scruggs.com> rejected RCPT <chuan@tschuan.com>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:07:02 dovecot_login authenticator failed for H=(nMbRBmIuGG) [77.83.39.181]:55463: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:07:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:07:07 dovecot_login authenticator failed for H=(Vazy9kcZ) [178.16.52.139]:49401: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:07:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin@cofreth.com.my has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:07:08 dovecot_login authenticator failed for H=(7h3Zvx) [77.83.39.61]:61975: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:07:21 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:07:09 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (z6BV8Nz) [34.101.116.145]:62865: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:07:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58197: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:08:03 dovecot_login authenticator failed for H=(WqwZyxtazQ) [77.83.39.61]:64003: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:08:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:08:16 dovecot_login authenticator failed for H=(hrxYZ3A) [77.83.39.181]:61059: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:08:17 H=(185.93.89.63) [185.93.89.63]:61724 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<mpnmjec@mpnmjec.ac.in> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jmccoy@generationone.com>: The mail server could not deliver mail to jmccoy@generationone.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:08:35 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56978: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:08:18 dovecot_login authenticator failed for H=(fImYJC8iY) [178.16.52.139]:52821: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:08:21 dovecot_login authenticator failed for H=(NZUFTv) [77.83.39.61]:52507: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:08:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:08:36 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:58634: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 20:08:27 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (polocry) [87.103.126.54]:37381: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.96.29
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=4111725259 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:08:05 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (isVsglJ) [34.101.116.145]:64882: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:08:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:09:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:09:22 dovecot_login authenticator failed for H=(5GFVEgf) [178.16.52.139]:53732: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:09:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:09:06 dovecot_login authenticator failed for H=(msl7Zv) [77.83.39.61]:58152: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.205
country_id: 2661886
description:
2026-02-02 20:09:18 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.205]:37354: 535 Incorrect authentication data (set_id=mjason@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:09:57 H=(185.93.89.63) [185.93.89.63]:62210 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <scott.burr@bbgns.com>: The mail server could not deliver mail to scott.burr@bbgns.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:09:47 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (5V9Rqg) [34.101.116.145]:53982: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:09:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:09:08 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (V858zp1o7) [34.101.116.145]:51533: 535 Incorrect authentication data (set_id=kok-hoe.chin@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:09:11 dovecot_login authenticator failed for H=(WkwpGD) [77.83.39.181]:49285: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.249.35.200
country_id: 3017382
description:
2026-02-02 20:09:23 dovecot_login authenticator failed for H=vmi3015057.contaboserver.net ([127.0.0.1]) [173.249.35.200]:36184: 535 Incorrect authentication data (set_id=mjason)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:09:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53199: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.71
country_id: 1562822
description:
2026-02-02 20:09:35 H=([103.237.86.71]) [103.237.86.71]:58122 F=<finance@bumclebanon.com> rejected RCPT <marylinkoh@ktlog.com.my>: SPF: 103.237.86.71 is not allowed to send mail from bumclebanon.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:10:04 dovecot_login authenticator failed for H=(6s4eIxsaYM) [178.16.52.139]:63403: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:10:07 dovecot_login authenticator failed for H=(QFlxb5Z7) [77.83.39.181]:53761: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 20:10:08 H=([141.98.10.106]) [141.98.10.106]:55477 F=<mselhime@drake-scruggs.com> rejected RCPT <info@cordage.com.my>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 20:10:12 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (cauddyng) [87.103.126.54]:13132: 535 Incorrect authentication data (set_id=khairul_aa@ajplantations.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:10:44 dovecot_login authenticator failed for H=(XM2NaB1q8f) [77.83.39.61]:51355: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:10:04 dovecot_login authenticator failed for H=(BdUJxX) [77.83.39.61]:61483: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:10:04 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (W3LN0IAv) [34.101.116.145]:54764: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:10:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:10:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49880: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:10:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:10:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.71
country_id: 1562822
description:
2026-02-02 20:10:08 H=([103.237.86.71]) [103.237.86.71]:59360 F=<finance@bumclebanon.com> rejected RCPT <info@mkmetal.com.my>: SPF: 103.237.86.71 is not allowed to send mail from bumclebanon.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:10:21 H=(185.93.89.63) [185.93.89.63]:62283 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <bprainito@absolutemortgage.com>: The mail server could not deliver mail to bprainito@absolutemortgage.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:11:02 dovecot_login authenticator failed for H=(tXnshJl) [77.83.39.181]:58488: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:11:08 dovecot_login authenticator failed for H=(kUGueJXstK) [178.16.52.139]:51845: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:11:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.212.91.18
country_id: 1814991
description:
2026-02-02 20:11:25 dovecot_login authenticator failed for H=(18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [222.212.91.18]:49539: 535 Incorrect authentication data (set_id=contact@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.109.38.143
country_id: 6252001
description:
2026-02-02 20:11:34 dovecot_login authenticator failed for H=143.38.109.208.host.secureserver.net [208.109.38.143]:55802: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:11:07 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (0AmoLtfsH) [34.101.116.145]:57335: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:11:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61625: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:11:03 dovecot_login authenticator failed for H=(hceqWAY5di) [77.83.39.61]:50531: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:11:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.39.246.184
country_id: 102358
domain: indfinitydesign.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/indfinitydesign.com/?page_id=2 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:11:05 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:55268: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:11:08 H=(185.93.89.63) [185.93.89.63]:62382 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <sabts@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:11:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.237.86.71
country_id: 1562822
description:
2026-02-02 20:11:15 H=([103.237.86.71]) [103.237.86.71]:62212 F=<finance@bumclebanon.com> rejected RCPT <euratech@euratech.com.my>: SPF: 103.237.86.71 is not allowed to send mail from bumclebanon.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:11:56 dovecot_login authenticator failed for H=(Jy16LT86xq) [77.83.39.61]:64620: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:12:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:12:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:12:56 dovecot_login authenticator failed for H=(mStqcTf4) [77.83.39.61]:53134: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:12:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61222: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:13:02 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:12:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (qid1Tht) [34.101.116.145]:59858: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:12:16 dovecot_login authenticator failed for H=(kd0Dq9) [77.83.39.181]:64961: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:12:55 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:12:14 dovecot_login authenticator failed for H=(Lj33J4Nj95) [77.83.39.61]:56971: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:12:07 dovecot_login authenticator failed for H=(VQfnZY) [178.16.52.139]:61920: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:12:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:13:18 dovecot_login authenticator failed for H=(3cuJsnih0) [178.16.52.139]:51304: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:13:21 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51472: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:13:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:13:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:13:06 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (ePTj54) [34.101.116.145]:63485: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:13:10 dovecot_login authenticator failed for H=(IwBDmcnf) [77.83.39.61]:52651: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:13:12 dovecot_login authenticator failed for H=(cpUH7QHT) [77.83.39.181]:53030: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:13:14 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:13:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:13:05 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57218: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:14:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (MNaESCzgR) [34.101.116.145]:50738: 535 Incorrect authentication data (set_id=yin-jian.lim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:14:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53320: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:14:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:14:13 dovecot_login authenticator failed for H=(O3pJH6) [130.12.181.159]:65439: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:14:09 dovecot_login authenticator failed for H=(06HD2GXO) [77.83.39.61]:50084: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.84.23
country_id: 290557
description:
2026-02-02 20:14:58 dovecot_plain authenticator failed for H=(diaskably) [94.205.84.23]:41567: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:14:08 dovecot_login authenticator failed for H=(UGwutzOJ) [77.83.39.181]:57786: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:14:05 dovecot_login authenticator failed for H=(P1eWeW0Fy) [77.83.39.61]:62998: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:14:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:14:03 dovecot_login authenticator failed for H=(KtcumTNcMO) [178.16.52.139]:63809: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:15:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:15:11 dovecot_login authenticator failed for H=(9wg7FEcSux) [178.16.52.139]:49201: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:15:17 dovecot_login authenticator failed for H=(nh1qsHhl) [130.12.181.159]:59090: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:15:04 dovecot_login authenticator failed for H=(anaP2He) [77.83.39.181]:62161: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:15:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49766: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:15:05 dovecot_login authenticator failed for H=(IrJVLE) [77.83.39.61]:53861: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:15:05 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (WfS17Q305) [34.101.116.145]:55119: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 141.98.10.106
country_id: 597427
description:
2026-02-02 20:15:22 H=([141.98.10.106]) [141.98.10.106]:60631 F=<mselhime@drake-scruggs.com> rejected RCPT <sales@chs.com.my>: SPF: 141.98.10.106 is not allowed to send mail from drake-scruggs.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:15:40 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60282: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:15:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:15:05 dovecot_login authenticator failed for H=(3NnHksER) [77.83.39.61]:53857: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 20:15:42 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:55363: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:15:44 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:16:13 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (cc3nMR) [34.101.116.145]:59215: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:16:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:16:16 dovecot_login authenticator failed for H=(cdCNlQsoD) [77.83.39.61]:56796: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 20:16:17 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (chilable) [87.103.126.54]:27272: 535 Incorrect authentication data (set_id=callen@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:16:16 dovecot_login authenticator failed for H=(fdsjl7) [178.16.52.139]:64982: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:16:17 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64365: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-02-02 20:16:30 H=([77.83.39.188]) [77.83.39.188]:23981 F=<mustapa@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.224.171.101
country_id: 6252001
description:
2026-02-02 20:16:32 dovecot_plain authenticator failed for H=c-73-224-171-101.hsd1.fl.comcast.net (rebed) [73.224.171.101]:35962: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:16:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:16:12 H=(185.93.89.63) [185.93.89.63]:63382 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <yxu@jtcc.edu>: The mail server could not deliver mail to yxu@jtcc.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:16:19 dovecot_login authenticator failed for H=(OSnKcVd) [77.83.39.181]:52774: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:16:20 dovecot_login authenticator failed for H=(TcQhMKMF) [130.12.181.159]:63597: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:16:18 dovecot_login authenticator failed for H=(r3QrrXb1x) [77.83.39.61]:58566: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:17:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60692: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-02-02 20:17:33 dovecot_plain authenticator failed for H=(oriatted) [65.20.160.107]:46115: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:17:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:17:07 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:17:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.79.185.164
country_id: 2802361
description:
2026-02-02 20:17:11 dovecot_login authenticator failed for H=164.185.79.34.bc.googleusercontent.com (10.132.0.2) [34.79.185.164]:52065: 535 Incorrect authentication data (set_id=kimmarkpurchase@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:17:16 dovecot_login authenticator failed for H=(sUzzocY) [77.83.39.181]:57691: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:17:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:17:23 dovecot_login authenticator failed for H=(Xc0cLRt20) [130.12.181.159]:49160: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.97.203.163
country_id: 3686110
description:
2026-02-02 20:17:38 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [186.97.203.163]:53836: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:17:04 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (ws93vJAUk) [34.101.116.145]:63009: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:17:11 dovecot_login authenticator failed for H=(xFclSHCW) [178.16.52.139]:57917: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:17:14 dovecot_login authenticator failed for H=(qqtkytkdWx) [77.83.39.61]:62555: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:17:15 dovecot_login authenticator failed for H=(V5TuBTGbX) [77.83.39.61]:60237: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.165.111
country_id: 1835841
description:
2026-02-02 20:17:48 dovecot_login authenticator failed for H=([121.142.165.111]) [121.142.165.111]:47173: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.92.181
country_id: 1562822
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/project-references/project-puncak-gama-klr360-stp.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:18:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:18:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44812: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:18:09 dovecot_login authenticator failed for H=(SABvms51) [77.83.39.61]:50643: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:18:12 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (PreYBS) [34.101.116.145]:51320: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:18:13 dovecot_login authenticator failed for H=(kHFrfz) [77.83.39.181]:62774: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:18:07 dovecot_login authenticator failed for H=(EX47YsrRK) [130.12.181.159]:52616: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:18:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:18:51 H=(185.93.89.63) [185.93.89.63]:63998 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sbradley@wa-emp.com>: The mail server could not deliver mail to sbradley@wa-emp.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:18:10 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57537: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:18:14 dovecot_login authenticator failed for H=(QfUfxrbq) [178.16.52.139]:58653: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:18:27 dovecot_login authenticator failed for H=(EMEFuXA9) [77.83.39.61]:51154: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:19:03 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (91Bh01y9) [34.101.116.145]:54695: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:19:04 dovecot_login authenticator failed for H=(lIv6CDPdU) [77.83.39.61]:63200: 535 Incorrect authentication data (set_id=alex_santiago@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:19:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53864: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.139.168.236
country_id: 2510769
description:
2026-02-02 20:19:13 dovecot_login authenticator failed for H=236.red-2-139-168.staticip.rima-tde.net [2.139.168.236]:59990: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 86.150.100.174
country_id: 2635167
description:
2026-02-02 20:19:23 dovecot_login authenticator failed for H=host86-150-100-174.range86-150.btcentralplus.com [86.150.100.174]:42666: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:19:24 dovecot_login authenticator failed for H=(spie5k) [77.83.39.61]:62924: 535 Incorrect authentication data (set_id=aipeng)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:19:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:19:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:19:14 H=(185.93.89.63) [185.93.89.63]:64097 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <steve.kronmiller@osceolamedicalcenter.com>: host lookup did not complete


