# incident

plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.92.28.206
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://gix.ru/bitrix/redirect.php?goto=http://bouchersocial.club/story.php?title=game-tips-%7C-top-gaming-reviews-%7C-gaming-insights-%7C-honest-casino-opinions-%7C-bet-safe-hub\">https://gix.ru/bitrix/redirect.php?goto=http://bouchersocial.club/story.php?title=game-tips-%7C-top-gaming-reviews-%7C-gaming-insights-%7C-honest-casino-opinions-%7C-bet-safe-hub</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-10 17:12:34 dovecot_login authenticator failed for H=([192.111.135.19]) [65.20.217.64]:39967: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-10 17:12:50 dovecot_login authenticator failed for H=([131.189.214.140]) [181.129.31.42]:37363: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-10 17:12:49 dovecot_login authenticator failed for H=([114.98.63.18]) [206.62.136.109]:34842: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-10 17:12:58 dovecot_login authenticator failed for H=([162.212.13.76]) [102.210.148.41]:45768: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-10 17:12:58 dovecot_login authenticator failed for H=([211.252.172.89]) [121.131.220.152]:56895: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-10 17:13:11 dovecot_login authenticator failed for H=([111.62.173.90]) [70.120.9.176]:50299: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-10 17:13:57 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com (static.90.254.104.190.cps.com.ar) [220.246.47.169]:51522: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-10 17:14:21 dovecot_login authenticator failed for H=([115.93.117.61]) [38.212.67.79]:35775: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.90.184.28
country_id: 1831722
description:
[2026-07-10 17:15:10 +0530] info [whostmgrd] 111.90.184.28 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-10 17:16:28 dovecot_login authenticator failed for H=([49.124.153.46]) [50.217.40.11]:46744: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.71.160.34
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/category/products?Itemid=101 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: ibmcglobal.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/iuqvymug/fonts/zhlumhuh.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-10 17:17:27 dovecot_login authenticator failed for H=([206.62.136.111]) [38.141.252.55]:49712: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.248.151.168
country_id: 1880251
description:
[2026-07-10 17:18:21 +0530] info [webmaild] 104.248.151.168 - - "GET /blog/ HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-10 17:21:12 dovecot_login authenticator failed for H=([49.124.142.132]) [203.252.10.3]:34291: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-10 17:21:29 dovecot_login authenticator failed for H=([67.201.57.102]) [210.5.117.238]:56918: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.46
country_id: 99237
description:
2026-07-10 17:21:37 dovecot_login authenticator failed for H=([117.241.77.78]) [65.20.138.46]:57866: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 78.138.14.34
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://barcodeultra.com/\">judi</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.237.122
country_id: 1269750
description:
2026-07-10 17:26:47 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [122.187.237.122]:44762: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-10 17:26:26 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([174.64.199.88]) [217.211.208.125]:42968: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.60.194.194
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/projection-mapping HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.176.254.53
country_id: 6252001
description:
2026-07-10 17:28:32 dovecot_login authenticator failed for H=([221.5.224.71]) [24.176.254.53]:45314: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-10 17:32:22 dovecot_login authenticator failed for H=([111.26.63.85]) [14.96.106.175]:33288: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-10 17:32:38 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net ([189.52.52.162]) [69.115.178.196]:46517: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-10 17:35:39 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([183.171.208.174]) [176.10.203.54]:50584: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-10 17:35:56 dovecot_login authenticator failed for H=([113.53.251.101]) [65.20.202.4]:59810: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.243
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.203.101.30
country_id: 3624060
description:
2026-07-10 17:39:47 dovecot_login authenticator failed for H=(server.first4systems.com) [201.203.101.30]:33784: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-10 17:39:05 dovecot_login authenticator failed for H=(h79-138-90-195.cust.bredband2.com) [38.148.99.59]:52881: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.15.242.79
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.59
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:17-39.185.255.126.59||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-10 17:41:48 dovecot_login authenticator failed for H=(6.40.48.59.broad.cz.sx.dynamic.163data.com.cn) [1.227.228.131]:59870: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-10 17:45:46 dovecot_login authenticator failed for H=([59.23.3.146]) [157.119.70.200]:63638: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-07-10 17:45:40 dovecot_login authenticator failed for H=([182.95.87.177]) [122.187.234.54]:47327: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ubyoxoii/fonts/dbkodldm.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-10 17:45:54 dovecot_login authenticator failed for H=(host94.sub-63-47-182.myvzw.com) [203.192.247.84]:57032: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-10 17:46:17 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [123.212.9.122]:58425: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/dyjnhmeg/fonts/pjofphwe.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.207
country_id: 1668284
description:
2026-07-10 17:54:08 dovecot_login authenticator failed for H=111-70-32-207.emome-ip.hinet.net ([197.219.228.246]) [111.70.32.207]:50403: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-10 17:54:25 dovecot_login authenticator failed for H=(46.191.197.143.dynamic.str.ufanet.ru) [5.48.46.95]:57844: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-10 17:56:11 dovecot_login authenticator failed for H=([67.201.57.102]) [212.132.64.89]:59856: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-10 17:56:47 dovecot_login authenticator failed for H=(karuna.divineled.com) [182.95.106.102]:46348: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.211.186
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.28.211.186||TA:104.28.211.186||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-10 17:57:17 dovecot_login authenticator failed for H=([65.20.187.47]) [23.30.11.253]:46677: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.186
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/localhost.key||User:ddgalaxy||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-10 17:58:40 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se (181-212-174-164.baf.movistar.cl) [83.191.181.23]:59588: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 182.8.122.158
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-10 17:59:07 dovecot_login authenticator failed for H=(dynamic-ip-181612514.cable.net.co) [143.202.162.196]:57464: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 10 18:05:42 vps sshd[1577800]: error: kex_exchange_identification: read: Connection reset by peer


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/somxeqzi/fonts/qfvogiyr.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.181.161.192
country_id: 2029969
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 31.215.43.244
country_id: 290557
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:87736.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1203fbc41bf6158508871d15a33641928499170||Title:0x167ee003||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-10 18:14:12 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [122.185.44.206]:54478: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-10 18:14:54 dovecot_login authenticator failed for H=([180.94.75.202]) [185.15.82.135]:52884: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-10 18:15:04 dovecot_login authenticator failed for H=([38.148.99.59]) [62.164.148.87]:52258: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-10 18:15:34 dovecot_login authenticator failed for H=([67.201.57.102]) [182.66.213.59]:55700: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-10 18:15:50 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([183.171.154.64]) [83.166.50.15]:48354: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-10 18:17:16 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([49.124.151.6]) [79.138.90.195]:34798: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.99.78.221
country_id: 1269750
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:72159.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2fd11105537c72b5280de28f8b04dc688dab9419||Title:qeskv3x2angu8hm||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-10 18:17:50 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com ([218.21.241.50]) [78.66.45.101]:39536: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.161.116
country_id: 1835841
description:
2026-07-10 18:18:28 dovecot_login authenticator failed for H=([68.71.249.154]) [14.49.161.116]:42802: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.203.101.30
country_id: 3624060
description:
2026-07-10 18:18:09 dovecot_login authenticator failed for H=([149.54.40.222]) [201.203.101.30]:33476: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.220.98
country_id: 1733045
description:
2026-07-10 18:19:30 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [49.124.220.98]:52326: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-10 18:27:07 dovecot_login authenticator failed for H=(136-35-246-152.googlefiber.net) [38.148.99.59]:54239: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-10 18:27:46 dovecot_login authenticator failed for H=([27.128.162.146]) [41.89.128.6]:45616: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-10 18:28:26 dovecot_login authenticator failed for H=([203.129.217.70]) [64.53.7.231]:60762: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-10 18:28:45 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.6
country_id: 99237
description:
2026-07-10 18:28:51 dovecot_login authenticator failed for H=([68.71.251.130]) [65.20.175.6]:52672: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-07-10 18:28:56 dovecot_login authenticator failed for H=(219-89-198-191.adsl.xtra.co.nz) [122.160.85.144]:59725: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-10 18:29:11 dovecot_login authenticator failed for H=([121.66.63.189]) [182.95.181.138]:47752: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.236.155
country_id: 1168579
description:
2026-07-10 18:29:58 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [119.152.236.155]:34981: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-07-10 18:30:18 dovecot_login authenticator failed for H=([72.207.33.65]) [125.19.159.186]:37988: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.60.46
country_id: 1168579
description:
2026-07-10 18:30:47 dovecot_login authenticator failed for H=([80.233.77.136]) [203.124.60.46]:49460: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-10 18:31:09 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net (ip-142-54-232-1.hosts.zerolag.com) [50.121.186.125]:56041: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-10 18:31:24 dovecot_login authenticator failed for H=([197.219.228.242]) [163.61.33.117]:36170: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/upmwiocf/fonts/ppnnyouu.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.107.154
country_id: 1269750
description:
2026-07-10 18:35:12 dovecot_login authenticator failed for H=([184.181.217.198]) [27.123.107.154]:43318: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-10 18:35:42 dovecot_login authenticator failed for H=(chernyshevskayarb-gw.transtelecom.net) [197.219.228.242]:44164: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-10 18:43:46 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([103.168.241.32]) [213.101.138.172]:45924: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-07-10 18:45:14 dovecot_login authenticator failed for H=([65.20.187.47]) [167.250.118.53]:57924: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.155.233.254
country_id: 174982
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://telegra.ph/Dostavka-lyuksa-iz-zarubezhnyh-butikov-novye-uslugi-Oskelly-06-23\">\xd0\xbf\xd0\xbb\xd0\xb0\xd1\x82\xd1\x84\xd0\xbe\xd1\x80\xd0\xbc\xd0\xb0 oskelly</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 192.36.61.172
country_id: 597427
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:futuracarecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-10 18:50:52 dovecot_login authenticator failed for H=([49.125.201.87]) [122.185.44.206]:47182: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-10 18:51:09 dovecot_login authenticator failed for H=([38.148.99.59]) [152.70.157.25]:52434: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 60.54.224.200
country_id: 1733045
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.bazi001.com\">\xe5\x85\xab\xe5\xad\x97\xe6\xb5\x8b\xe7\xae\x97</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 5.83.135.102
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:wp-user.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 5.83.135.102
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:wp-user.jpg||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-10 18:54:04 dovecot_login authenticator failed for H=([125.139.87.30]) [117.252.93.114]:51254: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-10 18:55:35 dovecot_login authenticator failed for H=([59.110.5.198]) [41.215.125.250]:55912: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.45
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.223.223
country_id: 1835841
description:
2026-07-10 18:56:25 dovecot_login authenticator failed for H=([192.252.216.83]) [210.104.223.223]:51506: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.192.88
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es15?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-10 19:02:57 dovecot_login authenticator failed for H=([196.189.126.10]) [147.148.205.252]:39218: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 80.94.95.202
country_id: 798549
domain: jaashsupplies.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-04.80.94.95.202||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.215.90
country_id: 1269750
description:
2026-07-10 19:05:22 dovecot_login authenticator failed for H=([223.71.254.162]) [110.227.215.90]:35050: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.41.134
country_id: 1733045
description:
2026-07-10 19:04:54 dovecot_login authenticator failed for H=([149.54.40.94]) [183.171.41.134]:41928: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.120.128
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-automation-systems HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 202.14.4.165
country_id: 1819730
domain: globalgroupoman.com
description:


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.96.69
country_id: 1562822
domain: www.globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.globalgroupoman.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-10 19:11:46 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net ([174.64.199.85]) [76.132.238.43]:40664: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.188.125.230
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/acoustic-consultancy HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-10 19:12:34 dovecot_login authenticator failed for H=([111.26.63.85]) [121.202.138.181]:34810: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-10 19:13:43 dovecot_login authenticator failed for H=([117.34.210.196]) [197.219.210.94]:56374: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.132.209.110
country_id: 6252001
description:
2026-07-10 19:13:02 dovecot_login authenticator failed for H=([46.210.95.88]) [47.132.209.110]:52188: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-10 19:13:19 dovecot_login authenticator failed for H=([103.68.52.210]) [61.1.105.105]:54068: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-10 19:13:42 dovecot_login authenticator failed for H=([211.169.212.206]) [203.194.5.183]:50995: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-10 19:13:43 dovecot_login authenticator failed for H=([65.20.141.202]) [196.41.207.112]:50385: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-10 19:16:39 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([142.54.231.33]) [217.211.208.125]:49570: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.48
country_id: 1733045
description:
2026-07-10 19:16:54 dovecot_login authenticator failed for H=(76.pool90-160-117.dynamic.orange.es) [49.124.149.48]:49382: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-07-10 19:19:46 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca (65-73-230-99.d1dd231b1e9e11c70abaf8fabd83036a.ip.frontiernet.net) [96.30.129.165]:37352: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-10 19:20:08 dovecot_login authenticator failed for H=([220.72.138.160]) [163.223.244.3]:45080: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.161.77
country_id: 6252001
description:
2026-07-10 19:20:46 H=([64.89.161.77]) [64.89.161.77]:56944 F=<dpr@priv8shop.com> rejected RCPT <peterpan510@rocketmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-10 19:25:34 dovecot_login authenticator failed for H=([45.167.250.173]) [1.250.67.114]:47506: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.150.64.183
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/home-theatre-is-not-a-luxury-it-is-a-trend-of-a-covid-era-report-on-kerala-kaumudi HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.184
country_id: 1733045
description:
2026-07-10 19:27:04 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [49.124.159.184]:34552: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-10 19:27:24 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com (ip103-31-38-92.cloudhost.web.id) [82.209.191.11]:44596: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.64
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/json.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.64
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/2023/11/config.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-10 19:28:39 dovecot_login authenticator failed for H=([61.111.255.216]) [62.220.236.203]:49984: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-10 19:28:51 dovecot_login authenticator failed for H=([49.125.203.163]) [183.82.108.109]:43918: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.151
country_id: 1668284
description:
2026-07-10 19:34:12 dovecot_login authenticator failed for H=110-25-112-151.adsl.fetnet.net ([98.181.137.75]) [110.25.112.151]:46802: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-10 19:34:32 dovecot_login authenticator failed for H=(42-200-73-3.static.imsbiz.com) [183.104.220.152]:38088: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-10 19:35:56 dovecot_login authenticator failed for H=([203.124.32.243]) [102.210.148.41]:33792: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-10 19:36:35 dovecot_login authenticator failed for H=([27.39.130.144]) [197.219.228.242]:47426: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.251.0.147
country_id: 390903
description:
2026-07-10 19:37:19 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [212.251.0.147]:45834: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-10 19:37:34 dovecot_login authenticator failed for H=([162.217.227.37]) [121.162.61.229]:52679: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-10 19:43:24 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [210.118.224.138]:40382: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-10 19:43:43 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi ([47.215.0.185]) [80.223.192.112]:41566: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.189.40.91
country_id: 6252001
description:
2026-07-10 19:43:45 dovecot_login authenticator failed for H=syn-108-189-040-091.biz.spectrum.com ([192.111.130.1]) [108.189.40.91]:32769: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2026-07-10 19:44:03 dovecot_login authenticator failed for H=93-42-227-251.ip88.fastwebnet.it (cpc1-ersk4-2-0-cust471.know.cable.virginm.net) [93.42.227.251]:44060: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-10 19:48:44 dovecot_login authenticator failed for H=(111-70-9-87.emome-ip.hinet.net) [117.250.19.91]:39192: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.3.114