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 199.45.155.100
country_id: 6252001
description:
Feb  2 20:19:34 sv3 pure-ftpd[2182471]: (?@199.45.155.100) [INFO] New connection from 199.45.155.100


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.118.205
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=3 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:19:09 dovecot_login authenticator failed for H=(WucyltJbCo) [77.83.39.181]:51076: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:19:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:19:15 dovecot_login authenticator failed for H=(YVtwgsV) [130.12.181.159]:60631: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:19:18 dovecot_login authenticator failed for H=(HJQulj) [178.16.52.139]:50517: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:20:05 dovecot_login authenticator failed for H=(w7Br68) [77.83.39.181]:55571: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:20:16 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.244.253.75
country_id: 3469034
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/project-references/project-wasan-berbuloh-mechanised-rice-scheme.html HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 20:20:32 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:63643: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:20:03 dovecot_login authenticator failed for H=(aBwxjC) [130.12.181.159]:60278: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:20:03 dovecot_login authenticator failed for H=(tIkyja9v) [77.83.39.61]:59107: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:20:38 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45542: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:20:45 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63574: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:20:11 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (J52o8Hn2GW) [34.101.116.145]:59603: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:20:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account cofreth has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:20:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:20:03 dovecot_login authenticator failed for H=(caZWWpm) [178.16.52.139]:52987: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:20:35 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:20:38 dovecot_login authenticator failed for H=(PKOgiHCvUk) [77.83.39.61]:63490: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.213
country_id: 690791
description:
2026-02-02 20:20:38 H=([77.83.39.213]) [77.83.39.213]:54004 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<d.miyamae@guu-farm.co.jp> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.213 is not allowed to send mail from guu-farm.co.jp


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:20:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:20:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:21:20 dovecot_login authenticator failed for H=(fbQ21y) [77.83.39.181]:62084: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.214.108.39
country_id: 3469034
description:
2026-02-02 20:22:01 dovecot_login authenticator failed for H=(b3d66c27.virtua.com.br) [179.214.108.39]:53382: 535 Incorrect authentication data (set_id=test@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:21:07 dovecot_login authenticator failed for H=(m5oGpmkYf0) [130.12.181.159]:50442: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:21:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:21:07 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (ZfYblY0) [34.101.116.145]:63524: 535 Incorrect authentication data (set_id=cofreth)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:21:07 dovecot_login authenticator failed for H=(nWHo78RF) [178.16.52.139]:62918: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:21:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:21:39 H=(185.93.89.63) [185.93.89.63]:64569 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <jvitko@mail.uch.org>: host lookup did not complete


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:21:52 dovecot_login authenticator failed for H=(pWPO4wBrmP) [77.83.39.61]:53296: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:21:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-content/images/login.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:21:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:21:14 dovecot_login authenticator failed for H=(p3lGa1nNUw) [77.83.39.61]:58286: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:21:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59283: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:22:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:22:17 dovecot_login authenticator failed for H=(2lNgKIK) [77.83.39.181]:50380: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-02-02 20:23:02 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (dinathry) [76.157.219.158]:57056: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:22:04 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:22:10 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (IdIPhb6OGX) [34.101.116.145]:52230: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.240
country_id: 2186224
description:
2026-02-02 20:22:12 dovecot_login authenticator failed for H=([121.73.168.240]) [121.73.168.240]:40134: 535 Incorrect authentication data (set_id=test)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:22:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:22:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:22:14 dovecot_login authenticator failed for H=(d7X3an) [130.12.181.159]:59706: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-02-02 20:22:58 dovecot_plain authenticator failed for H=(roacs) [65.20.153.146]:35799: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:22:11 dovecot_login authenticator failed for H=(dUOFNNA) [77.83.39.61]:56817: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:22:16 dovecot_login authenticator failed for H=(Dlcw1O) [178.16.52.139]:58902: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:22:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56654: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 66.23.142.29
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/mke2fs.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 20:23:03 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:23:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:23:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:23:24 dovecot_login authenticator failed for H=(KrFA50dOA) [130.12.181.159]:50336: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:23:24 dovecot_login authenticator failed for H=(LLDWRwW) [178.16.52.139]:54618: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:23:03 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51360: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:23:32 H=(185.93.89.63) [185.93.89.63]:64859 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <kleffel@greenbay.k12.wi.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:23:08 dovecot_login authenticator failed for H=(YdayjgZ) [77.83.39.61]:63778: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:23:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:23:18 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (kO9kDSMb) [34.101.116.145]:55902: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:23:27 dovecot_login authenticator failed for H=(4WXZrZVl) [77.83.39.61]:52483: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 140.233.190.110
country_id: 6252001
description:
2026-02-02 20:23:57 H=([140.233.190.110]) [140.233.190.110]:50355 F=<calvarezs@dualuxcr.com> rejected RCPT <info@oxbold.com>: SPF: 140.233.190.110 is not allowed to send mail from dualuxcr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:23:14 dovecot_login authenticator failed for H=(3rCefm) [77.83.39.181]:55515: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:23:25 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49632: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.0.140
country_id: 2017370
description:
2026-02-02 20:24:48 dovecot_login authenticator failed for H=([31.173.0.140]) [31.173.0.140]:38884: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.188
country_id: 690791
description:
2026-02-02 20:25:01 H=([77.83.39.188]) [77.83.39.188]:38251 F=<inquiries@ktlog.com.my> rejected RCPT <inquiries@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:24:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 34.101.116.145
country_id: 1643084
description:
Feb  2 20:24:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account kok-hoe.chin has been locked for the attacker IP 34.101.116.145


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:24:09 dovecot_login authenticator failed for H=(LPBS725Cm) [77.83.39.181]:60162: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:24:11 dovecot_login authenticator failed for H=(xbB6ZT) [130.12.181.159]:52376: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2026-02-02 20:24:58 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:54705: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:24:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:24:04 dovecot_login authenticator failed for H=(MD6McJUjpm) [77.83.39.61]:50771: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:24:06 dovecot_login authenticator failed for H=(thF4TWCaC) [178.16.52.139]:50271: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:24:09 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (fcYpHc) [34.101.116.145]:58739: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:24:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61505: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:24:19 H=(185.93.89.63) [185.93.89.63]:65157 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mcook@mtlm.com>: The mail server could not deliver mail to mcook@mtlm.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:24:41 dovecot_login authenticator failed for H=(VXsVuk4E) [77.83.39.61]:58255: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.169.206.229
country_id: 2963597
domain: tschuan.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/tschuan/public_html/wp-admin||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:25:54 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:25:27 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54522: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:25:40 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:25:05 dovecot_login authenticator failed for H=(h59Wp9W) [77.83.39.181]:65019: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:25:14 dovecot_login authenticator failed for H=(KGBrn7w) [130.12.181.159]:58258: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:25:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57930: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.101.116.145
country_id: 1643084
description:
2026-02-02 20:25:17 dovecot_login authenticator failed for H=145.116.101.34.bc.googleusercontent.com (aVPTKwYK0) [34.101.116.145]:61560: 535 Incorrect authentication data (set_id=kok-hoe.chin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:25:05 dovecot_login authenticator failed for H=(WQYye7) [178.16.52.139]:64481: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.246.106
country_id: 1269750
description:
2026-02-02 20:25:09 dovecot_login authenticator failed for H=([125.19.172.119]) [125.20.246.106]:37014: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:25:19 dovecot_login authenticator failed for H=(bDL0Qw6fx) [77.83.39.61]:64337: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.47.172.253
country_id: 2287781
description:
2026-02-02 20:25:10 dovecot_plain authenticator failed for H=host-196-47-172-253.afnet.net (egaisiocan) [196.47.172.253]:43737: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:25:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-02-02 20:26:12 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:51396: 535 Incorrect authentication data (set_id=admin@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:26:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54489: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:26:14 dovecot_login authenticator failed for H=(1RmXlULGV) [77.83.39.61]:56901: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:26:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.176.126
country_id: 1269750
description:
2026-02-02 20:26:27 dovecot_login authenticator failed for H=([27.123.119.235]) [122.185.176.126]:59928: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 20:26:30 dovecot_login authenticator failed for H=(t6DfcU) [45.94.31.131]:51085: 535 Incorrect authentication data (set_id=azman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:26:08 dovecot_login authenticator failed for H=(E8iYeQObbi) [178.16.52.139]:54365: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:26:14 dovecot_login authenticator failed for H=(txtwnrGNP5) [77.83.39.61]:51384: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:26:18 dovecot_login authenticator failed for H=(iT4Fprp) [130.12.181.159]:64798: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:26:20 dovecot_login authenticator failed for H=(aWzHIS6rzS) [77.83.39.181]:51778: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.128.209.48
country_id: 3469034
description:
2026-02-02 20:26:47 dovecot_login authenticator failed for H=(138.219.244.10.static.softdados.net) [177.128.209.48]:39600: 535 Incorrect authentication data (set_id=office@wohcheong.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:26:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.227
country_id: 718075
description:
2026-02-02 20:27:45 dovecot_plain authenticator failed for H=([10.239.0.4]) [185.225.28.227]:29311: 535 Incorrect authentication data (set_id=christina.edward@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:27:03 dovecot_login authenticator failed for H=(IalDpkQhI) [130.12.181.159]:64845: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:27:12 dovecot_login authenticator failed for H=(Rwx54zd) [178.16.52.139]:55247: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:27:32 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:27:40 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:27:12 dovecot_login authenticator failed for H=(oUiGpDM) [77.83.39.61]:63231: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:27:19 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53172: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.141.169.99
country_id: 2750405
description:
2026-02-02 20:27:33 dovecot_login authenticator failed for H=99.169.141.34.bc.googleusercontent.com (10.164.0.2) [34.141.169.99]:59146: 535 Incorrect authentication data (set_id=sham@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:27:16 dovecot_login authenticator failed for H=(uYLkaqH) [77.83.39.181]:56683: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:27:53 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43846: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:27:01 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:27:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 20:27:11 dovecot_login authenticator failed for H=(1MlQCJV) [45.94.31.131]:59753: 535 Incorrect authentication data (set_id=azman)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:27:52 dovecot_login authenticator failed for H=(FyQhbFXPJ6) [77.83.39.61]:62185: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:28:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.94.31.131
country_id: 2750405
description:
2026-02-02 20:28:10 dovecot_login authenticator failed for H=(66C5uC) [45.94.31.131]:50440: 535 Incorrect authentication data (set_id=azman)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:28:16 dovecot_login authenticator failed for H=(nW4mPP) [178.16.52.139]:58342: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:28:46 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:28:12 dovecot_login authenticator failed for H=(N4Mr8A) [77.83.39.61]:53351: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:28:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.225.28.227
country_id: 718075
description:
2026-02-02 20:28:04 dovecot_login authenticator failed for H=([10.239.0.4]) [185.225.28.227]:26350: 535 Incorrect authentication data (set_id=christina.edward@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:28:05 dovecot_login authenticator failed for H=(yQB5suZHQi) [130.12.181.159]:56052: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:28:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:28:10 H=(185.93.89.63) [185.93.89.63]:49338 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <echandler@hipage.com>: The mail server could not deliver mail to echandler@hipage.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:28:11 dovecot_login authenticator failed for H=(i9euHDJXB) [77.83.39.181]:54633: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:28:12 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65460: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 20:28:55 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58069: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:29:07 dovecot_login authenticator failed for H=(J1OLSpNvd) [130.12.181.159]:63328: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:29:09 dovecot_login authenticator failed for H=(MAjeQG) [77.83.39.61]:52005: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:29:24 dovecot_login authenticator failed for H=(gonrY9owm) [178.16.52.139]:52596: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:29:08 dovecot_login authenticator failed for H=(TyPEDA) [77.83.39.181]:61305: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:29:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account albertsim@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:29:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55258: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:29:56 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:29:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:29:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:29:13 dovecot_login authenticator failed for H=(dkrzCHfd) [77.83.39.61]:49813: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:30:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.155
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/jquery.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:30:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:30:43 dovecot_login authenticator failed for H=(9OWOfrz) [77.83.39.61]:55536: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:30:11 dovecot_login authenticator failed for H=(M57P7ElEv) [130.12.181.159]:54330: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.213
country_id: 690791
description:
2026-02-02 20:30:12 H=([77.83.39.213]) [77.83.39.213]:62675 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<d.miyamae@guu-farm.co.jp> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.213 is not allowed to send mail from guu-farm.co.jp


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.74
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/modernizr.custom.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.219
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/jquery-plugin-collection.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:30:04 dovecot_login authenticator failed for H=(9txOmQh) [77.83.39.181]:51056: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:30:08 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:30:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50571: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.169.50
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/script.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:30:06 dovecot_login authenticator failed for H=(XCDZDbJ8) [77.83.39.61]:61941: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 130.12.181.159
country_id: 6252001
description:
Feb  2 20:30:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account yennymky@essemgroup.net has been locked for the attacker IP 130.12.181.159