country_id: 1835841
description:
2026-07-10 19:49:01 dovecot_login authenticator failed for H=([41.220.3.113]) [119.207.3.114]:56185: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-10 19:52:27 dovecot_login authenticator failed for H=([112.27.230.157]) [119.192.219.77]:40101: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-10 19:52:40 dovecot_login authenticator failed for H=([183.171.44.82]) [112.160.57.196]:34366: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-10 19:56:32 dovecot_login authenticator failed for H=([174.75.211.195]) [121.185.89.74]:52378: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 ex yu iptv (<a href=\"http://legion152.nnov.org/common/redir.php?https://87.torayche.com/index/d1?diff=0&utm_clickid=00gocgogswows8g4&aurl=https://exyuiptv.org/blog/sta-je-iptv-i-kako-radi/\">http://legion152.nnov.org/common/redir.php?https://87.torayche.com/index/d1?diff=0&utm_clickid=00gocgogswows8g4&aurl=https://exyuiptv.org/blog/sta-je-iptv-i-kako-radi/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 189.164.204.15
country_id: 3996063
domain: interceptorglobal.in
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.193.105
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es90?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-10 20:04:25 dovecot_login authenticator failed for H=([98.170.57.236]) [119.198.191.180]:38977: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2026-07-10 20:04:36 dovecot_login authenticator failed for H=([101.13.5.63]) [85.159.165.216]:39620: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: elegantautomotives.com
description:


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 35.192.232.168
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-10 20:09:45 dovecot_login authenticator failed for H=([1.212.225.99]) [106.247.22.181]:34015: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-10 20:15:24 dovecot_login authenticator failed for H=([119.203.4.207]) [188.122.37.97]:50610: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.203.173.125
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:57789.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:80d80253f81df94f24b2de903045f1e02f61a3e7||Title:7l5efu6m2xyn5of63||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://local.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-10 20:17:55 dovecot_login authenticator failed for H=([84.111.136.211]) [85.152.57.60]:39027: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-10 20:23:35 dovecot_login authenticator failed for H=([107.181.161.85]) [183.104.220.195]:59046: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.3.134
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/gallo-accoustics-round-sound?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.86.2
country_id: 1819730
description:
2026-07-10 20:26:37 dovecot_login authenticator failed for H=([192.252.214.22]) [156.238.86.2]:46944: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.69.233
country_id: 1269750
description:
2026-07-10 20:27:02 dovecot_login authenticator failed for H=([60.173.105.206]) [122.160.69.233]:47965: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 20.191.115.169
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.178.142
country_id: 337996
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-10 20:35:37 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net (203-221-144-203.tpgi.com.au) [111.70.28.243]:55275: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-07-10 20:35:54 dovecot_login authenticator failed for H=([175.206.1.60]) [2.55.70.26]:60693: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-10 20:39:19 dovecot_login authenticator failed for H=([68.71.243.10]) [61.37.150.6]:33057: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.201.203.173
country_id: 1831722
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.198.124.247
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es30?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-07-10 20:48:44 dovecot_plain authenticator failed for H=(afticaulat) [65.20.184.80]:60946: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-10 20:51:35 dovecot_login authenticator failed for H=(testmft.sedgwick.com) [98.122.215.23]:35496: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-10 20:52:59 dovecot_login authenticator failed for H=([98.178.72.4]) [65.20.179.251]:53261: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.248.252
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:21-00.193.32.248.252||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-10 21:04:35 dovecot_login authenticator failed for H=([119.201.143.23]) [103.171.39.147]:42806: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-10 21:04:47 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([116.228.195.251]) [213.101.138.172]:55740: 535 Incorrect authentication data (set_id=pan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-10 21:04:16 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [23.30.11.253]:41935: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-10 21:04:30 dovecot_login authenticator failed for H=([180.168.60.146]) [165.101.222.22]:47664: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2026-07-10 21:05:07 dovecot_login authenticator failed for H=([45.164.115.86]) [49.125.201.68]:51278: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-10 21:06:06 dovecot_login authenticator failed for H=([68.71.249.154]) [103.176.160.146]:56118: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-10 21:06:46 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net ([68.71.249.154]) [110.25.109.52]:52580: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-10 21:07:25 dovecot_login authenticator failed for H=([121.153.78.105]) [182.95.127.42]:45764: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-07-10 21:07:44 dovecot_login authenticator failed for H=([49.124.151.63]) [138.118.215.192]:38672: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-10 21:09:46 dovecot_login authenticator failed for H=([49.124.146.43]) [125.23.203.138]:51500: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-10 21:10:27 dovecot_login authenticator failed for H=([14.33.93.214]) [203.192.211.180]:47684: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-10 21:12:27 dovecot_login authenticator failed for H=(84-82-14-214.fixed.kpn.net) [65.20.217.64]:54181: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-10 21:14:30 dovecot_login authenticator failed for H=([183.171.43.35]) [65.20.143.45]:38326: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.78.148.150
country_id: 1643084
description:
2026-07-10 21:15:35 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [36.78.148.150]:32796: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-07-10 21:15:43 dovecot_login authenticator failed for H=([116.237.181.57]) [197.219.228.250]:59450: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-10 21:17:25 dovecot_login authenticator failed for H=([84.111.136.211]) [213.55.79.195]:51208: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.66.168
country_id: 1835841
description:
2026-07-10 21:17:37 dovecot_login authenticator failed for H=(172-233-139-80.ip.linodeusercontent.com) [220.80.66.168]:48140: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-10 21:27:16 dovecot_login authenticator failed for H=([72.207.109.1]) [190.67.106.221]:45770: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-10 21:27:33 dovecot_login authenticator failed for H=([49.124.151.32]) [121.120.42.31]:52686: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.175.66.233
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://Sboagen.com/\">situs judi bola</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-10 21:32:40 dovecot_login authenticator failed for H=([197.156.121.38]) [94.16.17.140]:36392: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-10 21:32:53 dovecot_login authenticator failed for H=([41.220.3.113]) [128.185.253.122]:50114: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-10 21:36:09 dovecot_login authenticator failed for H=([211.205.53.47]) [122.160.142.194]:40588: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.100.203.153
country_id: 3658394
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13906.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93a29d69b3b13a25c8a20e903c281964f121b914||Title:0xe32a3c4a||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.114.177
country_id: 1835841
description:
2026-07-10 21:46:17 dovecot_login authenticator failed for H=([182.95.12.178]) [59.8.114.177]:45542: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-10 21:45:58 dovecot_login authenticator failed for H=([118.26.153.102]) [184.57.39.170]:57854: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.73.89.160
country_id: 1269750
description:
2026-07-10 21:47:15 dovecot_plain authenticator failed for H=(localhost) [116.73.89.160]:49169: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.56
country_id: 1733045
description:
2026-07-10 21:53:29 dovecot_login authenticator failed for H=([82.162.56.186]) [49.124.145.56]:35740: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.150.198.202
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:66.150.198.202||TA:66.150.198.202||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.63.24.93
country_id: 3686110
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-10 21:59:00 dovecot_login authenticator failed for H=(189-57-218-139.customer.tdatabrasil.net.br) [181.54.70.40]:36524: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-10 21:59:15 dovecot_login authenticator failed for H=ns1.sinergi.net.id (95.158.39.201.bestsolution.net.ua) [223.25.108.2]:45394: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-10 21:59:49 dovecot_login authenticator failed for H=(ip68-7-114-69.sd.sd.cox.net) [197.219.208.58]:59834: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"$dd876768\":\"default\",\"_response\":{\"_prefix\":\"var yp=arguments['\\\\x31'];var rrtyw=yp;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.157.49.5
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icottinst/fonts/fmuncrj.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.156.189.227
country_id: 1210997
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/img/aboutus.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-10 22:03:06 dovecot_login authenticator failed for H=([70.166.167.59]) [220.77.214.59]:34432: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.16.216
country_id: 1522867
description:
2026-07-10 22:05:25 dovecot_login authenticator failed for H=(res-aton56247d.ppp.twt.it) [5.76.16.216]:35888: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-10 22:05:37 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net ([211.78.54.14]) [110.25.112.132]:39377: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 194.99.25.199
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/online-casino-tips/barbut-holland-casino\">penis enlargement pill review</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-10 22:09:56 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([60.12.106.119]) [111.70.38.53]:36550: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 48.211.158.211
country_id: 6252001
description:
[2026-07-10 22:13:07 +0530] info [whostmgrd] 48.211.158.211 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-10 22:18:49 dovecot_login authenticator failed for H=([85.159.165.216]) [182.95.123.50]:50864: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-10 22:18:59 dovecot_login authenticator failed for H=([220.82.8.82]) [1.227.228.131]:34041: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-10 22:19:46 dovecot_login authenticator failed for H=([67.201.38.131]) [119.92.76.210]:47152: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.157.49.5
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoedkzvm/fonts/fugzjbr.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.124
country_id: 1668284
description:
2026-07-10 22:21:47 dovecot_login authenticator failed for H=111-70-38-124.emome-ip.hinet.net (abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [111.70.38.124]:44987: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-10 22:21:14 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([178.178.222.59]) [80.223.200.184]:35698: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-10 22:22:18 dovecot_login authenticator failed for H=(syn-174-134-045-064.res.spectrum.com) [220.77.214.59]:47099: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-10 22:27:39 dovecot_login authenticator failed for H=([211.37.24.146]) [136.35.246.152]:34164: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-10 22:27:59 dovecot_login authenticator failed for H=([118.183.180.108]) [1.250.67.190]:43524: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.30.244
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://solo.to/kingslot96\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-10 22:33:12 dovecot_login authenticator failed for H=([174.77.111.220]) [65.20.211.96]:47575: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-10 22:33:30 dovecot_login authenticator failed for H=([142.54.228.195]) [65.20.161.126]:37950: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-10 22:34:21 dovecot_login authenticator failed for H=([58.222.72.182]) [14.46.58.104]:36952: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 34.87.73.49
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/up.php||SC:/home/jaashsupplies/public_html/images/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-07-10 22:34:05 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net ([1.227.135.186]) [69.118.232.13]:58987: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 34.87.73.49
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:up.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-10 22:38:39 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([49.125.201.70]) [35.130.111.98]:41257: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-10 22:39:16 dovecot_login authenticator failed for H=([111.206.233.34]) [45.167.250.45]:39012: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-10 22:39:47 dovecot_login authenticator failed for H=([45.164.115.86]) [210.5.117.238]:58296: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-10 22:39:59 dovecot_login authenticator failed for H=([70.166.167.37]) [182.78.86.62]:57216: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 34.87.73.49
country_id: 1880251
domain: vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/up.php||SC:/home/vrishenterprises/public_html/images/up.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.3.164.243
country_id: 1880251
description:
[2026-07-10 22:46:14 +0530] info [whostmgrd] 103.3.164.243 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-10 22:48:18 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([174.64.199.71]) [221.120.57.125]:45266: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.18.255.9
country_id: 1643084
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59763.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:192458f79af2eabd3b3986de6172e715cd24732d||Title:0x84d408a1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.6
country_id: 99237
description:
2026-07-10 22:48:29 dovecot_login authenticator failed for H=([211.43.120.12]) [65.20.175.6]:38857: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.233.24
country_id: 1835841
description:
2026-07-10 22:50:29 dovecot_login authenticator failed for H=([49.124.152.170]) [175.207.233.24]:48591: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-10 22:50:49 dovecot_login authenticator failed for H=(187-51-219-26.customer.tdatabrasil.net.br) [87.106.245.167]:33206: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.5.124
country_id: 1269750
description:
2026-07-10 22:54:33 dovecot_login authenticator failed for H=(107-135-117-245.lightspeed.livnmi.sbcglobal.net) [103.181.5.124]:50622: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-10 22:54:45 dovecot_login authenticator failed for H=([49.124.150.247]) [110.227.211.82]:58456: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-10 22:55:01 dovecot_login authenticator failed for H=([112.31.109.13]) [212.132.64.89]:38740: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-10 22:55:10 dovecot_login authenticator failed for H=([65.20.204.88]) [165.101.222.22]:47721: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-10 22:56:42 dovecot_login authenticator failed for H=([131.189.214.140]) [182.95.122.110]:54280: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-10 23:01:38 dovecot_login authenticator failed for H=([49.124.151.67]) [38.141.252.55]:44682: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-10 23:01:52 dovecot_login authenticator failed for H=([182.73.109.194]) [220.126.215.120]:46822: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-10 23:01:13 dovecot_login authenticator failed for H=(cm125-59-252-103.hkcable.com.hk) [182.95.232.66]:40512: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-10 23:01:39 dovecot_login authenticator failed for H=(81-230-11-165-no2664.tbcn.telia.com) [182.95.229.110]:50458: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-10 23:02:45 dovecot_login authenticator failed for H=([144.24.107.1]) [196.189.51.64]:41326: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 34.87.73.49
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:up.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-10 23:03:06 dovecot_login authenticator failed for H=([174.75.211.195]) [197.219.208.38]:44270: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.233.24
country_id: 1835841
description:
2026-07-10 23:03:21 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [175.207.233.24]:55053: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-10 23:04:05 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([49.124.146.45]) [78.66.44.246]:36140: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-07-10 23:04:09 dovecot_login authenticator failed for H=([36.144.74.39]) [122.170.99.195]:48818: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-10 23:05:03 dovecot_login authenticator failed for H=mail.sotus.co.th ([130.185.102.59]) [171.100.156.38]:54510: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.196.164.144
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://mybiourl.com/MVcD\">888starz</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-10 23:06:06 dovecot_login authenticator failed for H=(111-70-32-11.emome-ip.hinet.net) [149.34.191.39]:52504: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-10 23:06:58 dovecot_login authenticator failed for H=([58.17.128.7]) [27.72.46.152]:53600: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-10 23:07:14 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net (abts-mum-static-253.100.170.122.airtelbroadband.in) [111.70.9.143]:57410: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.140.89
country_id: 1835841
description:
2026-07-10 23:07:25 dovecot_login authenticator failed for H=([67.201.59.67]) [14.49.140.89]:39368: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-10 23:08:43 dovecot_login authenticator failed for H=([49.124.145.56]) [202.88.209.51]:55610: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.245.240.133
country_id: 3624060
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2019/01/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.66.211
country_id: 1512440
description:
2026-07-10 23:09:44 dovecot_login authenticator failed for H=([31.173.2.182]) [213.230.66.211]:58302: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.39.35.211
country_id: 2635167
description:
2026-07-10 23:09:24 dovecot_login authenticator failed for H=([36.135.92.36]) [82.39.35.211]:58434: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-07-10 23:08:59 dovecot_login authenticator failed for H=([152.67.48.120]) [222.99.52.202]:40690: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.239.150.15
country_id: 3996063
description:
2026-07-10 23:18:07 dovecot_login authenticator failed for H=([49.124.148.194]) [170.239.150.15]:51440: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-10 23:18:24 dovecot_login authenticator failed for H=([121.187.214.107]) [121.131.220.168]:52863: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-10 23:19:49 dovecot_login authenticator failed for H=([78.30.250.62]) [203.252.10.3]:51806: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-10 23:19:24 dovecot_login authenticator failed for H=([70.166.167.44]) [203.193.168.136]:50044: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/iogamesunblocked\">Basket Bros Unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-10 23:24:27 dovecot_login authenticator failed for H=([223.109.200.181]) [196.207.177.56]:54808: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-07-10 23:24:39 dovecot_login authenticator failed for H=([65.20.138.3]) [192.81.229.179]:47966: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.137.4