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:30:13 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:45650: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:30:05 dovecot_login authenticator failed for H=(KXaGaead) [178.16.52.139]:49974: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.74
country_id: 2635167
domain: fonts.googleapis.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fonts.googleapis.com/css?family=Lato:300,400,700 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.82.150.172
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/bootstrap.bundle.min.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.206.72.21
country_id: 2635167
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/js/jquery.dlmenu.js HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:31:02 dovecot_login authenticator failed for H=(OGnVC6W1k) [77.83.39.61]:58342: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:31:06 dovecot_login authenticator failed for H=(14FnhapQY) [178.16.52.139]:50460: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:31:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63203: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:31:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:31:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:31:18 dovecot_login authenticator failed for H=(DCgytb) [77.83.39.181]:57756: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 20:31:44 +0800] info [cpaneld] 185.204.54.153 - krisfood "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:31:18 dovecot_login authenticator failed for H=(I4OEkZm7te) [130.12.181.159]:60447: 535 Incorrect authentication data (set_id=yennymky@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:32:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59392: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:32:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:32:14 dovecot_login authenticator failed for H=(CR0sU3) [77.83.39.181]:62086: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.12.181.159
country_id: 6252001
description:
2026-02-02 20:32:02 dovecot_login authenticator failed for H=(Wvs84Ijz) [130.12.181.159]:58996: 535 Incorrect authentication data (set_id=albertsim@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:32:19 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:32:44 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:52518: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.165
country_id: 99237
description:
2026-02-02 20:32:52 dovecot_plain authenticator failed for H=(hypers) [65.20.148.165]:48546: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:32:11 dovecot_login authenticator failed for H=(woj5yNmR5) [178.16.52.139]:56243: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:32:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:32:16 dovecot_login authenticator failed for H=(fVNfWU) [77.83.39.61]:59773: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:32:27 H=(185.93.89.63) [185.93.89.63]:50240 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tberry@jtcc.edu>: The mail server could not deliver mail to tberry@jtcc.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:32:15 dovecot_login authenticator failed for H=(S1vjS52uj) [77.83.39.61]:52409: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.104.50.190
country_id: 1562822
description:
2026-02-02 20:33:09 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.104.50.190]:58576: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:33:10 dovecot_login authenticator failed for H=(IfBvusU) [178.16.52.139]:53259: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:33:10 dovecot_login authenticator failed for H=(rhhrH7I) [77.83.39.181]:50399: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.239.182
country_id: 1269750
description:
2026-02-02 20:33:25 dovecot_login authenticator failed for H=(aes-static-177.143.22.125.airtel.in) [128.185.239.182]:35344: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.77
country_id: 1814991
description:
2026-02-02 20:33:37 dovecot_login authenticator failed for H=([111.26.101.76]) [111.26.101.77]:43882: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:33:03 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56575: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:33:33 dovecot_login authenticator failed for H=(Ro3NArpTe8) [77.83.39.61]:62138: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.126.144.30
country_id: 6252001
description:
2026-02-02 20:33:57 dovecot_login authenticator failed for H=ool-457e901e.dyn.optonline.net [69.126.144.30]:59917: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:33:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:33:11 dovecot_login authenticator failed for H=(ySKaCu) [77.83.39.61]:57378: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:33:30 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:34:07 dovecot_login authenticator failed for H=(v8NmbW) [77.83.39.181]:55920: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:34:06 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:34:07 dovecot_login authenticator failed for H=(n6r88EKOcS) [77.83.39.61]:57234: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.171.131.246
country_id: 6252001
description:
2026-02-02 20:34:48 dovecot_plain authenticator failed for H=(r1qdk8vxf7fpt68vloy0s4) [142.171.131.246]:43960: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:34:20 H=(185.93.89.63) [185.93.89.63]:50798 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <sulliva@pi.cpmc.columbia.edu>: The mail server could not deliver mail to sulliva@pi.cpmc.columbia.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/img/demos/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:34:10 dovecot_login authenticator failed for H=(4KltRqKB9) [178.16.52.139]:63863: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:34:38 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65056: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:35:02 dovecot_login authenticator failed for H=(YThknXR1g) [77.83.39.61]:55937: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:35:02 dovecot_login authenticator failed for H=(s1OeH1) [77.83.39.61]:58598: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:35:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account alex_santiago has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:35:04 dovecot_login authenticator failed for H=(FfaKT4A) [77.83.39.181]:61679: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:35:30 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54652: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:35:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62263: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:35:03 dovecot_login authenticator failed for H=(KmI3SZl) [178.16.52.139]:62274: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:35:05 H=(185.93.89.63) [185.93.89.63]:50924 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jerodb@interlectric.com>: The mail server could not deliver mail to jerodb@interlectric.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:35:08 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:36:16 dovecot_login authenticator failed for H=(MFBReqc) [178.16.52.139]:54944: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-02-02 20:36:02 dovecot_login authenticator failed for H=([65.20.149.26]) [65.20.149.26]:57028: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.245.175
country_id: 3469034
description:
2026-02-02 20:37:01 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [186.215.245.175]:60699: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.95.14.102
country_id: 1835841
description:
2026-02-02 20:37:01 dovecot_login authenticator failed for H=([220.95.14.102]) [220.95.14.102]:51074: 535 Incorrect authentication data (set_id=support@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.56.179.201
country_id: 1814991
description:
2026-02-02 20:36:16 dovecot_login authenticator failed for H=([183.56.179.201]) [183.56.179.201]:39964: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/plug/sms/img/new-development.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:36:37 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:59094: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:36:34 dovecot_login authenticator failed for H=(KQcuI92y4) [77.83.39.61]:61092: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:36:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:36:16 dovecot_login authenticator failed for H=(OwxFISvVF) [77.83.39.61]:59752: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:36:19 dovecot_login authenticator failed for H=(TP9GXWaBw1) [77.83.39.181]:52978: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:36:31 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.24.164
country_id: 2017370
description:
2026-02-02 20:37:09 dovecot_login authenticator failed for H=([91.146.24.164]) [91.146.24.164]:57800: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:37:11 dovecot_login authenticator failed for H=(EAdB7lR) [77.83.39.61]:57299: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:37:12 dovecot_login authenticator failed for H=(UGgKbXgXz) [178.16.52.139]:52415: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:37:23 H=(185.93.89.63) [185.93.89.63]:51253 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kprendergast@perfectfitindustries.com>: The mail server could not deliver mail to kprendergast@perfectfitindustries.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:37:39 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:37:53 dovecot_login authenticator failed for H=(8fuj0T8lJ) [77.83.39.61]:51403: 535 Incorrect authentication data (set_id=alex_santiago)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:37:16 dovecot_login authenticator failed for H=(ZlzgL9zT) [77.83.39.181]:57969: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-02-02 20:37:17 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [201.46.124.0]:1549: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:37:32 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56045: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:37:57 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:51206: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:38:06 dovecot_login authenticator failed for H=(6ENodzr) [77.83.39.61]:58749: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:38:09 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:38:10 dovecot_login authenticator failed for H=(YoP6U4) [178.16.52.139]:57999: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:38:11 dovecot_login authenticator failed for H=(4EIFkaG) [77.83.39.181]:63044: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.224.147
country_id: 1880251
domain: ajplantations.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home/ajpl3424/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:38:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57760: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:38:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:39:08 dovecot_login authenticator failed for H=(zKqf2DZ) [178.16.52.139]:56749: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:39:34 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56838: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:39:07 dovecot_login authenticator failed for H=(J1rKTZ) [77.83.39.181]:51606: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.230.197
country_id: 1880251
domain: aire-fresh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/airefresh/public_html/wp-includes||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:39:49 H=(185.93.89.63) [185.93.89.63]:51879 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <emark@co.boulder.co.us>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.38
country_id: 1835841
description:
2026-02-02 20:39:57 dovecot_login authenticator failed for H=([61.72.145.38]) [61.72.145.38]:42589: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:39:56 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:39:22 dovecot_login authenticator failed for H=(RCAMRXizp) [77.83.39.61]:51181: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:39:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:39:37 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:39:04 dovecot_login authenticator failed for H=(DcSk2pQ4E) [77.83.39.61]:57037: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.83.98
country_id: 1269750
description:
2026-02-02 20:40:10 dovecot_login authenticator failed for H=([182.79.83.98]) [182.79.83.98]:59766: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:40:11 dovecot_login authenticator failed for H=(UUbwuT43N) [178.16.52.139]:52181: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:40:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:40:15 dovecot_login authenticator failed for H=(hbzmHflUp) [77.83.39.61]:57237: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:40:20 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:40:28 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41386: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:40:29 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53297: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:40:03 dovecot_login authenticator failed for H=(DJIihi3x7) [77.83.39.181]:56842: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:41:43 H=(185.93.89.63) [185.93.89.63]:52173 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <ssmith@telleen.com>: The mail server could not deliver mail to ssmith@telleen.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:41:27 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49507: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:41:17 dovecot_login authenticator failed for H=(I3qzFKnpl) [77.83.39.181]:63232: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.93
country_id: 690791
description:
2026-02-02 20:41:20 H=([77.83.39.93]) [77.83.39.93]:60179 F=<Vanessa.Wang@skf.com> rejected RCPT <aoto@aoto.com.my>: SPF: 77.83.39.93 is not allowed to send mail from skf.com


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:41:31 dovecot_login authenticator failed for H=(CTdHnqTn6F) [77.83.39.61]:61760: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 20:41:05 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:41:11 dovecot_login authenticator failed for H=(0HuoM2) [77.83.39.61]:55772: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:41:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:41:17 dovecot_login authenticator failed for H=(0dO2oFm6vH) [178.16.52.139]:53658: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.204.54.153
country_id: 6252001
description:
[2026-02-02 20:41:03 +0800] info [cpaneld] 185.204.54.153 - masaakis "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user masaakis (has_cpuser_file failed)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:41:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:42:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:42:21 dovecot_login authenticator failed for H=(uRWbsdEUw3) [178.16.52.139]:55270: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.18
country_id: 2542007
description:
2026-02-02 20:42:44 dovecot_plain authenticator failed for H=(scuraler) [102.53.15.18]:59850: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:42:06 dovecot_login authenticator failed for H=(GCpCK8Jj) [77.83.39.61]:63681: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:42:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.248.192.204
country_id: 1269750
description:
[2026-02-02 20:42:39 +0800] info [whostmgrd] 49.248.192.204 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:42:55 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:43254: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.149.153.106
country_id: 3175395
description:
2026-02-02 20:42:39 dovecot_plain authenticator failed for H=(exiliase) [88.149.153.106]:38052: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:42:46 H=(185.93.89.63) [185.93.89.63]:52310 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <lleh@nwhosp.com>: The mail server could not deliver mail to lleh@nwhosp.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-02-02 20:42:06 H=([45.144.212.41]) [45.144.212.41]:64095 F=<sales@factmr.com> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from factmr.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:42:13 dovecot_login authenticator failed for H=(Tjh18TVV) [77.83.39.181]:51265: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:42:21 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62251: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:43:09 dovecot_login authenticator failed for H=(7q1g1ajY) [178.16.52.139]:57049: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:43:13 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60845: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:43:03 dovecot_login authenticator failed for H=(6TpJMH) [77.83.39.61]:65528: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:43:55 H=(185.93.89.63) [185.93.89.63]:52532 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <chris@cornett-ims.com>: The mail server could not deliver mail to chris@cornett-ims.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:43:08 dovecot_login authenticator failed for H=(FoCHPb2V1H) [77.83.39.181]:56321: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:43:19 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:43:39 dovecot_login authenticator failed for H=(T1TaZ6J) [77.83.39.61]:56179: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:44:01 H=(185.93.89.63) [185.93.89.63]:52609 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <rbarba@bordermetalstamping.com>: The mail server could not deliver mail to rbarba@bordermetalstamping.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:44:16 dovecot_login authenticator failed for H=(HRg5pGm) [77.83.39.61]:50760: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 69.123.224.8
country_id: 6252001
description:
[2026-02-02 20:44:41 +0800] info [whostmgrd] 69.123.224.8 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:45:00 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:44:03 dovecot_login authenticator failed for H=(i290VTxd) [178.16.52.139]:61427: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:44:04 dovecot_login authenticator failed for H=(Fyn2jLDotZ) [77.83.39.181]:60437: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:44:10 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56474: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.52.119.193
country_id: 6252001
description:
2026-02-02 20:44:10 dovecot_plain authenticator failed for H=c-68-52-119-193.hsd1.tn.comcast.net (blest) [68.52.119.193]:44416: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:44:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-02-02 20:45:27 dovecot_plain authenticator failed for H=(ametitylly) [207.254.29.22]:62389: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2026-02-02 20:45:39 dovecot_login authenticator failed for H=([218.75.123.109]) [183.247.171.186]:45134: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:45:36 H=(185.93.89.63) [185.93.89.63]:52979 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <tromano@newcenturybk.com>: The mail server could not deliver mail to tromano@newcenturybk.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-02-02 20:45:05 dovecot_login authenticator failed for H=([123.212.9.122]) [123.212.9.122]:52773: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:45:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53174: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:45:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:45:12 dovecot_login authenticator failed for H=(cdDNrlnJV) [77.83.39.61]:59425: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.237.70.75
country_id: 2661886
description:
2026-02-02 20:45:33 dovecot_login authenticator failed for H=([127.0.0.1]) [194.237.70.75]:54926: 535 Incorrect authentication data (set_id=vekamodu@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:45:22 dovecot_login authenticator failed for H=(AdrBsp) [178.16.52.139]:58567: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:45:49 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:45:11 dovecot_login authenticator failed for H=(AnYU8rS2) [77.83.39.61]:59417: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:45:18 dovecot_login authenticator failed for H=(hQ0Q6y) [77.83.39.181]:51680: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:45:19 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:41000: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.241.138.174
country_id: 1562822
description:
2026-02-02 20:45:40 dovecot_login authenticator failed for H=([127.0.0.1]) [171.241.138.174]:39591: 535 Incorrect authentication data (set_id=vekamodu)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:46:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:46:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64878: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:46:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:46:14 dovecot_login authenticator failed for H=(sBrp5Fdc) [77.83.39.61]:54315: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:46:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:46:06 dovecot_login authenticator failed for H=(Un9JWzGvJn) [77.83.39.61]:55091: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.151.36
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=91191527239694 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:46:14 dovecot_login authenticator failed for H=(LpuEyS) [77.83.39.181]:56827: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 20:46:18 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:63671: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:46:20 dovecot_login authenticator failed for H=(mWfn9L1) [178.16.52.139]:62259: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-02-02 20:47:16 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (creephailt) [87.103.126.54]:23910: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:47:24 dovecot_login authenticator failed for H=(NcD9cE2kv7) [178.16.52.139]:57613: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:47:04 dovecot_login authenticator failed for H=(I4hNaZ) [77.83.39.61]:55658: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:47:23 dovecot_login authenticator failed for H=(hSJ9cG) [77.83.39.61]:60975: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:47:15 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60325: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-02-02 20:47:20 dovecot_plain authenticator failed for H=(stermiss) [65.20.149.93]:47104: 535 Incorrect authentication data (set_id=takao-nakashima@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:47:26 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:47:48 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53140: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:47:58 dovecot_login authenticator failed for H=(Ps59POFG) [141.98.11.11]:55607: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:47:09 dovecot_login authenticator failed for H=(DantXpXB7C) [77.83.39.181]:61581: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:47:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:47:24 H=(185.93.89.63) [185.93.89.63]:53227 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <thomas.dunbar@alegent.com>: host lookup did not complete


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.84.23
country_id: 290557
description:
2026-02-02 20:47:43 dovecot_plain authenticator failed for H=(molmously) [94.205.84.23]:54212: 535 Incorrect authentication data (set_id=hvoon@stonewld.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:47:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:48:04 dovecot_login authenticator failed for H=(LViaPD) [77.83.39.61]:51570: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:48:14 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56426: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:48:23 dovecot_login authenticator failed for H=(LJgfr1yN4z) [77.83.39.61]:64120: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:48:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:48:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:48:32 dovecot_login authenticator failed for H=(scwSZ0b07Z) [141.98.11.11]:60400: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.15.178
country_id: 290557
description:
2026-02-02 20:48:58 dovecot_plain authenticator failed for H=(sacks) [5.31.15.178]:58505: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:48:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:48:05 dovecot_login authenticator failed for H=(UAV1C8) [77.83.39.181]:49958: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:48:39 H=(185.93.89.63) [185.93.89.63]:53460 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <gadams@ahadirect.com>: The mail server could not deliver mail to gadams@ahadirect.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.157.219.158
country_id: 6252001
description:
2026-02-02 20:48:55 dovecot_plain authenticator failed for H=c-76-157-219-158.hsd1.il.comcast.net (addle) [76.157.219.158]:60150: 535 Incorrect authentication data (set_id=adeline@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:48:07 dovecot_login authenticator failed for H=(n7Hf0Zh) [178.16.52.139]:57430: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:49:09 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65389: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:49:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:49:12 dovecot_login authenticator failed for H=(MUNqAaQbk) [77.83.39.61]:52603: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 20:49:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:49:14 dovecot_login authenticator failed for H=(Ox3UsAi) [178.16.52.139]:56727: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:49:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.207.15.25
country_id: 1269750
description:
2026-02-02 20:50:00 dovecot_login authenticator failed for H=(49.207.15.25.actcorp.in) [49.207.15.25]:63255: 535 Incorrect authentication data (set_id=contact@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:49:20 dovecot_login authenticator failed for H=(fYksJVbbs8) [77.83.39.181]:55645: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:49:29 dovecot_login authenticator failed for H=(BEHPMw7fD) [141.98.11.11]:58942: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:49:33 dovecot_login authenticator failed for H=(atsyXeMm) [77.83.39.61]:63775: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:50:16 dovecot_login authenticator failed for H=(6ZoSl2H1CN) [77.83.39.181]:60366: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:50:32 dovecot_login authenticator failed for H=(tANvOA0c) [77.83.39.61]:49869: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.92.55
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=72&page=7 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:50:53 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.57.70.191
country_id: 1814991
description:
2026-02-02 20:50:13 dovecot_login authenticator failed for H=([203.57.70.191]) [203.57.70.191]:44458: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:50:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info@oxbold.com has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 20:50:58 dovecot_plain authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:63668: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:50:11 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:47964: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:50:25 dovecot_login authenticator failed for H=(b6SHAy1VM) [141.98.11.11]:58606: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:50:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:50:08 dovecot_login authenticator failed for H=(06b85n) [77.83.39.61]:61596: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:50:32 H=(185.93.89.63) [185.93.89.63]:53988 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <llauth@expertproducts.com>: The mail server could not deliver mail to llauth@expertproducts.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:50:07 dovecot_login authenticator failed for H=(0ZiA0xb5F) [178.16.52.139]:63689: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:51:45 H=(185.93.89.63) [185.93.89.63]:54152 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <lynch_n@westcler.org>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:51:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.60.31.166
country_id: 2921044
description:
2026-02-02 20:51:04 dovecot_login authenticator failed for H=(c10712.servers.ecomdata.de) [212.60.31.166]:63668: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:51:07 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55453: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:51:11 dovecot_login authenticator failed for H=(XXSKF0gi) [77.83.39.181]:65167: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:51:40 dovecot_login authenticator failed for H=(rCz6etat) [141.98.11.11]:65034: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:51:42 dovecot_login authenticator failed for H=(96vzVw) [77.83.39.61]:54019: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 20:51:19 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:59367: 535 Incorrect authentication data (set_id=cass@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:51:03 dovecot_login authenticator failed for H=(wwUKlV5) [178.16.52.139]:57007: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:51:04 dovecot_login authenticator failed for H=(bgPcnxdJ7l) [77.83.39.61]:52086: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:52:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53230: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:52:08 H=(185.93.89.63) [185.93.89.63]:54224 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <richardv@milwaukeechaplet.com>: The mail server could not deliver mail to richardv@milwaukeechaplet.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:52:12 dovecot_login authenticator failed for H=(YlNJXklfP) [141.98.11.11]:58268: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:52:07 dovecot_login authenticator failed for H=(GKBwokJt81) [77.83.39.181]:52779: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:52:25 dovecot_login authenticator failed for H=(SpAPL1U) [178.16.52.139]:51077: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:52:41 dovecot_login authenticator failed for H=(832CukLy) [77.83.39.61]:55637: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-02-02 20:52:50 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:59546: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:52:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:52:05 dovecot_login authenticator failed for H=(A22Jx0) [77.83.39.61]:49531: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:52:41 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50212: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 20:53:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lsst has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:53:10 dovecot_login authenticator failed for H=(eqKCm0wUkI) [178.16.52.139]:60373: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:53:21 dovecot_login authenticator failed for H=(L6zyJB9UR) [77.83.39.181]:60554: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.196.144.25
country_id: 6252001
description:
2026-02-02 20:53:06 dovecot_plain authenticator failed for H=c-73-196-144-25.hsd1.nj.comcast.net (dodeckful) [73.196.144.25]:43064: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:53:14 dovecot_login authenticator failed for H=(v5qVQJqJ) [77.83.39.61]:53017: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:53:39 H=(185.93.89.63) [185.93.89.63]:54431 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mennis@businessbankva.com>: The mail server could not deliver mail to mennis@businessbankva.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:53:07 dovecot_login authenticator failed for H=(ptt5Wo3) [141.98.11.11]:50365: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 20:53:31 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:55098: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:53:05 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51787: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:53:12 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:53:51 dovecot_login authenticator failed for H=(P0xfH4) [77.83.39.61]:55160: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 20:54:06 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:54:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:54:16 dovecot_login authenticator failed for H=(zJGxoCsqJ) [77.83.39.181]:65511: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 20:54:21 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lsst has been locked for the attacker IP 141.98.11.11


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:54:23 dovecot_login authenticator failed for H=(fOe4NAn) [141.98.11.11]:57916: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:54:44 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63046: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:54:51 dovecot_login authenticator failed for H=(65Juvt9pK) [77.83.39.61]:53006: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:54:09 dovecot_login authenticator failed for H=(fQBjcbwtiU) [77.83.39.61]:59881: 535 Incorrect authentication data (set_id=aniza)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.82.110
country_id: 1562822
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/career.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:54:24 dovecot_login authenticator failed for H=(tVRRR4Wgl) [178.16.52.139]:54882: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:55:37 dovecot_login authenticator failed for H=(fWaqAs) [141.98.11.11]:52718: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:55:05 dovecot_login authenticator failed for H=(WOxQmj) [178.16.52.139]:57024: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:55:08 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:54450: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.72.57.248
country_id: 3703430
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-token-stream/tests/TokenTest.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:55:40 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58774: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:56:01 dovecot_login authenticator failed for H=(fBYjF7E) [77.83.39.61]:50394: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:55:05 dovecot_login authenticator failed for H=(D0U4R4GxK) [77.83.39.61]:62580: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:55:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 20:55:35 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account lsst has been locked for the attacker IP 141.98.11.11