country_id: 1835841
description:
2026-07-10 23:24:52 dovecot_login authenticator failed for H=([121.120.148.19]) [14.49.137.4]:35429: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-10 23:25:07 dovecot_login authenticator failed for H=([116.237.181.57]) [121.171.95.112]:34238: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.104.0
country_id: 99237
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/b2b/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 143.244.57.90
country_id: 3017382
domain: ibmctradeflow.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.28||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-10 23:29:46 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [85.105.2.51]:43362: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-10 23:29:18 dovecot_login authenticator failed for H=([124.153.182.69]) [182.78.86.62]:36714: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: ddgalaxy.in
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-10 23:37:56 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net (91x144x158x62.static-customer.chelny.ertelecom.ru) [96.56.228.149]:41108: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 151.115.165.172
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:globalgroupoman||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.56.123
country_id: 1733045
description:
2026-07-10 23:42:37 dovecot_login authenticator failed for H=(voip.uet.edu.pk) [183.171.56.123]:52618: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-10 23:42:58 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl (95-87-248-223.ip.btc-net.bg) [89.67.37.52]:48831: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-10 23:43:13 dovecot_login authenticator failed for H=([98.178.72.4]) [203.192.211.180]:42604: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-10 23:43:08 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([24.45.137.84]) [89.67.246.166]:43801: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-10 23:43:26 dovecot_login authenticator failed for H=([67.201.59.67]) [103.55.89.5]:47430: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-10 23:44:02 dovecot_login authenticator failed for H=([220.94.163.193]) [128.185.208.42]:42578: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.232.53.79
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://lovealba.co.kr/\">\xec\xa3\xbc\xec\xa0\x90\xec\x95\x8c\xeb\xb0\x94</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-10 23:45:39 dovecot_login authenticator failed for H=([183.171.56.123]) [122.160.142.194]:38148: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-10 23:45:56 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([49.124.153.4]) [77.53.193.47]:33818: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-10 23:50:57 dovecot_login authenticator failed for H=([222.126.106.8]) [119.198.191.180]:53991: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-10 23:51:49 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [59.12.212.38]:53732: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.194.8.156
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/metrodigitals/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-10 23:53:59 dovecot_login authenticator failed for H=([68.71.253.70]) [195.222.43.138]:39626: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.47.192.100
country_id: 6252001
description:
2026-07-10 23:54:07 dovecot_login authenticator failed for H=ool-182fc064.dyn.optonline.net ([183.171.155.13]) [24.47.192.100]:50140: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.91.20.114
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://en.chatruletka-18.com/\">chatruletka +18</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-10 23:56:04 dovecot_login authenticator failed for H=(110-25-112-145.adsl.fetnet.net) [197.157.252.162]:49749: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-10 23:56:48 dovecot_login authenticator failed for H=([70.166.167.58]) [182.95.181.26]:53400: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.105.37.25
country_id: 878675
description:
2026-07-10 23:56:50 dovecot_plain authenticator failed for H=(localhost) [143.105.37.25]:9434: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.120.2
country_id: 1835841
description:
2026-07-10 23:57:33 dovecot_login authenticator failed for H=(grupokrause.static.gvt.net.br) [121.1.120.2]:39236: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-10 23:57:49 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([61.191.145.123]) [174.168.146.152]:53402: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-10 23:58:14 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [122.160.142.194]:44444: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-10 23:58:31 dovecot_login authenticator failed for H=([70.166.167.49]) [136.56.34.147]:40158: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.34.144
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-theater-products/v5010i-4k-rgb-laser-tv-projector HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.61.17.63
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/news HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469914
abuser: 34.87.73.49
country_id: 1880251
domain: jaashsupplies.com
name:
IM360 WAF: Unauthenticated arbitrary file deletion in Tassos/Novarain Framework (nrframework) for Joomla (CVE-2026-48906)

description:
IM360 WAF: Unauthenticated arbitrary file deletion in Tassos/Novarain Framework (nrframework) for Joomla (CVE-2026-48906)||MVN:ARGS:remove_file||MV:images/.htaccess||RSV:8.28||T:APACHE||TGT:images/.htaccess||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.14.191
country_id: 2963597
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://blog.newxd.com/wp-content/themes/dux/go.php?url=aHR0cHM6Ly91c2F4aWkuY29tL3RocmVhZC0zMDAyOTYtMS0xLmh0bWw\">mostbet 100 free spins bez depozytu</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 34.87.73.49
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:class||MV:JFormFieldNRInlineFileUpload||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-11 00:18:02 dovecot_login authenticator failed for H=([115.144.178.210]) [78.189.17.35]:40228: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.107.52.83
country_id: 3923057
description:
2026-07-11 00:18:08 dovecot_login authenticator failed for H=83.52.107.190.dyn.supernet.com.bo ([60.172.1.210]) [190.107.52.83]:35394: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-11 00:18:44 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([198.8.94.171]) [71.229.1.186]:55404: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.46
country_id: 1733045
description:
2026-07-11 00:21:29 dovecot_login authenticator failed for H=([223.82.97.51]) [49.124.153.46]:51240: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.47.157
country_id: 1835841
description:
2026-07-11 00:21:50 dovecot_login authenticator failed for H=([84.111.136.211]) [222.116.47.157]:59555: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.104.76.210
country_id: 6251999
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-11 00:21:42 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([218.15.224.102]) [90.230.115.5]:55226: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-11 00:27:10 dovecot_login authenticator failed for H=([49.124.151.81]) [14.51.12.142]:41488: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-11 00:27:36 dovecot_login authenticator failed for H=(181-212-174-164.baf.movistar.cl) [140.130.98.240]:55901: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-11 00:29:17 dovecot_login authenticator failed for H=n112120115152.netvigator.com (219-89-198-191.adsl.xtra.co.nz) [112.120.115.152]:54022: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-11 00:29:29 dovecot_login authenticator failed for H=(syn-024-180-043-126.res.spectrum.com) [65.20.191.231]:51662: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-11 00:29:50 dovecot_login authenticator failed for H=([115.95.23.226]) [78.187.9.111]:34562: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-11 00:31:45 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([121.163.63.200]) [125.59.252.103]:49507: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-11 00:32:18 dovecot_login authenticator failed for H=([183.171.236.87]) [196.41.207.112]:53060: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-11 00:38:42 dovecot_login authenticator failed for H=(pppoe-78-111-249-76.dynamic.tvingo.ru) [197.219.210.94]:32910: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.2.70
country_id: 1835841
description:
2026-07-11 00:38:18 dovecot_login authenticator failed for H=([128.185.116.114]) [59.8.2.70]:46070: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.52.248
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-11 00:41:30 dovecot_login authenticator failed for H=([72.207.109.1]) [85.152.57.60]:42923: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.85
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-41.185.255.126.85||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.213.209
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/category/commercial-spaces?Itemid=101 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-11 00:43:08 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com ([59.37.13.66]) [213.66.196.11]:48336: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-11 00:43:17 dovecot_login authenticator failed for H=([220.182.14.60]) [51.116.117.203]:26948: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.196.164.144
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://Https%3a%2Folv.e.l.U.pc@haedongacademy.org/phpinfo.php?a[]=%3Ca%20href=https://dexless.com/proxy.php%3Flink=https://www.nightvisionservices.com/tie-business/photography/%3Ecrazytimes%3C/a%3E%3Cmeta%20http-equiv=refresh%20content=0;url=https://dexless.com/proxy.php%3Flink=https://www.nightvisionservices.com/tie-business/photography/%20/%3E\">crazytimesit</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: reach.ddgalaxy.in
description:


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.198.131
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wireless-presentation-solutions HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-11 00:51:21 dovecot_login authenticator failed for H=([112.28.73.142]) [147.148.205.252]:57402: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-11 00:55:33 dovecot_login authenticator failed for H=(host-93-177-157-179.customer.magticom.ge) [118.33.119.34]:57610: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-11 00:58:24 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net ([192.111.129.146]) [27.124.111.122]:59591: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://bbs.abcdv.net/home.php?mod=space&uid=1365958&do=profile\">\xe2\x80\x9ctrung t\xc3\xa2m nghi\xc3\xaan c\xe1\xbb\xa9u c\xc3\xa2y tr\xe1\xbb\x93ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-11 00:59:08 dovecot_login authenticator failed for H=([31.171.125.179]) [196.188.187.21]:43516: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-07-11 01:00:33 dovecot_login authenticator failed for H=([49.124.149.49]) [90.173.78.90]:59391: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-11 01:01:21 dovecot_login authenticator failed for H=([152.52.192.162]) [197.219.228.242]:35822: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-11 01:00:56 dovecot_login authenticator failed for H=([196.189.51.64]) [190.67.106.221]:48644: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-11 01:02:02 dovecot_login authenticator failed for H=([58.65.73.22]) [41.89.128.6]:40836: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://academy.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.231.172
country_id: 1269750
description:
2026-07-11 01:04:54 dovecot_login authenticator failed for H=([98.182.147.126]) [122.187.231.172]:53674: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.107.16.248
country_id: 2589581
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/11/01/company-launches-new-software-channel/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-11 01:09:30 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([142.54.231.33]) [82.209.148.60]:47770: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2026-07-11 01:10:36 dovecot_login authenticator failed for H=([87.150.241.128]) [91.149.142.17]:35724: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-11 01:10:10 dovecot_login authenticator failed for H=([153.37.177.219]) [14.42.47.150]:53730: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-11 01:10:19 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([222.174.184.86]) [220.246.47.146]:49795: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2026-07-11 01:13:58 dovecot_login authenticator failed for H=176-170-1-244.abo.bbox.fr ([110.172.147.190]) [176.170.1.244]:57637: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-11 01:15:28 dovecot_login authenticator failed for H=([5.48.46.95]) [65.20.161.126]:45221: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-11 01:18:12 dovecot_login authenticator failed for H=([211.217.26.2]) [65.20.161.126]:52647: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 172.105.43.205
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s446893.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.105.151.124
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-26.23.105.151.124||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-11 01:26:24 dovecot_login authenticator failed for H=([210.13.99.68]) [203.252.10.3]:21509: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-11 01:26:35 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net (166.143.48.116.static.netvigator.com) [64.207.225.55]:57558: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.241.153.228
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-26.172.241.153.228||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-11 01:30:21 dovecot_login authenticator failed for H=(211-23-109-116.hinet-ip.hinet.net) [65.20.233.110]:42916: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:metrodigitals||SC:/home/metrodigitals/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350977
abuser: 51.79.180.235
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/fbi.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 67.43.12.67
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 67.43.12.67
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.28||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.161.51
country_id: 6252001
description:
2026-07-11 01:36:43 H=([64.89.161.51]) [64.89.161.51]:55511 F=<dpr@priv8shop.com> rejected RCPT <suniksm2talk@gmail.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-11 01:38:41 dovecot_login authenticator failed for H=([41.214.10.178]) [128.185.187.2]:35504: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-11 01:38:42 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([98.170.57.251]) [64.207.225.55]:50818: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-11 01:39:30 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [122.184.124.46]:38880: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-11 01:39:16 dovecot_login authenticator failed for H=(139-216-6-17.sta.dodo.net.au) [45.167.250.45]:39502: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-11 01:39:29 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se (static-172.84.12.61-tataidc.co.in) [155.4.209.51]:37236: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.138
country_id: 1269750
description:
2026-07-11 01:40:16 dovecot_login authenticator failed for H=(mx-ll-171.6.98-160.dynamic.3bb.in.th) [182.95.182.138]:40810: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked\">1v1.lol unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-11 01:41:39 dovecot_login authenticator failed for H=([125.215.199.37]) [50.212.27.150]:48936: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-11 01:41:58 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [207.188.158.216]:46362: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.157.142
country_id: 1835841
description:
2026-07-11 01:44:00 dovecot_login authenticator failed for H=([98.170.57.236]) [61.80.157.142]:49589: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-07-11 01:44:15 dovecot_login authenticator failed for H=([72.207.33.65]) [210.1.66.154]:60255: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-11 01:44:32 dovecot_login authenticator failed for H=([93.95.241.150]) [182.95.181.50]:34064: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-11 01:44:40 dovecot_login authenticator failed for H=(openemm.lansystems.it) [182.95.116.66]:54744: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-11 01:47:26 dovecot_login authenticator failed for H=a4.ucndns.in (core1-nap.jkt-link.iforte.net.id) [103.252.168.4]:40086: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-11 01:47:34 dovecot_login authenticator failed for H=([49.124.151.28]) [110.227.211.82]:44352: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-11 01:47:09 dovecot_login authenticator failed for H=(54.126.103.87.rev.vodafone.pt) [101.13.4.120]:42640: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 16.174.127.183
country_id: 6251999
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shell.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.152.58.233
country_id: 6252001
description:
2026-07-11 01:47:25 dovecot_login authenticator failed for H=([58.215.243.6]) [104.152.58.233]:43044: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-11 01:50:28 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com ([111.17.213.162]) [89.233.203.159]:43516: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-11 01:50:58 dovecot_login authenticator failed for H=(karuna.divineled.com) [122.169.40.221]:39806: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 190.123.210.247
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.mydeathspace.com/byebye.aspx?go=http://soloture.cafe24.com/tc/guestbook?tssessionsoloturecafe24comtc=49e6e3a54ed0cc946d1d01125959bcfe\">https://www.mydeathspace.com/byebye.aspx?go=http://soloture.cafe24.com/tc/guestbook?tssessionsoloturecafe24comtc=49e6e3a54ed0cc946d1d01125959bcfe</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-11 01:53:05 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net ([59.37.13.66]) [221.120.73.25]:40156: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.18.127.68
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /contact-us?name=Dominick Bowler&email=bowler.dominick@gmail.com&phone=08473701714&subject=Run your social marketing from ChatGPT & Claude \xe2\x80\x94 free 1-on-1&captcha_question=7&message=Hey there,\r\n\r\nWhat if you could manage your marketing directly from ChatGPT or Claude?\r\n\r\nWith the Letstok Connector and our Meta Ads Connector, you can create social posts, manage Meta Ads, brainstorm new campaigns, and control your marketing\xe2\x80\x94all from your AI assistant.\r\n\r\nWe're offering a free 30-minute session to show you how it works using your own business.\r\n\r\nNo sales pressure\xe2\x80\x94just a practical walkthrough and answers to your questions.\r\n# Reserve your free session:\r\n https:/calendar.google.com/appointments/schedules/AcZssZ0uHlTYoWIthRHFAllU-A3_rVAeQNJbDzShB1rda3nduvQ6tWQqCNkoQyRubq99r3pLa7_8CUw1\r\n\r\nCheers,\r\nThe Letstok Team\r\nhttps:/letstalkugc.com\r\n\r\n\r\n\r\nIn case you no longer want to receive subsequent communications from our side, just fill the form at brnd .li/delist url with your domain address (URL).\r\n53 Crown Street, Ellicottville, CA, USA, 90146&contact_id=eyJyZWNpcGllbnRfZW1haWwiOiJjMmhoZVdGNmEyaGhia0I1WVdodmJ5NWpieTVwYmc9PSIsImZyb21fZW1haWwiOiJkMlZpUUdGc2JtRjVlbUV1WTI5dCIsImZyb21fbmFtZSI6IlFXeHVZWGw2WVNCWFpXSnphWFJsIn0=:575b05cd071484e6e8beb99e1504e498&addon_id=1642844955&captcha_answer=8f14e45fceea167a5a36dedd4bea2543&captcha_type=default HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-11 01:56:07 dovecot_login authenticator failed for H=([192.111.135.19]) [103.250.160.76]:39620: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 172.105.43.205
country_id: 1269750
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s785292.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: ibmcglobal.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-11 02:04:36 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com (static-169-23-83-103.ebonenet.com) [78.66.44.246]:48610: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.255.83.8