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 182.48.94.107
country_id: 1210997
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/run/NetworkManager/resolv.conf||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:56:03 H=(185.93.89.63) [185.93.89.63]:55025 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <kristen.giessler@averionintl.com>: The mail server could not deliver mail to kristen.giessler@averionintl.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:55:11 dovecot_login authenticator failed for H=(dwdUHS3H0W) [77.83.39.181]:55136: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:56:07 dovecot_login authenticator failed for H=(dWPRpa59) [77.83.39.181]:59369: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:56:06 dovecot_login authenticator failed for H=(Gzq1tmk8z) [77.83.39.61]:55241: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:56:09 dovecot_login authenticator failed for H=(NefdkM5SLT) [141.98.11.11]:60283: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:56:18 dovecot_login authenticator failed for H=(vZrWV6) [178.16.52.139]:62395: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:56:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.220.169.113
country_id: 2635167
description:
2026-02-02 20:56:40 dovecot_login authenticator failed for H=(165-220-169-113.cust.exede.net) [165.220.169.113]:43099: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:56:42 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.60.146
country_id: 1269750
description:
2026-02-02 20:56:13 dovecot_login authenticator failed for H=([182.95.60.146]) [182.95.60.146]:43676: 535 Incorrect authentication data (set_id=office@ocned.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:57:01 dovecot_login authenticator failed for H=(SmoWV2KWn) [77.83.39.61]:59261: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:56:41 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54609: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:57:02 dovecot_login authenticator failed for H=(ycIFUAx) [77.83.39.181]:63731: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:57:09 dovecot_login authenticator failed for H=(7SxJ66W) [178.16.52.139]:56214: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 20:57:45 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:33322: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:57:12 dovecot_login authenticator failed for H=(tFBY16cB) [141.98.11.11]:50613: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:57:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:57:15 dovecot_login authenticator failed for H=(fwJC0dX8) [77.83.39.61]:51445: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.208.106.89
country_id: 6252001
description:
2026-02-02 20:57:29 dovecot_login authenticator failed for H=71-208-106-89.ftmy.qwest.net ([127.0.0.1]) [71.208.106.89]:38068: 535 Incorrect authentication data (set_id=achigold@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.155.113
country_id: 1814991
description:
2026-02-02 20:57:39 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.155.113]:52566: 535 Incorrect authentication data (set_id=achigold)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.173.31.66
country_id: 2017370
description:
2026-02-02 20:58:00 dovecot_plain authenticator failed for H=(baries) [31.173.31.66]:50692: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:57:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:57:46 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52497: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:58:08 dovecot_login authenticator failed for H=(T9c6q81rhO) [178.16.52.139]:64254: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:58:11 dovecot_login authenticator failed for H=(Ymf3YhAKpG) [77.83.39.61]:59530: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:58:36 dovecot_login authenticator failed for H=(XCJB55D) [141.98.11.11]:51972: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:58:02 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52497: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:58:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:58:11 dovecot_login authenticator failed for H=(ryRrmk1Rs) [77.83.39.61]:59528: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:58:14 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:58:16 dovecot_login authenticator failed for H=(Qu4XEmN4QN) [77.83.39.181]:54730: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 20:59:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 20:59:10 dovecot_login authenticator failed for H=(QzYqjG) [141.98.11.11]:59811: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 20:59:13 dovecot_login authenticator failed for H=(F2q5nECI) [77.83.39.181]:60167: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.113.155.132
country_id: 690791
description:
2026-02-02 20:59:09 dovecot_plain authenticator failed for H=(inglotical) [176.113.155.132]:38509: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:59:10 dovecot_login authenticator failed for H=(ZnlXeb1) [77.83.39.61]:57163: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 20:59:12 dovecot_login authenticator failed for H=(h0Biz3wyC) [178.16.52.139]:62813: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 20:59:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.125.212
country_id: 690791
description:
2026-02-02 20:59:04 dovecot_plain authenticator failed for H=(unpercente) [178.165.125.212]:15718: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 20:59:05 dovecot_login authenticator failed for H=(TBWfD552) [77.83.39.61]:53584: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.36.41.213
country_id: 2017370
description:
2026-02-02 20:59:05 dovecot_login authenticator failed for H=([78.36.41.213]) [78.36.41.213]:54341: 535 Incorrect authentication data (set_id=contacto@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 20:59:42 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60974: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 20:59:54 H=(185.93.89.63) [185.93.89.63]:55838 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <richard.brzezinski@nmg.sms.siemens.com>: The mail server could not deliver mail to richard.brzezinski@nmg.sms.siemens.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:00:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:00:15 dovecot_login authenticator failed for H=(AaPxW5iQ) [178.16.52.139]:60094: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:00:16 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46924: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:00:19 dovecot_login authenticator failed for H=(dlW9yZQK) [141.98.11.11]:49458: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:00:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:57284: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:00:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc@ajplantations.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:00:05 dovecot_login authenticator failed for H=(qGQixOho) [77.83.39.61]:55541: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:00:09 dovecot_login authenticator failed for H=(LUfPA1BD3) [77.83.39.181]:63882: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:00:22 H=(185.93.89.63) [185.93.89.63]:55904 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <redwards@edwardsconstruction.com>: The mail server could not deliver mail to redwards@edwardsconstruction.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:00:55 dovecot_login authenticator failed for H=(3hrtX8) [77.83.39.61]:55631: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.13.28.247
country_id: 1814991
description:
2026-02-02 21:01:30 dovecot_login authenticator failed for H=([127.0.0.1]) [27.13.28.247]:43692: 535 Incorrect authentication data (set_id=limls)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:01:02 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:01:03 H=(185.93.89.63) [185.93.89.63]:55997 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <daphne@teambutashomes.com>: The mail server could not deliver mail to daphne@teambutashomes.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:01:05 dovecot_login authenticator failed for H=(48fDzVCj) [77.83.39.61]:50581: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.123.109.43
country_id: 732800
description:
2026-02-02 21:01:07 dovecot_login authenticator failed for H=(ADMIN) [93.123.109.43]:43442: 535 Incorrect authentication data (set_id=info@aircarbonic.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:01:23 dovecot_login authenticator failed for H=(sKJRA7OeT) [178.16.52.139]:58006: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:01:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53016: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.130
country_id: 1269750
description:
2026-02-02 21:01:53 dovecot_login authenticator failed for H=(mail1.i-megh.com) [182.95.182.130]:58422: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:01:04 dovecot_login authenticator failed for H=(StaIHrh) [77.83.39.181]:52829: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:01:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-02-02 21:01:38 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([127.0.0.1]) [218.103.36.176]:61416: 535 Incorrect authentication data (set_id=jesslim@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.70.24.131
country_id: 2017370
description:
2026-02-02 21:01:44 dovecot_login authenticator failed for H=([127.0.0.1]) [178.70.24.131]:43693: 535 Incorrect authentication data (set_id=jesslim)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.254.84.120
country_id: 1562822
description:
2026-02-02 21:01:23 dovecot_login authenticator failed for H=([127.0.0.1]) [222.254.84.120]:37892: 535 Incorrect authentication data (set_id=limls@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:01:29 dovecot_login authenticator failed for H=(Hulawg78tr) [141.98.11.11]:63761: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:01:42 dovecot_login authenticator failed for H=(gJugp6tI6) [77.83.39.61]:55562: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:02:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:65293: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:02:22 H=(185.93.89.63) [185.93.89.63]:56175 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <denis@wwstar.com>: The mail server could not deliver mail to denis@wwstar.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:02:15 dovecot_login authenticator failed for H=(Z0nhwi) [178.16.52.139]:55415: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:02:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:02:09 dovecot_login authenticator failed for H=(Wk3oNnp9xn) [77.83.39.61]:54653: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:02:18 dovecot_login authenticator failed for H=(BjncRFuboz) [77.83.39.181]:59713: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:02:56 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:44442: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.239.84.130
country_id: 2017370
description:
2026-02-02 21:02:03 dovecot_login authenticator failed for H=([83.239.84.130]) [83.239.84.130]:57960: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:02:35 dovecot_login authenticator failed for H=(lGkS1G) [77.83.39.61]:49288: 535 Incorrect authentication data (set_id=chewkc@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:02:07 dovecot_login authenticator failed for H=(RoUYG1p) [141.98.11.11]:50573: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:03:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:03:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:55793: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 48.218.160.155
country_id: 1861060
domain: mail.nexuscollection.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home2/nexus2019/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:03:06 dovecot_login authenticator failed for H=(tQBGJhi2i) [77.83.39.61]:64323: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:03:10 dovecot_login authenticator failed for H=(92CihF) [141.98.11.11]:54788: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:03:15 dovecot_login authenticator failed for H=(MbNSXq2j8R) [77.83.39.181]:65254: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:03:20 dovecot_login authenticator failed for H=(5rzdH96Lm) [178.16.52.139]:62405: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:03:30 dovecot_login authenticator failed for H=(eLvB64MrQ) [77.83.39.61]:55855: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:04:10 H=(185.93.89.63) [185.93.89.63]:56477 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <gennen@tribune.com>: The mail server could not deliver mail to gennen@tribune.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:04:39 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:54070: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:04:07 dovecot_login authenticator failed for H=(v3t63tu) [178.16.52.139]:53388: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:04:08 dovecot_login authenticator failed for H=(iggtzLyi) [77.83.39.61]:51828: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:04:20 dovecot_login authenticator failed for H=(tnOyACAR) [77.83.39.61]:63393: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:04:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate@mssa.org.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:04:12 dovecot_login authenticator failed for H=(7fSHBROTe) [77.83.39.181]:55006: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:04:30 dovecot_login authenticator failed for H=(rxvmOCPlCp) [141.98.11.11]:60276: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:04:48 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:05:32 H=(185.93.89.63) [185.93.89.63]:56887 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <scentimental@alltel.net>: host lookup did not complete