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://kingslot96.godaddysites.com/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-11 02:08:09 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([49.124.152.30]) [79.138.90.195]:50940: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-11 02:08:21 dovecot_login authenticator failed for H=([162.253.68.102]) [101.13.5.49]:49396: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-11 02:08:22 dovecot_login authenticator failed for H=([183.195.135.222]) [182.95.106.138]:50180: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-11 02:08:50 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [14.35.209.208]:45172: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-11 02:09:15 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([181.48.97.163]) [200.105.141.172]:47334: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-11 02:11:23 dovecot_login authenticator failed for H=(122-116-225-114.hinet-ip.hinet.net) [103.168.241.32]:35635: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-11 02:11:47 dovecot_login authenticator failed for H=([188.247.43.42]) [181.61.251.4]:49078: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.82.38
country_id: 1694008
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:12861.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bd60240c12ea7e19caf172aadd0cbb5ae5709d9e||Title:0x7ac825fa||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-11 02:16:21 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net (95-87-248-223.ip.btc-net.bg) [50.121.186.125]:50743: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-11 02:16:38 dovecot_login authenticator failed for H=([192.252.211.196]) [222.97.195.179]:57734: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 172.105.43.205
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s699844.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-11 02:21:34 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([178.178.222.53]) [93.241.232.14]:45226: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.20.78
country_id: 3017382
description:
2026-07-11 02:22:02 dovecot_login authenticator failed for H=vps-5b692794.vps.ovh.net (111-70-32-10.emome-ip.hinet.net) [213.32.20.78]:51494: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-11 02:28:37 dovecot_login authenticator failed for H=([47.223.212.176]) [94.16.17.141]:39632: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-11 02:28:54 dovecot_login authenticator failed for H=([61.32.68.66]) [122.186.249.6]:41294: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 35.196.184.161
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.28||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-11 02:35:20 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [122.176.21.104]:54345: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-11 02:35:06 dovecot_login authenticator failed for H=([192.111.130.1]) [122.160.11.40]:36867: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-11 02:35:41 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net (wsip-184-178-172-24.rn.hr.cox.net) [111.70.29.132]:43798: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-11 02:42:59 dovecot_login authenticator failed for H=([78.37.9.103]) [1.227.228.131]:48660: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-11 02:44:27 dovecot_login authenticator failed for H=([184.181.217.198]) [45.167.250.45]:48902: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.95.116.245
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 demo crazytime; <a href=\"https://clients1.google.com.tj/url?sa=t&url=http%3A%2F%2Fhigashiyamakai.com%2Fcgi-local%2Fbbs%2Fhigashiyama_kai.cgi%3Faction%3Dregister\">clients1.google.com.tj</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 67.172.163.38
country_id: 6252001
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84624.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:27227a1ded68a8ca5360dd84ed52fffc1002a2ac||Title:0x6bac3280||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-11 02:52:39 dovecot_login authenticator failed for H=([180.94.75.122]) [65.20.204.88]:59537: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-11 02:52:06 dovecot_login authenticator failed for H=([1.223.239.36]) [41.219.149.74]:52537: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.55.252
country_id: 1605651
description:
2026-07-11 02:55:25 dovecot_login authenticator failed for H=node-b24.pool-182-53.dynamic.nt-isp.net ([188.240.192.154]) [182.53.55.252]:37369: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.69.233
country_id: 1269750
description:
2026-07-11 02:55:40 dovecot_login authenticator failed for H=([182.210.174.66]) [122.160.69.233]:35197: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-11 02:58:12 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([74.119.147.213]) [218.103.36.176]:50841: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-11 02:58:35 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net (mx-ll-171.6.98-160.dynamic.3bb.in.th) [72.234.16.75]:59062: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-07-11 03:03:20 dovecot_login authenticator failed for H=([222.246.240.162]) [24.104.225.201]:45226: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-11 03:03:40 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [222.108.109.37]:42325: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 172.105.43.205
country_id: 1269750
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s468438.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-07-11 03:07:29 dovecot_login authenticator failed for H=([36.151.68.7]) [24.104.225.201]:38948: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-11 03:07:39 dovecot_login authenticator failed for H=([213.101.138.172]) [202.62.88.25]:39940: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-11 03:10:30 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.190
country_id: 1733045
description:
2026-07-11 03:12:22 dovecot_login authenticator failed for H=([178.178.222.59]) [49.124.148.190]:60946: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.82
country_id: 2186224
description:
2026-07-11 03:21:10 dovecot_login authenticator failed for H=([152.70.157.25]) [121.73.163.82]:42398: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-11 03:21:37 dovecot_login authenticator failed for H=([121.172.104.204]) [183.82.56.12]:62960: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.243.243.53
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ibmcglobal||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 35.243.243.53
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.28||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-11 03:25:28 dovecot_login authenticator failed for H=([199.116.114.10]) [152.52.192.162]:49908: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-11 03:29:46 dovecot_login authenticator failed for H=(113-11-34-221.broadband.smile.com.bd) [182.95.61.82]:59142: 535 Incorrect authentication data (set_id=pan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-11 03:29:28 dovecot_login authenticator failed for H=([60.172.41.103]) [220.72.138.160]:51698: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.162.227.199
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/serendipity-arts-festival-in-panjim-goa HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-11 03:30:19 dovecot_login authenticator failed for H=([202.138.229.190]) [78.187.9.111]:54491: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.105.15.219
country_id: 6252001
description:
2026-07-11 03:33:29 dovecot_login authenticator failed for H=([58.17.128.7]) [174.105.15.219]:59088: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-11 03:33:46 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([68.71.240.212]) [168.91.173.57]:33064: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-11 03:36:01 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [5.48.46.95]:33470: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-07-11 03:38:26 dovecot_login authenticator failed for H=([49.124.148.189]) [12.150.243.22]:60892: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-11 03:38:38 dovecot_login authenticator failed for H=(137.173.198.203.static.netvigator.com) [175.200.217.128]:53690: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-11 03:38:19 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [120.29.140.188]:44768: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 151.244.79.85
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.google.com/maps/d/u/0/edit?mid=14qyRTA4FUKJ-8LSOlYdQAkAQ8x6NEWs&usp=sharing\">oskelly \xd0\xb8\xd0\xbd\xd1\x82\xd0\xb5\xd1\x80\xd0\xbd\xd0\xb5\xd1\x82 \xd0\xbc\xd0\xb0\xd0\xb3\xd0\xb0\xd0\xb7\xd0\xb8\xd0\xbd</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/kxqjcame/fonts/ddkjeqmc.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: vrishenterprises.in
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.165.46
country_id: 2077456
description:
2026-07-11 03:54:25 dovecot_login authenticator failed for H=([122.185.68.89]) [118.211.165.46]:44839: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-11 03:54:13 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [193.46.192.20]:60129: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-11 03:59:25 dovecot_login authenticator failed for H=([106.246.89.73]) [1.250.67.114]:42774: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.80.17
country_id: 1835841
description:
2026-07-11 04:00:20 dovecot_login authenticator failed for H=(bb121-6-81-59.singnet.com.sg) [121.1.80.17]:54237: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 5.83.135.102
country_id: 2921044
domain: fefkadirectorsunion.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:widget-session.jpg||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 5.83.135.102
country_id: 2921044
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:widget-session.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.43.150.20
country_id: 1668284
description:
2026-07-11 04:08:35 dovecot_login authenticator failed for H=([31.173.2.182]) [115.43.150.20]:59336: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-11 04:08:50 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([124.152.90.68]) [83.255.209.245]:40498: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.251
country_id: 1733045
description:
2026-07-11 04:10:58 dovecot_login authenticator failed for H=([72.207.33.65]) [49.124.150.251]:39138: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-11 04:14:30 dovecot_login authenticator failed for H=([183.6.115.88]) [175.203.199.118]:35358: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-11 04:14:49 dovecot_login authenticator failed for H=(118-163-145-175.hinet-ip.hinet.net) [128.185.33.227]:53822: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.229.103.195
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-14.138.229.103.195||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 130.254.112.55
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-14.130.254.112.55||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 138.229.103.195
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 170.199.229.70
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:8.28||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 170.199.229.70
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-14.170.199.229.70||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.75.254
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-14.167.160.75.254||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://legal.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.53.167.93
country_id: 1562822
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/colonoscopy/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.177.242
country_id: 3703430
description:
2026-07-11 04:23:24 dovecot_login authenticator failed for H=([183.171.57.72]) [200.46.177.242]:38074: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-11 04:23:47 dovecot_login authenticator failed for H=(host-148-170-156-248.public.eastlink.ca) [182.95.61.82]:50956: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.194.120
country_id: 163843
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/uncategorized/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-11 04:25:12 dovecot_login authenticator failed for H=([45.182.5.96]) [103.83.23.169]:55070: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-07-11 04:25:51 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [122.187.229.168]:54973: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: sriganapathyent.in.vrishenterprises.in
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-11 04:26:37 dovecot_login authenticator failed for H=([121.185.89.74]) [65.191.211.33]:58108: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.198.98
country_id: 1819730
description:
2026-07-11 04:26:46 dovecot_login authenticator failed for H=(90-230-115-5-no2550.tbcn.telia.com) [121.202.198.98]:56757: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.180.164.182
country_id: 1835841
description:
2026-07-11 04:27:12 dovecot_login authenticator failed for H=([119.196.213.196]) [121.180.164.182]:37507: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-11 04:26:54 dovecot_plain authenticator failed for H=(chers) [190.67.106.221]:47362: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.105.15.219
country_id: 6252001
description:
2026-07-11 04:27:02 dovecot_login authenticator failed for H=([1.241.64.237]) [174.105.15.219]:35226: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.37.22
country_id: 1835841
description:
2026-07-11 04:31:59 dovecot_login authenticator failed for H=([111.21.45.74]) [119.207.37.22]:50625: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.183.59.33
country_id: 130758
description:
2026-07-11 04:37:15 dovecot_login authenticator failed for H=([223.75.156.89]) [94.183.59.33]:47992: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.118.20.106
country_id: 2921044
description:
2026-07-11 04:37:30 dovecot_login authenticator failed for H=ip-084-118-020-106.um23.pools.vodafone-ip.de (hn.kd.ny.adsl) [84.118.20.106]:42433: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.94.151
country_id: 1835841
description:
2026-07-11 04:41:29 dovecot_login authenticator failed for H=([174.75.211.198]) [211.252.94.151]:36601: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.46
country_id: 99237
description:
2026-07-11 04:41:44 dovecot_login authenticator failed for H=([192.111.143.93]) [65.20.138.46]:51545: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-11 04:44:28 dovecot_login authenticator failed for H=([121.6.81.59]) [165.101.222.22]:39041: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-11 04:44:40 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net ([80.223.201.173]) [111.70.9.143]:58667: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-11 04:49:21 dovecot_login authenticator failed for H=([67.201.58.185]) [207.254.29.22]:53271: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.185.128.124
country_id: 3865483
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/assets/client/GR-16.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-11 04:51:11 dovecot_login authenticator failed for H=([222.92.61.242]) [182.95.150.106]:58238: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-11 04:51:21 dovecot_login authenticator failed for H=([182.95.127.42]) [183.82.56.12]:57709: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2026-07-11 05:00:37 dovecot_login authenticator failed for H=([174.77.111.220]) [122.187.249.88]:40824: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-07-11 05:00:50 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca ([49.124.151.7]) [96.30.129.165]:37952: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:ogocindia||SC:/home/ogocindia/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-11 05:14:14 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [103.67.152.201]:40062: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.33
country_id: 1835841
description:
2026-07-11 05:15:26 dovecot_login authenticator failed for H=(dynamic-ip-19015713210.cable.net.co) [112.164.234.33]:51759: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-11 05:15:06 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [125.23.203.138]:37206: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 48.211.158.211
country_id: 6252001
description:
[2026-07-11 05:15:22 +0530] info [whostmgrd] 48.211.158.211 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.naughtyallie.com/gals/pgals/p0077awrh/?link=http://lonevelde.lovasok.hu/out_link.php?url=https://exyuiptv.org/iptv/svedska/\">premium Iptv za Dijasporu</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: travelinbh.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/xbinhjws/fonts/flbselfx.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: travelinbh.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/tshebhzy/fonts/guyjhtje.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-07-11 05:23:12 dovecot_login authenticator failed for H=([101.13.4.124]) [103.111.6.121]:51070: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-11 05:23:23 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([65.20.204.179]) [90.230.212.29]:33982: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-11 05:27:36 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([58.221.244.34]) [82.209.148.60]:35198: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.55.147
country_id: 1562822
description:
2026-07-11 05:27:57 dovecot_login authenticator failed for H=([49.124.151.64]) [222.252.55.147]:57830: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.48.99.5
country_id: 1168579
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/29/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.255.126.94
country_id: 4566966
description:
2026-07-11 05:33:43 dovecot_login authenticator failed for H=([109.207.33.248]) [38.255.126.94]:59897: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.171.72.93
country_id: 2921044
domain: autoconfig.ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-07-11 05:35:10 dovecot_login authenticator failed for H=([27.123.94.66]) [196.188.187.205]:43078: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.171.74.60
country_id: 2635167
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/database_backup.sql||User:ibmcglobal||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-11 05:40:35 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is ([184.181.217.198]) [185.40.122.250]:45271: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.156
country_id: 1835841
description:
2026-07-11 05:40:04 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [121.131.220.156]:60534: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-11 05:41:36 dovecot_login authenticator failed for H=([107.181.168.150]) [196.41.207.112]:32853: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-11 05:42:16 dovecot_login authenticator failed for H=(red.138.118.213.068.ssservicios.com.ar) [65.20.233.110]:38135: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-11 05:42:44 dovecot_login authenticator failed for H=([112.29.109.174]) [121.185.89.74]:54624: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-11 05:43:02 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([178.178.222.52]) [51.68.226.171]:52930: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-11 05:45:03 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net ([104.152.58.233]) [110.25.107.172]:53856: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-11 05:52:02 dovecot_login authenticator failed for H=([142.54.239.4]) [197.219.228.242]:42608: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-11 05:52:05 dovecot_login authenticator failed for H=([103.187.78.189]) [116.98.104.138]:55392: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-07-11 05:52:19 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se ([162.217.227.37]) [176.10.197.168]:58046: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-11 05:52:49 dovecot_login authenticator failed for H=(201-91-74-17.customer.tdatabrasil.net.br) [121.131.220.168]:42676: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-11 05:53:13 dovecot_login authenticator failed for H=([61.74.224.30]) [182.95.228.106]:40726: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.150.19.157
country_id: 3996063
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-11 05:53:49 dovecot_login authenticator failed for H=([182.90.248.108]) [51.162.194.94]:38100: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-11 05:54:05 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([68.71.251.130]) [220.246.40.63]:52368: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-11 05:57:42 dovecot_login authenticator failed for H=([59.3.212.111]) [213.55.79.195]:46738: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-11 05:57:59 dovecot_login authenticator failed for H=([196.189.126.10]) [41.89.128.6]:50370: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-11 06:03:09 dovecot_login authenticator failed for H=([179.125.175.74]) [182.78.112.174]:44970: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-11 06:03:24 dovecot_login authenticator failed for H=([49.124.146.37]) [171.244.60.35]:6400: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-11 06:07:33 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [116.98.104.138]:51268: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-11 06:07:50 dovecot_login authenticator failed for H=([111.26.63.84]) [121.148.184.47]:58894: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-11 06:07:14 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([187.93.202.22]) [121.6.81.59]:42962: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-11 06:08:39 dovecot_login authenticator failed for H=([59.8.114.177]) [41.128.181.196]:52298: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.54.166.194
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:142.54.166.194||TA:142.54.166.194||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-11 06:09:15 dovecot_login authenticator failed for H=a4.ucndns.in (ctw.webcas.net) [103.252.168.4]:53438: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.110.237.114
country_id: 1269750
description:
2026-07-11 06:12:11 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [103.110.237.114]:4563: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-11 06:12:31 dovecot_login authenticator failed for H=([220.179.255.54]) [98.122.215.23]:35030: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-11 06:13:34 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([49.124.155.162]) [83.166.50.15]:40453: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-11 06:13:51 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [182.95.232.66]:48066: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-11 06:19:33 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se ([174.75.211.203]) [89.253.90.113]:53766: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-11 06:19:46 dovecot_login authenticator failed for H=([211.178.165.251]) [116.72.9.151]:42892: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2026-07-11 06:22:42 dovecot_login authenticator failed for H=([221.10.221.104]) [136.185.6.181]:52927: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.34
country_id: 2186224
description:
2026-07-11 06:23:50 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [121.73.168.34]:55456: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-11 06:23:25 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net ([77.41.156.64]) [111.70.28.243]:34145: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-11 06:23:28 dovecot_login authenticator failed for H=([218.17.113.148]) [112.162.111.205]:57402: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.244.92.197
country_id: 6251999
description:
2026-07-11 06:25:41 dovecot_login authenticator failed for H=dhcp-4-bc-9f-5c-cd-c1.cpe.i-zoom.net (hpot-141-39-221-152.rdns.hnet.measurement.network) [24.244.92.197]:46472: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-11 06:26:05 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [121.129.75.178]:51813: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.231.172
country_id: 1269750
description:
2026-07-11 06:26:08 dovecot_login authenticator failed for H=([98.190.239.1]) [122.187.231.172]:40734: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-11 06:26:23 dovecot_login authenticator failed for H=(180.151.254.218.reverse.spectranet.in) [196.189.51.64]:52826: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-11 06:26:22 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com (visaotur.sdr.gvt.net.br) [213.66.196.11]:42858: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-11 06:26:01 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net (nsg-static-153.77.71.182.airtel.in) [66.45.144.201]:56012: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://opus.uni-hohenheim.de/awstats/awstats.pl?framename=mainright&output=refererpages\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 82.125.158.137
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88746.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:95a10679a487c365afd8cb18242fa5411110d150||Title:0x261e218c||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2026-07-11 06:33:49 dovecot_login authenticator failed for H=([198.8.94.171]) [61.81.133.182]:45718: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.251.0.147
country_id: 390903
description:
2026-07-11 06:33:20 dovecot_login authenticator failed for H=([1.250.67.114]) [212.251.0.147]:54600: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.25.192
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/about-us HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-11 06:40:35 dovecot_login authenticator failed for H=([195.158.14.232]) [220.86.176.134]:48132: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-11 06:40:55 dovecot_login authenticator failed for H=([174.64.199.77]) [182.95.217.202]:47770: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-11 06:41:28 dovecot_login authenticator failed for H=([89.111.237.150]) [212.132.64.89]:35996: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-11 06:44:40 dovecot_login authenticator failed for H=([67.201.33.12]) [221.167.50.229]:34318: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-11 06:45:04 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net (distribution05-10gb.1560.la3.switches.zerolag.com) [111.70.29.132]:47895: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-11 06:45:18 dovecot_login authenticator failed for H=(110-25-105-240.adsl.fetnet.net) [129.45.84.119]:43500: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.221.251.64
country_id: 878675
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:46924.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8077ed126495293ab75407691554d9397e60276d||Title:0x55609721||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://brickipedia.org/index.php?title=L%C3%A0m_Th%E1%BA%BF_N%C3%A0o_%C4%90%E1%BB%83_Ch%E1%BB%8Dn_%C4%90%C3%BAng_N%C6%A1i_B%C3%A1n_Gi%E1%BB%91ng_C%C3%A0_Ph%C3%AA%3F\">Xem b\xc3\xa0i vi\xe1\xba\xbft</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-11 06:47:33 dovecot_login authenticator failed for H=(189-20-84-129.customer.tdatabrasil.net.br) [38.148.99.59]:46688: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.197.152.49
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-11 06:55:04 dovecot_login authenticator failed for H=([117.159.93.197]) [95.82.7.89]:50447: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-11 06:55:23 dovecot_login authenticator failed for H=(mail.sotus.co.th) [94.16.17.141]:53522: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 144.225.203.202
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-zjk6e8x6.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 92.205.186.129
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://vird.co/go/virdsam\">Syair Virdsam</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2026-07-11 07:03:56 dovecot_login authenticator failed for H=([211.169.212.206]) [49.124.147.96]:41988: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-11 07:04:13 dovecot_login authenticator failed for H=([49.125.201.77]) [65.20.161.126]:50145: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.171.215.52
country_id: 3996063
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2019/01/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-11 07:08:38 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee (ip-68-71-242-113.hosts.zerolag.com) [83.166.50.15]:46542: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.240.192.154
country_id: 2510769
description:
2026-07-11 07:08:40 dovecot_login authenticator failed for H=([184.170.245.145]) [188.240.192.154]:57829: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.117.184.1
country_id: 3437598
domain: combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/combinations.in/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-07-11 07:10:09 dovecot_login authenticator failed for H=([198.8.94.171]) [121.131.220.136]:43209: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-11 07:10:29 dovecot_login authenticator failed for H=(syn-071-012-042-216.res.spectrum.com) [119.196.213.196]:54346: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783734113678.PhP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-11 07:11:52 dovecot_login authenticator failed for H=a4.ucndns.in ([68.71.247.133]) [103.252.168.4]:53532: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.189.40.91
country_id: 6252001
description:
2026-07-11 07:11:00 dovecot_login authenticator failed for H=syn-108-189-040-091.biz.spectrum.com ([103.121.27.218]) [108.189.40.91]:43861: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-11 07:12:19 dovecot_login authenticator failed for H=([221.159.21.170]) [203.193.168.136]:49960: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://bbs.abcdv.net/home.php?mod=space&uid=1374665&do=profile\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-11 07:18:30 dovecot_login authenticator failed for H=([65.20.205.197]) [62.201.228.210]:40900: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-11 07:19:16 dovecot_login authenticator failed for H=([27.123.114.190]) [182.95.185.142]:35736: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-11 07:20:04 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([196.0.113.110]) [135.125.199.17]:39206: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-11 07:20:47 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([184.181.217.198]) [85.195.9.20]:38764: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-11 07:24:15 dovecot_login authenticator failed for H=([61.84.228.191]) [152.52.198.42]:38170: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-11 07:24:32 dovecot_login authenticator failed for H=([60.18.139.82]) [182.95.229.110]:39948: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://miami.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.0.119
country_id: 1835841
description:
2026-07-11 07:24:54 dovecot_login authenticator failed for H=([218.21.243.58]) [221.162.0.119]:51544: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-11 07:25:47 dovecot_login authenticator failed for H=([59.28.170.183]) [1.227.228.131]:53689: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-11 07:26:15 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([36.135.93.36]) [83.191.176.93]:39586: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-11 07:28:23 dovecot_login authenticator failed for H=(mail.sotus.co.th) [103.171.39.147]:36116: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-11 07:28:50 dovecot_login authenticator failed for H=(c-50-187-155-130.unallocated.comcastbusiness.net) [14.35.209.208]:59850: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.79
country_id: 1733045
description:
2026-07-11 07:32:45 dovecot_login authenticator failed for H=([59.0.127.22]) [49.125.201.79]:57132: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 216.250.105.229
country_id: 1819730
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/keralapeople/public_html/admin.php||User:keralapeople||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-11 07:40:51 dovecot_login authenticator failed for H=([111.26.177.216]) [182.95.119.30]:48676: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-11 07:41:24 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net (90-230-115-5-no2550.tbcn.telia.com) [66.45.144.201]:50516: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.150
country_id: 1835841
description:
2026-07-11 07:42:32 dovecot_login authenticator failed for H=([174.64.199.88]) [121.131.220.150]:54375: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-11 07:43:33 dovecot_login authenticator failed for H=([101.13.1.75]) [128.185.235.110]:36462: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-11 07:44:38 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [197.242.170.10]:59938: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.150
country_id: 1835841
description:
2026-07-11 07:43:57 dovecot_login authenticator failed for H=(server.first4systems.com) [121.131.220.150]:34163: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-11 07:45:36 dovecot_login authenticator failed for H=([49.124.151.64]) [152.52.198.42]:53674: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-11 07:45:59 dovecot_login authenticator failed for H=([183.171.57.164]) [122.185.44.206]:34057: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-11 07:46:42 dovecot_login authenticator failed for H=([142.54.236.102]) [182.95.176.122]:50412: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-11 07:46:28 dovecot_login authenticator failed for H=([218.235.135.46]) [201.46.124.0]:2953: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-11 07:46:04 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([128.185.33.239]) [60.40.45.223]:60478: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.152.58.233
country_id: 6252001
description:
2026-07-11 07:46:55 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [104.152.58.233]:39505: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 62.93.179.167
country_id: 2510769
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcei7rx7cx1.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://physics.life/proxy.php?link=https://maps.google.tk/url?q=https://exyuiptv.app/\">EXYU IPTV</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 194.5.82.96
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.28||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-11 07:52:33 dovecot_login authenticator failed for H=([70.166.167.44]) [78.187.230.168]:36363: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-11 07:51:56 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([109.233.21.109]) [50.121.186.125]:55822: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-11 07:52:08 dovecot_login authenticator failed for H=([178.178.194.151]) [85.105.255.56]:41790: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-11 07:56:46 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([74.119.147.213]) [94.61.159.91]:33020: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-11 07:57:16 dovecot_login authenticator failed for H=(111-70-33-194.emome-ip.hinet.net) [175.213.137.209]:35132: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-11 08:01:24 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net (static.91.254.104.190.cps.com.ar) [71.229.1.186]:56478: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-11 08:01:53 dovecot_login authenticator failed for H=([192.252.208.66]) [102.210.148.41]:33530: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.157.240
country_id: 1835841
description:
2026-07-11 08:03:51 dovecot_login authenticator failed for H=([142.54.228.195]) [218.149.157.240]:41886: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-11 08:03:36 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [119.92.76.210]:57100: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-11 08:03:53 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([201.28.246.221]) [68.7.114.69]:32887: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-07-11 08:04:36 dovecot_login authenticator failed for H=([45.82.110.150]) [196.188.187.205]:43478: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-11 08:04:14 dovecot_login authenticator failed for H=([61.72.145.38]) [47.234.138.49]:45304: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-11 08:07:40 dovecot_login authenticator failed for H=(111-211-96-66.myrepublic.com.sg) [110.227.211.82]:57372: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-11 08:08:08 dovecot_login authenticator failed for H=([178.178.194.136]) [203.193.168.136]:34908: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-11 08:08:34 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net ([222.124.249.132]) [110.25.107.172]:58216: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.62
country_id: 1733045
description:
2026-07-11 08:08:04 dovecot_login authenticator failed for H=([208.69.161.90]) [49.124.145.62]:34112: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.117.104.197
country_id: 1168579
description:
2026-07-11 08:11:21 dovecot_plain authenticator failed for H=(localhost) [45.117.104.197]:63169: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-11 08:14:50 dovecot_login authenticator failed for H=([111.26.167.37]) [152.52.192.162]:46938: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-11 08:14:22 dovecot_login authenticator failed for H=([196.190.220.199]) [65.181.79.60]:63518: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.90.151.230
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:103.90.151.230||TA:103.90.151.230||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-11 08:15:23 dovecot_login authenticator failed for H=([121.66.124.147]) [122.160.11.40]:45753: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-11 08:18:24 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [180.71.9.31]:43850: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.3.220.211
country_id: 1643084
description:
2026-07-11 08:19:32 dovecot_plain authenticator failed for H=(localhost) [103.3.220.211]:52437: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.139.57
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-gs50-portable-projector-review-little-lunchbox-of-light HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-11 08:23:09 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (113-11-34-221.broadband.smile.com.bd) [218.219.193.151]:44870: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-11 08:23:49 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [119.196.213.196]:36222: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-11 08:23:53 dovecot_login authenticator failed for H=([65.20.146.109]) [74.209.100.246]:33032: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-11 08:24:53 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [152.52.192.162]:47712: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-11 08:24:53 dovecot_login authenticator failed for H=([183.36.25.148]) [101.13.5.63]:48858: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2026-07-11 08:25:06 dovecot_login authenticator failed for H=(ipmapt-72-195-114-182.oc.oc.cox.net) [49.124.147.96]:38620: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.92.45
country_id: 2802361
description:
2026-07-11 08:29:26 dovecot_login authenticator failed for H=([98.170.57.236]) [91.86.92.45]:12379: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-11 08:29:17 dovecot_login authenticator failed for H=([183.171.4.144]) [122.187.234.73]:51385: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-11 08:30:34 dovecot_login authenticator failed for H=(nsg-corporate-110.116.187.122.airtel.in) [197.219.208.38]:36682: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-11 08:31:03 dovecot_login authenticator failed for H=([223.86.148.242]) [203.192.211.180]:55226: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-11 08:31:55 dovecot_login authenticator failed for H=([182.95.178.174]) [61.37.150.6]:57173: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.195.163
country_id: 1835841
description:
2026-07-11 08:36:40 dovecot_login authenticator failed for H=([192.111.131.4]) [124.153.195.163]:40235: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-11 08:41:28 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([67.201.33.12]) [111.70.38.53]:56431: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.211.210
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://index.businessinsurance.com/businessinsurance/article/abnewswire-2026-6-4-pressure-washing-support-in-farmingville-ny-expanded-by-power-washing-pros-of-farmingville-to-improve-long-term-roof-performance-across-the-service-area\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-11 08:46:13 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([192.252.208.66]) [73.203.17.220]:36262: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-11 08:47:37 dovecot_login authenticator failed for H=(136.151.48.116.static.netvigator.com) [119.196.213.196]:33266: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-11 08:48:15 dovecot_login authenticator failed for H=([199.58.185.11]) [14.38.177.105]:58326: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 129.121.77.134
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/sys_73818y.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 129.121.77.134
country_id: 6252001
domain: mail.fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:sys_n3g4a8.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 129.121.77.134
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: Attempt to upload malware||Action:upload||Scan duration:104006||Sizes:2518||Combined size:2518||User:jaashsupplies||WPU:||Filename:log_o2fm0s.gif||Scanned:/tmp//20260711-084950-alG2Vs0i6CLxwVId8bCa7gAAARE-file-0GUV1s||SC:/home/jaashsupplies/public_html/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 129.121.77.134
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:sys_73818y.gif||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 129.121.77.134
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:log_o2fm0s.gif||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 129.121.77.134
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Attempt to upload malware||Action:upload||Scan duration:176772||Sizes:2518||Combined size:2518||User:yukticlick||WPU:||Filename:sys_73818y.gif||Scanned:/tmp//20260711-084959-alG2X4rQzdJDL9lm28ggfwAAAEk-file-D5cA1x||SC:/home/yukticlick/public_html/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 129.121.77.134