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 58.8.48.178
country_id: 1605651
description:
Feb  2 21:05:34 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(58.8.48.178)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:05:32 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:60936: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-02-02 21:05:36 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th [58.8.48.178]:46927: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.27.76.210
country_id: 3469034
description:
2026-02-02 21:05:49 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [177.27.76.210]:33226: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:05:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate@mssa.org.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:05:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:05:07 dovecot_login authenticator failed for H=(DtoX2VJJR) [178.16.52.139]:61375: 535 Incorrect authentication data (set_id=png-sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:05:15 dovecot_login authenticator failed for H=(9F8965k) [77.83.39.61]:52108: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.16.52
country_id: 1168579
description:
2026-02-02 21:05:25 dovecot_login authenticator failed for H=([103.79.16.52]) [103.79.16.52]:41220: 535 Incorrect authentication data (set_id=info@wohcheong.com.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 177.27.76.210
country_id: 3469034
description:
Feb  2 21:05:47 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account info has been temporarily locked by Imunify PAM(177.27.76.210)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:05:04 dovecot_login authenticator failed for H=(dtb5wIUkVI) [77.83.39.61]:62061: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:05:05 dovecot_login authenticator failed for H=(YwP48G2) [141.98.11.11]:57910: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:05:09 dovecot_login authenticator failed for H=(ttO3QEy) [77.83.39.181]:61383: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:05:36 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:50769: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:06:03 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:06:11 dovecot_login authenticator failed for H=(NyijDA) [77.83.39.61]:61640: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:06:31 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61996: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:06:05 dovecot_login authenticator failed for H=(oAD4Ha) [77.83.39.181]:50215: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:06:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:06:12 dovecot_login authenticator failed for H=(QoF3UMU) [178.16.52.139]:50661: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:06:11 dovecot_login authenticator failed for H=(td9FG8Z6) [141.98.11.11]:57566: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.1.69.150
country_id: 2464461
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/classes/Swift/CharacterStream.php HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:06:57 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:06:57 dovecot_login authenticator failed for H=(0jnl4v8) [77.83.39.61]:64507: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:06:06 H=(185.93.89.63) [185.93.89.63]:56983 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<mpnmjec@mpnmjec.ac.in> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <jean@svbrokers.com>: The mail server could not deliver mail to jean@svbrokers.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.139.224.147
country_id: 1880251
domain: mail.uumism.edu.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/uumismed/public_html/wp-admin||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:07:16 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:07:06 dovecot_login authenticator failed for H=(Rah9TWpmb) [77.83.39.61]:54424: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:07:18 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:07:16 dovecot_login authenticator failed for H=(prqMX0pHu) [178.16.52.139]:50950: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:07:20 dovecot_login authenticator failed for H=(NsjUuUvNc) [77.83.39.181]:57376: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:07:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:07:26 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56780: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:07:27 dovecot_login authenticator failed for H=(C60kucSQ2l) [141.98.11.11]:56525: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:07:53 dovecot_login authenticator failed for H=(bhKTipT) [77.83.39.61]:50282: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 140.233.190.76
country_id: 6252001
description:
2026-02-02 21:08:41 H=([140.233.190.76]) [140.233.190.76]:52201 F=<ruyii@marimail.com> rejected RCPT <info@aire-fresh.com>: SPF: 140.233.190.76 is not allowed to send mail from marimail.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:08:06 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:50858: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:08:42 dovecot_login authenticator failed for H=(4p58naYlUu) [77.83.39.61]:55316: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:08:05 dovecot_login authenticator failed for H=(QpIyj6K43) [77.83.39.61]:56214: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:08:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:08:24 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49226: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:08:20 dovecot_login authenticator failed for H=(BBrGtWuJlr) [141.98.11.11]:60152: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:08:09 dovecot_login authenticator failed for H=(owcXis) [178.16.52.139]:60650: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.1.200.187
country_id: 6252001
description:
2026-02-02 21:08:12 dovecot_plain authenticator failed for H=c-24-1-200-187.hsd1.il.comcast.net (platurdhed) [24.1.200.187]:56978: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:08:15 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:08:17 dovecot_login authenticator failed for H=(oHaZlHe) [77.83.39.181]:62595: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 180.178.94.243
country_id: 1643084
domain: achieversvisionacademy.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.71||T:APACHE||MV:/wp-json/wp/v2/users?page=1&per_page=100||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.154
country_id: 1269750
description:
2026-02-02 21:08:44 dovecot_login authenticator failed for H=(nsg-corporate-154.230.187.122.airtel.in) [122.187.230.154]:43554: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.252.37.194
country_id: 3175395
description:
2026-02-02 21:08:54 dovecot_login authenticator failed for H=host-95-252-37-194.retail.telecomitalia.it [95.252.37.194]:41542: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:09:07 dovecot_login authenticator failed for H=(KT4Nvrfyrn) [77.83.39.61]:53924: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:09:13 dovecot_login authenticator failed for H=(XeRE6Nw) [77.83.39.181]:51446: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:09:13 dovecot_login authenticator failed for H=(JgdqA3B7) [178.16.52.139]:53251: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13010
name: Delayed Multiple triggers of Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:09:46 H=(185.93.89.63) [185.93.89.63]:57654 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <janet@handandphysicaltherapy.org>: The mail server could not deliver mail to janet@handandphysicaltherapy.org.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:09:35 dovecot_login authenticator failed for H=(lVxX0S) [77.83.39.61]:60950: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:09:05 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.181
country_id: 690791
description:
Feb  2 21:09:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account info has been locked for the attacker IP 77.83.39.181


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:09:10 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:09:21 dovecot_login authenticator failed for H=(Xje32v4sCf) [141.98.11.11]:59827: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.92.130.3
country_id: 1814991
description:
2026-02-02 21:10:00 dovecot_login authenticator failed for H=([127.0.0.1]) [211.92.130.3]:58911: 535 Incorrect authentication data (set_id=kumara.rao@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:09:20 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:61064: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:10:21 dovecot_login authenticator failed for H=(njej3w3) [77.83.39.61]:63490: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-02-02 21:10:22 dovecot_login authenticator failed for H=([112.161.26.125]) [112.161.26.125]:39748: 535 Incorrect authentication data (set_id=sales@ocned.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:10:33 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:53426: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.21.213
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8268 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:10:15 dovecot_login authenticator failed for H=(6YmDOoDqF) [178.16.52.139]:59975: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:10:16 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:56740: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:10:09 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza@mckd.com.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:10:16 dovecot_login authenticator failed for H=(pF4dXv4ezG) [141.98.11.11]:55909: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:10:19 H=(185.93.89.63) [185.93.89.63]:57846 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <dspitler@3speedys.com>: The mail server could not deliver mail to dspitler@3speedys.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.227.166
country_id: 1269750
description:
2026-02-02 21:10:30 dovecot_login authenticator failed for H=([103.56.85.65]) [128.185.227.166]:58420: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.181.216.158
country_id: 660013
description:
2026-02-02 21:10:06 dovecot_login authenticator failed for H=mail.paul42.de ([127.0.0.1]) [135.181.216.158]:40358: 535 Incorrect authentication data (set_id=kumara.rao)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:10:08 dovecot_login authenticator failed for H=(BHALPNC) [77.83.39.181]:56198: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-02-02 21:10:03 dovecot_plain authenticator failed for H=(luson) [102.53.15.180]:49500: 535 Incorrect authentication data (set_id=callen@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.135.135.213
country_id: 3469034
description:
2026-02-02 21:10:16 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [177.135.135.213]:46915: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:10:11 dovecot_login authenticator failed for H=(DsNJUrk) [77.83.39.61]:61314: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:11:11 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:52375: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:11:16 dovecot_login authenticator failed for H=(24OE61) [77.83.39.61]:61222: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.38.201.238
country_id: 6252001
description:
2026-02-02 21:11:46 dovecot_plain authenticator failed for H=c-68-38-201-238.hsd1.in.comcast.net (ableck) [68.38.201.238]:52392: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:11:09 dovecot_login authenticator failed for H=(AY7FZKW) [141.98.11.11]:52464: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.133.162.7
country_id: 953987
description:
2026-02-02 21:11:25 dovecot_login authenticator failed for H=(ADMIN) [102.133.162.7]:62873: 535 Incorrect authentication data (set_id=chuan@tschuan.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.181
country_id: 690791
description:
2026-02-02 21:11:04 dovecot_login authenticator failed for H=(wXoJ8V) [77.83.39.181]:60910: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:11:09 dovecot_login authenticator failed for H=(Ey4nyzjeik) [178.16.52.139]:52234: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 176.175.174.92
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/proc/self/cwd/etc/sudo.conf||User:root||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:11:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account azli has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:11:06 dovecot_login authenticator failed for H=(ma7DaIq) [77.83.39.61]:60444: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.113.114
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.71||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:12:11 dovecot_login authenticator failed for H=(LgETjEai) [77.83.39.61]:63922: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:12:14 dovecot_login authenticator failed for H=(m8LKg4lY) [178.16.52.139]:49541: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:12:03 dovecot_login authenticator failed for H=(Z7qWxST) [141.98.11.11]:58313: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:12:03 dovecot_login authenticator failed for H=(SvBT8YDP30) [77.83.39.61]:65358: 535 Incorrect authentication data (set_id=azli)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:12:04 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:63982: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:12:06 H=(185.93.89.63) [185.93.89.63]:58096 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my temporarily rejected RCPT <bmartz@martzagency.com>: host lookup did not complete