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:log_o2fm0s.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.84.103.142
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 movers perth (<a href=\"http://Www.Place123.net/place/rise-movers-vaughan-vaughan-on-canada\">Www.Place123.net</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 129.121.77.134
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:sys_73818y.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-11 08:51:53 dovecot_login authenticator failed for H=([182.95.12.178]) [182.95.181.166]:56934: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-11 08:52:22 dovecot_login authenticator failed for H=([70.166.167.44]) [182.95.61.82]:48846: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-11 08:52:04 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([61.178.82.215]) [210.0.90.82]:43342: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-11 08:52:46 dovecot_login authenticator failed for H=([125.23.79.65]) [1.227.228.131]:45500: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-11 08:53:07 dovecot_login authenticator failed for H=(ip184-182-240-1.mc.at.cox.net) [1.250.67.114]:58664: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-11 08:54:30 dovecot_login authenticator failed for H=([186.239.41.74]) [65.20.204.88]:45446: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-11 08:53:54 dovecot_login authenticator failed for H=([211.223.182.96]) [2.59.162.146]:34482: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.35.187
country_id: 1835841
description:
2026-07-11 08:54:47 dovecot_login authenticator failed for H=([72.223.188.94]) [182.31.35.187]:49966: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-07-11 08:55:10 dovecot_login authenticator failed for H=(201-91-242-197.customer.tdatabrasil.net.br) [24.104.225.201]:45475: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-11 08:54:54 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com (31.73.95.218.broad.yc.jx.dynamic.163data.com.cn) [78.66.44.23]:34462: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.73
country_id: 1269750
description:
2026-07-11 08:58:10 dovecot_login authenticator failed for H=([49.124.151.57]) [122.187.230.73]:57458: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-11 08:58:06 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [65.20.217.64]:40337: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-11 08:57:55 dovecot_login authenticator failed for H=(180.151.254.218.reverse.spectranet.in) [185.66.234.228]:54454: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-11 09:00:26 dovecot_login authenticator failed for H=(nsg-corporate-175.229.187.122.airtel.in) [122.169.40.221]:45222: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.187
country_id: 3017382
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:alnay||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.243.187
country_id: 3017382
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.28.243.187||TA:104.28.243.187||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-11 09:01:21 dovecot_login authenticator failed for H=([182.79.95.152]) [203.252.10.3]:57493: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 104.28.243.187
country_id: 3017382
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-11 09:01:47 dovecot_login authenticator failed for H=([115.95.23.226]) [59.145.160.134]:45504: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.187
country_id: 3017382
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/ssl/server.key||User:alnay||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-11 09:03:38 dovecot_login authenticator failed for H=([182.95.12.178]) [182.95.181.166]:33196: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 158.62.81.43
country_id: 1694008
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94256.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c49f9017d40b7e65cc012d1128f4a24f15b170d5||Title:0xb152109f||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-11 09:04:24 dovecot_login authenticator failed for H=([183.171.208.25]) [182.72.102.106]:34246: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-11 09:04:38 dovecot_login authenticator failed for H=([49.124.153.35]) [118.220.149.121]:54446: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-11 09:05:49 dovecot_login authenticator failed for H=([49.124.132.53]) [59.145.160.134]:41356: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-11 09:06:12 dovecot_login authenticator failed for H=([64.53.7.231]) [175.203.199.118]:32509: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-11 09:08:40 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com (178.170.251.102.leadertelecom.ru) [90.230.212.29]:57440: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-11 09:09:07 dovecot_login authenticator failed for H=([184.170.245.145]) [94.16.17.140]:47288: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.203.6
country_id: 3865483
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/company-profile/7-our-values HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 2a01:4f8:1c19:a57f::1
country_id: 2921044
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:futuracarecom||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 2a01:4f8:1c19:a57f::1
country_id: 2921044
domain: futuracare.com.au
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:2a01:4f8:1c19:a57f::1||TA:2a01:4f8:1c19:a57f::1||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-11 09:11:04 dovecot_login authenticator failed for H=([211.216.58.204]) [125.23.255.134]:44030: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.201.180.231
country_id: 1694008
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/22/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-11 09:14:10 dovecot_login authenticator failed for H=ns1.sinergi.net.id (SCZ-190-104-24-00006.tigo.bo) [223.25.108.2]:34226: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.236.155
country_id: 1168579
description:
2026-07-11 09:13:57 dovecot_login authenticator failed for H=([198.8.91.78]) [119.152.236.155]:44909: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-11 09:19:21 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net (119.92.76.213.static.pldt.net) [64.207.225.55]:56776: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-11 09:19:46 dovecot_login authenticator failed for H=([183.171.5.112]) [103.168.241.32]:33050: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.232.211
country_id: 1269750
description:
2026-07-11 09:19:54 dovecot_login authenticator failed for H=([115.89.229.34]) [106.201.232.211]:43472: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-11 09:20:05 dovecot_login authenticator failed for H=([102.110.7.41]) [65.191.211.33]:48716: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-11 09:21:25 dovecot_login authenticator failed for H=([102.110.11.36]) [207.254.40.89]:61427: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-11 09:21:01 dovecot_login authenticator failed for H=([183.171.4.144]) [183.104.220.152]:41624: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-11 09:21:34 dovecot_login authenticator failed for H=([118.45.101.159]) [122.187.116.110]:51724: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-11 09:20:53 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net (ip-104-200-152-25.hosts.zerolag.com) [68.7.114.69]:41936: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-11 09:24:24 dovecot_login authenticator failed for H=([182.135.63.175]) [182.95.123.50]:34906: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.207
country_id: 1668284
description:
2026-07-11 09:24:12 dovecot_login authenticator failed for H=111-70-32-207.emome-ip.hinet.net (abts-north-static-233.69.160.122.airtelbroadband.in) [111.70.32.207]:60117: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.253.71
country_id: 1835841
description:
2026-07-11 09:29:04 dovecot_login authenticator failed for H=([49.124.159.193]) [112.164.253.71]:44501: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 106.219.165.223
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:09-29.106.219.165.223||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-11 09:32:52 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([103.104.127.49]) [67.43.243.158]:53090: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-11 09:32:40 dovecot_login authenticator failed for H=([218.149.235.152]) [218.156.93.206]:43687: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.166.131
country_id: 1835841
description:
2026-07-11 09:33:44 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [14.49.166.131]:51116: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-11 09:33:03 dovecot_login authenticator failed for H=(27.49.156.220.rev.iijmobile.jp) [182.95.176.122]:54788: 535 Incorrect authentication data (set_id=pan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-11 09:33:54 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com (27-33-247-46.tpgi.com.au) [89.233.203.159]:48088: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-11 09:35:53 dovecot_login authenticator failed for H=([103.220.16.51]) [165.101.222.22]:43624: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 204.157.251.170
country_id: 3508796
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/22/strategy-development-for-clients/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-11 09:42:09 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net ([183.171.4.155]) [110.25.107.172]:60238: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.26.25
country_id: 1282988
description:
2026-07-11 09:42:27 dovecot_login authenticator failed for H=([203.124.32.243]) [103.156.26.25]:35668: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-11 09:47:43 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [103.176.160.146]:44404: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.124
country_id: 1668284
description:
2026-07-11 09:48:02 dovecot_login authenticator failed for H=111-70-38-124.emome-ip.hinet.net ([46.163.174.216]) [111.70.38.124]:52596: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-11 09:53:33 dovecot_login authenticator failed for H=([112.184.22.125]) [112.161.42.97]:40267: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.11
country_id: 1668284
description:
2026-07-11 09:54:18 dovecot_login authenticator failed for H=111-70-32-11.emome-ip.hinet.net ([125.23.255.134]) [111.70.32.11]:40098: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-11 09:56:29 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([206.220.175.5]) [24.105.160.100]:33029: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-11 09:55:53 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([49.124.133.224]) [67.85.146.216]:46164: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.255.5
country_id: 3625428
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/index.php/ibmc-services HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.106.241.211
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/index.php HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 209.242.211.131
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://news.northamericanreport.com/story/544844/paver-cleaning-services-enhance-outdoor-surface-maintenance-by-paver-cleaning-sealing-pros-of-dix-hills-in-dix-hills-new-york.html\">Paver Cleaning services</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-11 10:09:39 dovecot_login authenticator failed for H=([211.223.41.90]) [210.5.117.238]:51424: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.46
country_id: 99237
description:
2026-07-11 10:14:37 dovecot_login authenticator failed for H=(6.40.48.59.broad.cz.sx.dynamic.163data.com.cn) [65.20.138.46]:36083: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-11 10:14:02 dovecot_login authenticator failed for H=(static-201-163-73-93.alestra.net.mx) [205.250.25.62]:34668: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-11 10:14:14 dovecot_login authenticator failed for H=([178.178.222.52]) [122.160.15.31]:60821: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-11 10:15:24 dovecot_login authenticator failed for H=([210.204.110.224]) [65.99.181.123]:39661: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.167.38.157
country_id: 102358
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/our-services/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.240.247
country_id: 1168579
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/products/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-11 10:27:43 dovecot_login authenticator failed for H=([112.31.167.120]) [210.123.87.143]:40288: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-11 10:27:59 dovecot_login authenticator failed for H=([85.30.248.213]) [119.92.76.210]:33386: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.124.44.231
country_id: 1168579
description:
2026-07-11 10:29:31 dovecot_login authenticator failed for H=([49.124.155.189]) [203.124.44.231]:55161: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-11 10:29:43 dovecot_login authenticator failed for H=([38.148.99.59]) [65.20.233.110]:47678: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-11 10:30:32 dovecot_login authenticator failed for H=([68.71.249.154]) [197.219.210.94]:42696: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.100.216.56
country_id: 1269750
description:
2026-07-11 10:31:07 dovecot_login authenticator failed for H=(nsg-static-97.152.75.182-airtel.com) [103.100.216.56]:52362: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.134.215.22
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/_h3x_ybxyqqnc.phtml.json||SC:/home/globalgroupoman/public_html/images/_h3x_ybxyqqnc.phtml.json||


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 23.27.116.225
country_id: 1880251
domain: elegantautomotives.com
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-11 10:37:20 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([149.54.15.90]) [110.25.109.54]:60749: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.190
country_id: 3017382
domain: stcinemas.co
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:stcinemas||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.187
country_id: 3017382
domain: stcinemas.co
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:stcinemas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-11 10:45:08 dovecot_login authenticator failed for H=([83.220.245.109]) [98.122.215.23]:36648: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.88.103.109
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:51857.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fd4572bc0e2c8429442b22a57a0f339315842d3b||Title:0xdc8faf8d||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-07-11 10:48:16 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl ([70.166.167.35]) [178.183.125.51]:53620: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-11 10:49:00 dovecot_login authenticator failed for H=([68.71.253.70]) [125.23.203.138]:40970: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-11 10:58:43 dovecot_login authenticator failed for H=(221-120-4-61.emome-ip.hinet.net) [197.219.208.58]:43984: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-11 10:58:55 dovecot_login authenticator failed for H=([117.204.1.45]) [182.95.123.50]:48028: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-11 11:02:42 dovecot_login authenticator failed for H=([121.173.245.152]) [27.123.111.110]:60542: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-11 11:03:13 dovecot_login authenticator failed for H=([182.95.187.86]) [38.212.67.79]:46870: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.211.190
country_id: 3017382
domain: stcinemas.co
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.28.211.190||TA:104.28.211.190||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-11 11:05:40 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [98.122.215.23]:46084: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-11 11:05:03 dovecot_login authenticator failed for H=([36.151.68.7]) [196.191.142.67]:39852: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.82
country_id: 2186224
description:
2026-07-11 11:05:15 dovecot_login authenticator failed for H=([128.185.33.228]) [121.73.163.82]:50966: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-11 11:05:19 dovecot_login authenticator failed for H=([24.45.137.84]) [196.189.59.226]:44687: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-11 11:06:01 dovecot_login authenticator failed for H=([203.252.10.4]) [51.162.194.94]:53859: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-11 11:06:32 dovecot_login authenticator failed for H=([222.99.52.202]) [41.128.181.196]:34892: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-11 11:08:45 dovecot_login authenticator failed for H=([59.8.31.162]) [101.13.5.49]:59916: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-11 11:11:25 dovecot_login authenticator failed for H=([200.58.83.79]) [196.189.51.64]:39506: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-11 11:11:36 dovecot_login authenticator failed for H=([103.106.193.17]) [14.35.209.208]:48032: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-11 11:11:04 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net ([27.115.113.138]) [110.25.109.52]:33635: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-11 11:12:41 dovecot_login authenticator failed for H=([183.171.148.95]) [197.219.228.246]:56728: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.100.98.105
country_id: 718075
description:
2026-07-11 11:12:57 dovecot_login authenticator failed for H=([98.182.147.126]) [94.100.98.105]:57117: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-11 11:15:04 dovecot_login authenticator failed for H=([192.252.211.196]) [205.250.25.62]:40814: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.222.19.195
country_id: 6252001
description:
2026-07-11 11:15:20 dovecot_login authenticator failed for H=192-222-19-195.comsouth.net ([61.185.30.170]) [192.222.19.195]:54213: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-11 11:17:27 dovecot_login authenticator failed for H=([89.121.255.194]) [125.23.255.134]:57628: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-11 11:17:37 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([98.181.137.75]) [80.223.163.253]:46812: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-11 11:18:19 +0530] info [whostmgrd] 223.181.13.36 NEW root:IHgRQiDTGD3sKAKv address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.31.162
country_id: 1835841
description:
2026-07-11 11:19:26 dovecot_login authenticator failed for H=([142.54.239.4]) [59.8.31.162]:55347: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-11 11:19:57 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([87.106.245.167]) [111.70.38.53]:46804: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-11 11:20:21 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net (ip-104-37-133-100.hosts.zerolag.com) [66.45.144.201]:33012: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-11 11:22:10 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.103.228.238
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/metro-digital-media-won-the-best-performance-in-home-theatre-projector HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.167.246
country_id: 1562822
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/11/01/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-11 11:25:35 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([49.124.151.59]) [85.29.246.199]:45746: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-11 11:25:07 dovecot_login authenticator failed for H=([205.209.67.3]) [213.55.79.195]:55708: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.208.6.48
country_id: 6251999
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84288.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:986bae807325b190597a4240969bea97c6f42463||Title:0x9c3db0f2||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.211.201
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://business.newportvermontdailyexpress.com/newportvermontdailyexpress/markets/article/abnewswire-2026-6-4-pressure-washing-support-in-farmingville-ny-expanded-by-power-washing-pros-of-farmingville-to-improve-long-term-roof-performance-across-the-service-area/\">pressure washing near me</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-11 11:32:33 dovecot_login authenticator failed for H=([182.95.26.40]) [94.16.17.141]:53242: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.127.84
country_id: 6252001
description:
2026-07-11 11:32:54 dovecot_login authenticator failed for H=([211.216.58.204]) [74.196.127.84]:46832: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-11 11:38:22 dovecot_login authenticator failed for H=([174.75.211.203]) [136.56.34.147]:41136: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 217.181.91.43
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.28||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-11 11:46:10 dovecot_login authenticator failed for H=(179.185.69.43.static.gvt.net.br) [38.141.252.55]:36870: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-11 11:46:34 dovecot_login authenticator failed for H=([98.182.171.163]) [125.23.228.86]:54888: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-11 11:49:25 dovecot_login authenticator failed for H=([220.161.52.149]) [62.220.236.203]:59390: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-11 11:49:10 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([125.19.169.115]) [82.209.191.11]:57626: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-11 11:48:57 dovecot_login authenticator failed for H=(212-135-208-32.cyberverse.fun) [210.5.117.238]:53497: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-11 11:52:40 dovecot_login authenticator failed for H=([142.54.239.4]) [197.219.228.246]:55644: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-11 11:52:20 dovecot_login authenticator failed for H=([183.171.145.95]) [1.241.64.237]:43296: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-11 11:54:09 dovecot_login authenticator failed for H=([184.170.249.69]) [205.250.25.62]:53016: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-11 11:53:57 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (107-135-117-245.lightspeed.livnmi.sbcglobal.net) [200.105.141.172]:33002: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-11 11:55:33 dovecot_login authenticator failed for H=(111-70-14-135.emome-ip.hinet.net) [182.95.178.174]:35016: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.161.51
country_id: 6252001
description:
2026-07-11 11:56:09 H=([64.89.161.51]) [64.89.161.51]:51724 F=<dpr@priv8shop.com> rejected RCPT <sunny.chikezie@yahoo.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.137.177.119
country_id: 3996063
description:
2026-07-11 12:00:00 dovecot_plain authenticator failed for H=(localhost) [189.137.177.119]:58004: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-11 12:02:22 dovecot_login authenticator failed for H=([45.182.5.96]) [61.97.17.208]:46123: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.158.39.139
country_id: 2464461
description:
2026-07-11 12:02:21 dovecot_plain authenticator failed for H=(localhost) [102.158.39.139]:62043: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-11 12:02:05 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [175.200.217.128]:43790: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.223.55.187
country_id: 6252001
description:
2026-07-11 12:06:35 dovecot_login authenticator failed for H=187.sub-75-223-55.myvzw.com ([5.11.162.163]) [75.223.55.187]:33708: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-11 12:06:46 dovecot_login authenticator failed for H=(vipturbo.com.br) [121.162.61.229]:53343: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-11 12:08:07 dovecot_login authenticator failed for H=([149.54.62.58]) [65.20.153.146]:35531: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-11 12:08:24 dovecot_login authenticator failed for H=([31.173.31.59]) [182.95.106.138]:59326: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.37.127
country_id: 3923057
description:
2026-07-11 12:12:36 dovecot_login authenticator failed for H=([175.198.18.3]) [138.84.37.127]:25056: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-11 12:12:27 dovecot_login authenticator failed for H=([84.118.20.106]) [128.185.235.110]:33708: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.204.108.217
country_id: 1835841
description:
2026-07-11 12:13:02 dovecot_login authenticator failed for H=([179.183.114.175]) [210.204.108.217]:37827: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-11 12:12:59 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net ([142.54.235.12]) [221.120.73.25]:50171: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-11 12:14:47 dovecot_login authenticator failed for H=([188.168.86.6]) [102.210.148.41]:46902: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-11 12:14:39 dovecot_login authenticator failed for H=([78.136.223.227]) [182.95.185.142]:55224: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 115.42.75.122
country_id: 1168579
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15061.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6bba946e8da23a1b920d8dd6600f0cf120cb60be||Title:0x00aa3f40||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-11 12:14:33 dovecot_login authenticator failed for H=([149.54.62.66]) [196.189.59.226]:59175: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-11 12:14:52 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([142.54.228.195]) [111.70.38.53]:57237: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://chicago.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 115.42.75.122
country_id: 1168579
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91180.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7e0bcfec880e18b7e264100c373694189ed7496||Title:0xcc5b6dda||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.63
country_id: 1733045
description:
2026-07-11 12:21:06 dovecot_login authenticator failed for H=(835403.cloudwaysapps.com) [49.124.151.63]:45616: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.125.236
country_id: 1562822
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/business-gravity-img-13-1170x710/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.80.143.173
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es35?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 68.183.180.177
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:135381||Sizes:51||Combined size:51||User:ddgalaxy||WPU:||Filename:shell.php||Scanned:/tmp//20260711-122519-alHo1wKkZod9wM24nTogUwAAARE-file-PwUKrp||SC:/home/ddgalaxy/public_html/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 68.183.180.177
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/ddgalaxy/public_html/index.php||User:ddgalaxy||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-11 12:27:29 dovecot_login authenticator failed for H=([211.116.107.222]) [197.219.210.94]:58002: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-07-11 12:27:07 dovecot_login authenticator failed for H=(karuna.divineled.com) [122.170.97.94]:47040: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 194.5.82.146
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.28||T:APACHE||REQUEST_URI:/site/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-11 12:33:21 dovecot_login authenticator failed for H=(abts-west-static-211.232.201.106.airtelbroadband.in) [182.95.106.118]:51844: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.155.225.93
country_id: 878675
description:
2026-07-11 12:37:39 dovecot_login authenticator failed for H=([174.77.111.220]) [197.155.225.93]:50554: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-11 12:38:34 dovecot_login authenticator failed for H=([192.252.214.22]) [65.20.134.97]:44278: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.25.252.55
country_id: 1210997
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/wp-content/uploads/2018/10/business-gravity-img-10-1170x710-300x182.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-11 12:41:06 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net ([115.95.23.226]) [76.132.238.43]:41130: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-11 12:41:22 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [121.131.220.152]:57985: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-11 12:42:17 dovecot_login authenticator failed for H=([142.54.228.195]) [193.31.200.85]:55872: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.123.149.214
country_id: 1269750
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:31432.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:42bc1d450e925144eb57b7bfe4881b40657cc3c2||Title:0xf7988d5f||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.129
country_id: 1269750
description:
2026-07-11 12:42:00 dovecot_login authenticator failed for H=(static.170.209.108.65.clients.your-server.de) [122.187.229.129]:57300: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-11 12:45:10 dovecot_login authenticator failed for H=(78.187.9.111.dynamic.ttnet.com.tr) [85.152.57.60]:47318: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.192
country_id: 2287781
description:
2026-07-11 12:45:40 dovecot_login authenticator failed for H=(50-212-27-146-static.hfc.comcastbusiness.net) [160.154.84.192]:12711: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-11 12:50:05 dovecot_login authenticator failed for H=([85.159.165.216]) [81.214.75.248]:58097: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.47.134.108
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||User:globalgroupoman||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-11 12:54:36 dovecot_login authenticator failed for H=([218.25.94.199]) [182.95.228.106]:59500: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-11 12:54:18 dovecot_login authenticator failed for H=([195.158.14.232]) [119.192.219.77]:56569: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-11 12:54:57 dovecot_login authenticator failed for H=([121.131.220.137]) [220.72.198.61]:43574: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.159.196.181
country_id: 2542007
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/business-gravity-img-10-1170x710/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-11 13:07:45 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [218.156.93.203]:52213: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-11 13:08:39 dovecot_login authenticator failed for H=([184.181.178.35]) [122.160.137.230]:40373: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.241
country_id: 1733045
description:
2026-07-11 13:08:19 dovecot_login authenticator failed for H=(220-128-137-164.hinet-ip.hinet.net) [49.124.152.241]:35468: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.136
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.136
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 98.159.43.136
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 98.159.43.146
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.146
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.136
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.146
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/autoload_classmap.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 98.159.43.144
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.28||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.144
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.144
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.144
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/about.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.111
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-includes/images/media/index.php||SC:/home/ibmcglobal/public_html/wp-includes||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.156
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.109
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wordpress/wp-content/uploads/install.php||SC:/home/ibmcglobal/public_html/wordpress||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-11 13:11:38 dovecot_login authenticator failed for H=([200.199.32.174]) [45.191.91.81]:33608: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.112
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.156
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/bypass.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.129
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 98.159.43.109
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.168.101.166
country_id: 6252001
description:
2026-07-11 13:11:49 dovecot_login authenticator failed for H=wsip-98-168-101-166.hr.hr.cox.net ([176.111.152.79]) [98.168.101.166]:54836: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.129
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/admin-footer.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.109
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/1.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.134
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/uploads/xsec.php||SC:/home/ibmcglobal/public_html/uploads||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.134
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 98.159.43.134
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/themes.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.112
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/wp-cert.phtml||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.90.252
country_id: 6251999
description:
2026-07-11 13:12:49 dovecot_login authenticator failed for H=d157-90-252.home4.cgocable.net ([121.165.242.158]) [24.157.90.252]:36954: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.112
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/sst.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.156
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/upload/bilder/cong.php||SC:/home/ibmcglobal/public_html/upload||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.156
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/alfa.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 98.159.43.112
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 98.159.43.112
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/adminfus.php||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.134
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/dedi1.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 98.159.43.134
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.28||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.161
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/2021/wp-works.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 98.159.43.151
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:8.28||T:APACHE||MVN:REQUEST_URI||MV:/admin/assets/plugins/jquery-file-upload/server/php/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.151
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/autodiagnosis.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.118
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/assets/jquery-ui/images/lock2.php||SC:/home/ibmcglobal/public_html/assets||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.161
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/adminfus.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.78
country_id: 99237
description:
2026-07-11 13:13:01 dovecot_login authenticator failed for H=([58.18.80.18]) [65.20.167.78]:45687: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 98.159.43.118
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 98.159.43.161
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/assets/images/cloud.php||SC:/home/ibmcglobal/public_html/assets||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 98.159.43.151
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.28||T:APACHE||MV:/assets/images/accesson.php||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.151
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/file-js.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-11 13:13:15 dovecot_login authenticator failed for H=(vps-5b692794.vps.ovh.net) [61.1.105.105]:55228: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.198.108.234
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://business.am-news.com/am-news/markets/article/abnewswire-2026-4-14-paver-cleaning-services-in-bayshore-provided-by-paver-cleaning-and-sealing-pros-of-bay-shore-for-local-residents-focused-on-long-term-solution/\">Paver cleaning Bay Shore</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-11 13:14:05 dovecot_login authenticator failed for H=([70.166.167.58]) [14.46.58.104]:56632: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.132.81.182
country_id: 1522867
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/business/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350559
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.122
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/easy-themes-manager/||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 98.159.43.118
country_id: 1605651
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-11 13:16:28 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([74.208.177.56]) [221.120.78.177]:35985: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-11 13:17:21 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([45.118.136.243]) [79.136.8.69]:36954: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-11 13:22:39 dovecot_login authenticator failed for H=([223.70.149.210]) [119.192.219.77]:45590: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-11 13:22:32 dovecot_login authenticator failed for H=([67.201.59.67]) [197.219.208.38]:52758: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.107.179
country_id: 1835841
description:
2026-07-11 13:22:50 dovecot_login authenticator failed for H=([85.186.244.106]) [211.43.107.179]:50314: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-11 13:23:31 dovecot_login authenticator failed for H=([49.124.152.26]) [65.20.161.126]:48515: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-11 13:22:52 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [94.16.17.139]:58918: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.208.179.243
country_id: 1694008
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13828.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5ed6cac1a3669bcdee3e3e39411658624231d95c||Title:0xce6b7fb0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.211.189
country_id: 3017382
domain: ns2.ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.28.211.189||TA:104.28.211.189||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.189
country_id: 3017382
domain: ns2.ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-11 13:29:21 dovecot_login authenticator failed for H=(211-23-194-216.hinet-ip.hinet.net) [196.190.220.199]:59906: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.79.16.52
country_id: 1168579
description:
2026-07-11 13:33:04 dovecot_login authenticator failed for H=([49.124.152.222]) [103.79.16.52]:38609: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.152.25
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wp-content/uploads/2013/03/Jamo-D-600-HCS-2-7.1.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-11 13:35:44 dovecot_login authenticator failed for H=([68.71.240.212]) [49.124.205.169]:43264: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.255.83.8
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://iconwin.It.com\">iconwin indonesia</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 172.105.43.205
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s613103.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.195.164
country_id: 294640
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/b2b/workshope_seminarin_uae.php HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.186.45.242
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/interactive-whiteboards-smartboards HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.9.80.149
country_id: 1831722
description:
2026-07-11 13:42:47 dovecot_plain authenticator failed for H=(localhost) [96.9.80.149]:9442: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.66.94.140
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://telegra.ph/Original-ili-poddelka-stoit-li-doveryat-resejlu-Oskelly-06-23\">oskelly \xd0\xbe\xd1\x82\xd0\xb7\xd1\x8b\xd0\xb2\xd1\x8b</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-11 13:54:45 dovecot_login authenticator failed for H=(red.138.118.213.068.ssservicios.com.ar) [103.168.241.32]:50785: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-11 13:54:20 dovecot_login authenticator failed for H=([197.242.170.10]) [196.189.51.64]:57716: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-11 13:54:54 dovecot_login authenticator failed for H=([182.95.106.102]) [182.95.61.82]:48430: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.46
country_id: 99237
description:
2026-07-11 13:55:23 dovecot_login authenticator failed for H=([192.111.131.4]) [65.20.138.46]:45019: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-11 13:57:38 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net (81-230-11-165-no2664.tbcn.telia.com) [71.235.27.139]:49672: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-11 13:57:07 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([188.168.86.6]) [51.68.226.171]:48166: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.177
country_id: 1733045
description:
2026-07-11 13:59:44 dovecot_login authenticator failed for H=([125.215.199.37]) [49.124.152.177]:58738: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 194.5.83.62
country_id: 1819730
domain: futuracare.com.au
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/futuracarecom/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.5.83.62
country_id: 1819730
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/futuracarecom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.5.83.62
country_id: 1819730