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:12:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate@mssa.org.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-02-02 21:12:42 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net [111.70.41.88]:33647: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.245.210.70
country_id: 1814991
description:
2026-02-02 21:12:27 dovecot_login authenticator failed for H=(70.210.245.58.adsl-pool.jlccptt.net.cn) [58.245.210.70]:33269: 535 Incorrect authentication data (set_id=admin@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:13:09 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:48732: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:13:22 dovecot_login authenticator failed for H=(iXcwmZ) [141.98.11.11]:61774: 535 Incorrect authentication data (set_id=lsst)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:13:38 H=(185.93.89.63) [185.93.89.63]:58322 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <matt.mclaughlin@cunet.com>: The mail server could not deliver mail to matt.mclaughlin@cunet.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:13:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate@mssa.org.my has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:13:06 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:51634: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:13:06 dovecot_login authenticator failed for H=(UqMTexV) [77.83.39.61]:59882: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:13:06 dovecot_login authenticator failed for H=(uPJEd1pp) [178.16.52.139]:54360: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:13:52 dovecot_login authenticator failed for H=(P9YQKhi) [77.83.39.61]:60307: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:14:11 dovecot_login authenticator failed for H=(kPn258zT9) [178.16.52.139]:54568: 535 Incorrect authentication data (set_id=info@cordage.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/cryptsetup.conf||User:root||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:14:48 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:14:03 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:64164: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:14:38 dovecot_login authenticator failed for H=(ZvcTkK8) [77.83.39.61]:64967: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.63.78.142
country_id: 6252001
description:
2026-02-02 21:14:26 dovecot_login authenticator failed for H=(ADMIN) [45.63.78.142]:65349: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:14:52 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:14:17 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:14:11 dovecot_login authenticator failed for H=(nidSnHK5i) [77.83.39.61]:62216: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:14:17 dovecot_login authenticator failed for H=(spg0XcS8tx) [141.98.11.11]:50324: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:15:07 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 178.16.52.139
country_id: 2921044
description:
Feb  2 21:15:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(178.16.52.139)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/NetworkManager/NetworkManager.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:15:16 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:60384: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:15:06 dovecot_login authenticator failed for H=(03EGuetyk) [77.83.39.61]:61823: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:15:34 dovecot_login authenticator failed for H=(5MCPpVcmT) [77.83.39.61]:59711: 535 Incorrect authentication data (set_id=corporate@mssa.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:15:34 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:34734: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.37.162.117
country_id: 2017370
description:
2026-02-02 21:15:30 dovecot_login authenticator failed for H=broadband-77-37-162-117.ip.moscow.rt.ru [77.37.162.117]:42956: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.236
country_id: 294640
description:
2026-02-02 21:15:42 dovecot_login authenticator failed for H=(2-54-99-236.orange.net.il) [2.54.99.236]:51318: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:15:25 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.52.139
country_id: 2921044
description:
2026-02-02 21:15:15 dovecot_login authenticator failed for H=(Lm35PM33xE) [178.16.52.139]:57750: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.41.228.21
country_id: 1814991
description:
2026-02-02 21:15:23 dovecot_login authenticator failed for H=([112.48.16.186]) [120.41.228.21]:34562: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:15:34 H=(185.93.89.63) [185.93.89.63]:58819 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <bill_hughes@idx.com>: The mail server could not deliver mail to bill_hughes@idx.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:15:09 dovecot_login authenticator failed for H=(k7VJE44Xi) [141.98.11.11]:55984: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:15:13 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:16:07 H=(185.93.89.63) [185.93.89.63]:58919 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <mkepler@midstate.edu>: The mail server could not deliver mail to mkepler@midstate.edu.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:16:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:16:08 dovecot_plain authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58673: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:16:23 dovecot_login authenticator failed for H=(BV9fv7jb) [141.98.11.11]:63224: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:16:28 dovecot_login authenticator failed for H=(YwZz1YYs) [77.83.39.61]:49254: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:16:04 dovecot_login authenticator failed for H=(1PekWsbQW1) [77.83.39.61]:58855: 535 Incorrect authentication data (set_id=azli)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/cloudlinux-backup-utils.log||User:root||


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:16:45 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 51.91.251.0
country_id: 3017382
description:
[2026-02-02 21:16:56 +0800] info [whostmgrd] 51.91.251.0 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.94.75.42
country_id: 1149361
description:
2026-02-02 21:17:58 dovecot_login authenticator failed for H=([180.94.75.42]) [180.94.75.42]:47224: 535 Incorrect authentication data (set_id=info@ocned.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:17:04 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account chewkc has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:17:12 dovecot_login authenticator failed for H=(vJbXuOThT) [141.98.11.11]:55215: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:17:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:53748: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/opt/scripts/sync-nfs.sh.old||User:root||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:17:19 dovecot_login authenticator failed for H=(vymZus) [77.83.39.61]:50859: 535 Incorrect authentication data (set_id=azli@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-02-02 21:17:23 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net [71.235.27.139]:37562: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.123.11.209
country_id: 2963597
description:
2026-02-02 21:17:27 dovecot_login authenticator failed for H=(ADMIN) [20.123.11.209]:58387: 535 Incorrect authentication data (set_id=jasmine@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:17:06 dovecot_login authenticator failed for H=(7MwXnGlOJk) [77.83.39.61]:55387: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:17:10 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-02-02 21:17:43 dovecot_login authenticator failed for H=([152.52.244.106]) [152.52.244.106]:45912: 535 Incorrect authentication data (set_id=kitty.yap)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-02-02 21:18:43 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:50638: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:18:15 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:46560: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:18:04 dovecot_login authenticator failed for H=(E2nr4k9) [77.83.39.61]:56327: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:18:08 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/rsyslog.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.140.180.9
country_id: 2017370
description:
2026-02-02 21:18:52 dovecot_login authenticator failed for H=broadband-178-140-180-9.ip.moscow.rt.ru [178.140.180.9]:58920: 535 Incorrect authentication data (set_id=support@wohcheong.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.93.89.63
country_id: 130758
description:
2026-02-02 21:18:07 H=(185.93.89.63) [185.93.89.63]:59194 X=TLS1.2:DHE-RSA-AES256-GCM-SHA384:256 F=<enquiry@smartcable.com.my> A=dovecot_login:enquiry@smartcable.com.my rejected RCPT <howardr@actionpartners.com>: The mail server could not deliver mail to howardr@actionpartners.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:18:10 dovecot_login authenticator failed for H=(MeHdIo) [141.98.11.11]:50278: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:18:13 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:49850: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:18:13 dovecot_login authenticator failed for H=(kiH3OTc) [77.83.39.61]:50491: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:18:11 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-02-02 21:18:13 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (scyacely) [73.57.80.193]:35210: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:19:07 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:19:12 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:62382: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 6012
name: Imunify PAM. The account has been temporarily locked
abuser: 141.98.11.11
country_id: 597427
description:
Feb  2 21:19:16 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_UL] The account sales@cordage.com.my has been temporarily locked by Imunify PAM(141.98.11.11)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.70.149.210
country_id: 1814991
description:
2026-02-02 21:19:17 dovecot_login authenticator failed for H=([223.70.149.210]) [223.70.149.210]:35972: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/modprobe.d/firewalld-sysctls.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:19:18 dovecot_login authenticator failed for H=(uwPs14bIk) [141.98.11.11]:50459: 535 Incorrect authentication data (set_id=sales@cordage.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.94.125.250
country_id: 2017370
description:
2026-02-02 21:19:25 dovecot_login authenticator failed for H=h77-94-125-250.static.bashtel.ru [77.94.125.250]:57027: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.78.247.150
country_id: 1269750
description:
[2026-02-02 21:19:21 +0800] info [whostmgrd] 103.78.247.150 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.79.86.102
country_id: 1269750
description:
2026-02-02 21:19:06 dovecot_login authenticator failed for H=([182.79.86.102]) [182.79.86.102]:44080: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:19:09 dovecot_login authenticator failed for H=(OI2LorTRf) [77.83.39.61]:58020: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:19:53 dovecot_login authenticator failed for H=(kuAwKoE) [77.83.39.61]:58597: 535 Incorrect authentication data (set_id=chewkc)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.11.11
country_id: 597427
description:
2026-02-02 21:20:11 dovecot_login authenticator failed for H=(Qs42UQs) [141.98.11.11]:60678: 535 Incorrect authentication data (set_id=lsst@feliogroup.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 216.73.216.130
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.71||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/modprobe.d/dist-blacklist.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 82.156.33.17
country_id: 1814991
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.71||T:APACHE||MV:/portfolio/3-side-seal-bag/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.15.40.57
country_id: 1643084
description:
2026-02-02 21:20:50 dovecot_login authenticator failed for H=(USER) [157.15.40.57]:57500: 535 Incorrect authentication data (set_id=info@nobledec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:20:05 dovecot_login authenticator failed for H=(U4xicabM) [77.83.39.61]:63666: 535 Incorrect authentication data (set_id=aniza)


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 77.83.39.61
country_id: 690791
description:
Feb  2 21:20:22 sv3 auth[740177]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account aniza has been locked for the attacker IP 77.83.39.61


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.4.104.168
country_id: 2921044
description:
2026-02-02 21:20:06 dovecot_login authenticator failed for H=static.168.104.4.46.clients.your-server.de (RDPWINDOWS.your-server.de) [46.4.104.168]:58694: 535 Incorrect authentication data (set_id=admin@oxbold.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.142
country_id: 1269750
description:
2026-02-02 21:20:21 dovecot_login authenticator failed for H=([182.79.202.89]) [182.95.230.142]:56414: 535 Incorrect authentication data (set_id=postmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-02-02 21:20:12 dovecot_login authenticator failed for H=([196.189.59.226]) [196.189.59.226]:56375: 535 Incorrect authentication data (set_id=postmaster@wohcheong.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.61
country_id: 690791
description:
2026-02-02 21:20:47 dovecot_login authenticator failed for H=(UcC3F6) [77.83.39.61]:63607: 535 Incorrect authentication data (set_id=corporate)