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/admin/upload/css.php||SC:/home/futuracarecom/public_html/admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.160.72.42
country_id: 1835841
description:
2026-07-11 14:01:18 dovecot_login authenticator failed for H=([66.54.169.3]) [115.160.72.42]:44212: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-11 14:01:58 dovecot_login authenticator failed for H=([36.154.20.34]) [182.95.228.194]:45288: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 194.5.83.86
country_id: 1819730
domain: futuracare.com.au
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/futuracarecom/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-11 14:06:36 dovecot_login authenticator failed for H=([112.186.203.10]) [119.196.213.196]:32822: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-11 14:06:49 dovecot_login authenticator failed for H=(85-18-115-154.ip.mob-sol.it) [212.132.64.89]:49538: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 188.119.4.178
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcela31ttoc.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-11 14:15:36 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([211.247.127.250]) [66.45.144.201]:57580: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-11 14:32:27 dovecot_login authenticator failed for H=([65.20.167.78]) [122.184.124.46]:57220: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.34.106
country_id: 226074
description:
2026-07-11 14:31:53 dovecot_login authenticator failed for H=(dsl-tn-dynamic-137.209.22.125.airtelbroadband.in) [196.0.34.106]:47575: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.206.162.134
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://stocks.observer-reporter.com/observerreporter/article/abnewswire-2026-6-9-pressure-washing-services-in-brentwood-ny-provided-by-brentwoods-1-exterior-power-washing-roof-and-house-washing-for-local-property-owners/\">Residential Pressure Washing</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.77
country_id: 1733045
description:
2026-07-11 14:37:30 dovecot_login authenticator failed for H=([112.164.239.190]) [49.125.201.77]:56604: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.87.33.35
country_id: 3686110
description:
2026-07-11 14:38:30 dovecot_plain authenticator failed for H=(gralion) [186.87.33.35]:49674: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-11 14:37:59 dovecot_login authenticator failed for H=([49.124.151.16]) [122.187.116.110]:36652: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-11 14:39:07 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([122.53.106.124]) [89.67.246.166]:41941: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-11 14:39:41 dovecot_login authenticator failed for H=([49.124.151.71]) [181.129.31.42]:34107: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://cse.google.ca/\">iptv paketi</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.124
country_id: 1668284
description:
2026-07-11 14:43:52 dovecot_login authenticator failed for H=111-70-29-124.emome-ip.hinet.net ([211.49.49.137]) [111.70.29.124]:48328: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-11 14:44:47 dovecot_login authenticator failed for H=([68.71.253.70]) [128.185.187.2]:33386: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.38.139
country_id: 298795
description:
2026-07-11 14:44:29 dovecot_login authenticator failed for H=([91.237.183.81]) [81.214.38.139]:55662: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.17.10.211
country_id: 3437598
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/ibmc-vision-2022 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-11 14:46:50 dovecot_login authenticator failed for H=(62-20-205-17-no2360.tbcn.telia.com) [181.129.31.42]:52677: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.107.154
country_id: 1269750
description:
2026-07-11 14:46:36 dovecot_login authenticator failed for H=([174.64.199.87]) [27.123.107.154]:44562: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-07-11 14:47:32 dovecot_login authenticator failed for H=([103.148.206.98]) [222.99.52.202]:39398: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.251.22.198
country_id: 1269750
description:
2026-07-11 14:48:08 dovecot_login authenticator failed for H=([98.170.57.236]) [117.251.22.198]:42890: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://reseau-ig.com/joomla/index.php?option=com_easybookreloaded&view=easybookreloaded&Itemid=475\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 172.105.43.205
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s448306.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-11 14:54:24 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([154.58.35.181]) [220.246.47.146]:61853: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-11 14:54:39 dovecot_login authenticator failed for H=(098240.cagr.ncyu.edu.tw) [117.205.2.250]:46460: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-11 14:55:07 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([207.254.28.5]) [217.211.208.125]:37582: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-11 14:55:23 dovecot_login authenticator failed for H=([121.131.220.152]) [14.42.47.150]:6585: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-11 14:55:36 dovecot_login authenticator failed for H=(89-68-245-7.dynamic.play.pl) [197.242.170.10]:61362: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-11 14:58:37 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl (spb-195-239-224-194.sovintel.ru) [89.67.37.52]:54391: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-11 14:59:28 dovecot_login authenticator failed for H=([49.124.147.105]) [61.32.68.66]:25496: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-11 15:00:41 dovecot_login authenticator failed for H=([174.75.211.195]) [206.62.136.109]:47798: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-11 15:00:52 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com (mx-ll-171.6.10-57.dynamic.3bb.in.th) [90.230.115.5]:47356: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.178.131.164
country_id: 2464461
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-07-11 15:03:49 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net ([24.157.90.252]) [111.70.32.10]:32898: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.62.32
country_id: 6252001
description:
2026-07-11 15:05:24 dovecot_login authenticator failed for H=47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net (ip-68-71-245-203.hosts.zerolag.com) [47.145.62.32]:57302: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-11 15:05:45 dovecot_login authenticator failed for H=([98.190.239.1]) [182.95.217.202]:47130: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 172.105.43.205
country_id: 1269750
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s458520.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.110.57
country_id: 1835841
description:
2026-07-11 15:07:16 dovecot_login authenticator failed for H=([110.77.150.25]) [59.24.110.57]:36560: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 64.118.129.59
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:masta0qqvvw.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://maps.google.ca/url?q=https://forum.thd.vg/proxy.php?link=https://exyuiptv.org/iptv/slovenija/\">balkanski kanali</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-07-11 15:14:57 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se ([14.20.73.26]) [176.10.197.168]:35924: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.244.92.197
country_id: 6251999
description:
2026-07-11 15:15:40 dovecot_login authenticator failed for H=dhcp-4-bc-9f-5c-cd-c1.cpe.i-zoom.net (RZD-gw.transtelecom.net) [24.244.92.197]:55942: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.70.84
country_id: 1210997
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-11 15:15:58 dovecot_login authenticator failed for H=([39.183.162.243]) [59.90.111.74]:60682: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-11 15:21:17 dovecot_login authenticator failed for H=([104.200.135.42]) [125.19.158.2]:45168: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-11 15:20:59 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com (mission-web-hosting.com) [168.91.173.57]:35140: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.127
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/globalgroupoman/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.106
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/admin.php||SC:/home/globalgroupoman/public_html/images/admin.php||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.127
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-11 15:23:11 dovecot_login authenticator failed for H=([70.166.167.37]) [109.248.156.49]:58966: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.106
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/class-config.php||SC:/home/globalgroupoman/public_html/images/class-config.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.104
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.139
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/file.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.113
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/globalgroupoman/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.139
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-includes/images/media/index.php||SC:/home/globalgroupoman/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.228.18
country_id: 1835841
description:
2026-07-11 15:25:33 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [112.164.228.18]:50172: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.131
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.113
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/bypass.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-11 15:25:55 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com (www01.irishtitan.ul.zerolag.com) [213.65.190.48]:59436: 535 Incorrect authentication data (set_id=prameela)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.131
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/waf_defender.php||SC:/home/globalgroupoman/public_html/images/waf_defender.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-07-11 15:27:21 dovecot_login authenticator failed for H=([59.20.85.112]) [103.111.6.121]:41606: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.137
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/buy.php||SC:/home/globalgroupoman/public_html/images/buy.php||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.137
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.105
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/upload/install.php||SC:/home/globalgroupoman/public_html/upload||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.115
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/adminfus.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.105
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/autoload_classmap.php||SC:/home/globalgroupoman/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.115
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/system_cache.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.115
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/uploads/xsec.php||SC:/home/globalgroupoman/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.139
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/av.php||SC:/home/globalgroupoman/public_html/images/av.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-11 15:32:35 dovecot_login authenticator failed for H=([124.83.9.141]) [49.206.27.37]:40390: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.139
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/2021/themes.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.35
country_id: 798544
domain: globalgroupoman.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.28||T:APACHE||MVN:ARGS:data[2][value]||SC:/home/globalgroupoman/public_html/||


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 45.157.112.52
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.28||T:APACHE||MVN:ARGS:data[0][value]||SC:/home/globalgroupoman/public_html/||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.129
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/assets/images/cloud.php||SC:/home/globalgroupoman/public_html/assets||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.107
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/install.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: modsec
rule: 77264624
name: IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)
abuser: 45.134.20.107
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)||MV:/assets/images/accesson.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.107
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/link.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.104
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/assets/jquery-ui/images/lock2.php||SC:/home/globalgroupoman/public_html/assets||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.104
country_id: 2077456
domain: globalgroupoman.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-11 15:35:25 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is (static.ill.117.211.15.106.bsnl.co.in) [185.40.122.250]:42837: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.43.51
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88519.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5778f66dcd90f3eb10b54d811eb269d14ee53ac||Title:0x552f6549||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-11 15:42:00 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (187-50-226-182.customer.tdatabrasil.net.br) [200.105.141.172]:43060: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-11 15:42:10 dovecot_login authenticator failed for H=([49.124.149.208]) [103.130.91.83]:39476: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-11 15:42:30 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([36.135.100.48]) [220.246.40.63]:52177: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-11 15:43:01 dovecot_login authenticator failed for H=([196.190.220.168]) [197.219.228.246]:35224: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-11 15:43:21 dovecot_login authenticator failed for H=([195.222.57.183]) [41.214.10.178]:49416: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-11 15:43:33 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([179.184.85.167]) [213.66.197.199]:50882: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.198.99.18
country_id: 1269750
description:
2026-07-11 15:43:54 dovecot_login authenticator failed for H=([111.35.36.49]) [117.198.99.18]:59534: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-11 15:48:40 dovecot_login authenticator failed for H=([197.219.208.38]) [70.88.108.12]:55062: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-11 15:48:21 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([49.124.151.51]) [35.130.111.98]:54556: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_5ff2c7d1\":true,\"status\":\"resolved_model\",\"data_6b39913d\":\"rejected\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"x_eff195ee\":null,\"data_744c7fad\":[],\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var ovp=arguments['\\\\x31'];var mcid=ovp;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"ns_66f21b5a\":\"89a7\",\"__c8ffcce0\":\"\",\"data_282893b3\":\"723b\",\"_response\":{\"_prefix\":\"var edt=[].slice.call(arguments,1)[0];var xnh=edt;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.102.233
country_id: 2589581
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"data_32e8fa1a\":\"d3dd\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"__deea3a0b\":false,\"_response\":{\"_prefix\":\"var edt=[].slice.call(arguments,1)[0];var xnh=edt;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-11 15:54:04 dovecot_login authenticator failed for H=(static-185-2-228-48.cust.tele2.lt) [218.156.93.206]:54645: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.240
country_id: 294640
description:
2026-07-11 15:56:09 dovecot_login authenticator failed for H=([125.62.129.188]) [2.55.84.240]:35580: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-11 15:56:39 dovecot_login authenticator failed for H=([171.211.123.106]) [14.51.12.142]:42826: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 185.16.38.36
country_id: 798544
description:
[2026-07-11 15:57:57 +0530] info [whostmgrd] 185.16.38.36 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.16.38.36
country_id: 798544
description:
[2026-07-11 15:57:57 +0530] info [whostmgrd] 185.16.38.36 - root "GET /cpsess3294315230/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-11 16:03:45 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [182.95.181.166]:34070: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-11 16:07:25 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [221.167.50.229]:45560: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 172.105.43.205
country_id: 1269750
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s589294.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-11 16:09:26 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com (static.91.254.104.190.cps.com.ar) [75.80.69.106]:38993: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-07-11 16:09:43 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [102.214.44.117]:59570: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.155.186.8
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/video-conferencing-cameras HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-11 16:14:36 dovecot_login authenticator failed for H=([49.124.152.228]) [122.163.127.14]:35572: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-11 16:14:18 dovecot_login authenticator failed for H=([220.80.66.168]) [125.130.102.172]:38903: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.219
country_id: 1733045
description:
2026-07-11 16:19:54 dovecot_login authenticator failed for H=([110.77.150.25]) [49.124.149.219]:48910: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-11 16:20:24 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au (host-109-174-104-74.bb-nsk.sib.mts.ru) [210.0.90.82]:36074: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-11 16:22:12 dovecot_login authenticator failed for H=(p12.dist-aa.atl02.coloat.com) [5.48.46.95]:57016: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-11 16:22:20 dovecot_login authenticator failed for H=(111-70-23-253.emome-ip.hinet.net) [125.23.203.138]:49698: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-11 16:22:39 dovecot_login authenticator failed for H=([103.69.9.16]) [197.219.210.94]:53696: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.176.117.172
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/retail-and-hospitality HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 23.27.116.225
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:167848||Sizes:25||Combined size:25||User:ddgalaxy||WPU:||Filename:cox.txt||Scanned:/tmp//20260711-162625-alIhWRraw1YWkpia8NfhOAAAAE0-file-IxNgGM||SC:/home/ddgalaxy/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-11 16:28:37 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([49.124.149.55]) [66.45.144.201]:44976: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.132
country_id: 1733045
description:
2026-07-11 16:28:17 dovecot_login authenticator failed for H=([128.185.253.122]) [49.124.142.132]:53272: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-11 16:34:28 dovecot_login authenticator failed for H=([172.191.74.151]) [27.123.111.110]:46904: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-11 16:34:41 dovecot_login authenticator failed for H=([198.8.94.171]) [183.82.108.109]:50000: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-11 16:35:17 dovecot_login authenticator failed for H=([104.37.132.51]) [50.188.204.213]:51772: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.205.250.78
country_id: 290557
description:
2026-07-11 16:37:00 dovecot_login authenticator failed for H=(60-251-229-144.hinet-ip.hinet.net) [94.205.250.78]:55089: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.10.130.3
country_id: 1643084
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/shxt_1783768364_zdvoo.php||SC:/home/ogocindia/public_html/images/shxt_1783768364_zdvoo.php||


plugin: modsec
rule: 77469916
abuser: 182.10.130.3
country_id: 1643084
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1783768362_rjqmd.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 23.27.116.225
country_id: 1880251
domain: elegantautomotives.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:81641||Sizes:25||Combined size:25||User:elegantautomotiv||WPU:||Filename:cox.txt||Scanned:/tmp//20260711-164634-alImEsK9hSjNLJO_ywAw9QAAAMM-file-JltMo7||SC:/home/elegantautomotiv/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-11 16:50:05 dovecot_login authenticator failed for H=([45.178.227.128]) [94.16.17.141]:59430: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


