# incident

plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 38.253.224.25
country_id: 6252001
domain: img6kb79.ibmcglobal.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.26||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 38.253.224.25
country_id: 6252001
domain: img6kb79.ibmcglobal.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.26||T:APACHE||MV:wp-config.php~||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.122.122
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.87
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.26||T:APACHE||MVN:ARGS:data[5][value]||SC:/home/cochinbigbandsho/public_html/contact-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-08 19:10:43 dovecot_login authenticator failed for H=([183.171.61.10]) [61.97.17.208]:50029: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-08 19:10:58 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net ([180.94.75.202]) [27.124.111.122]:36097: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-08 19:11:20 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net ([184.170.245.145]) [108.35.129.132]:46448: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-08 19:11:21 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([206.220.175.5]) [112.120.115.152]:58040: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-08 19:11:59 dovecot_login authenticator failed for H=([192.111.134.12]) [103.206.131.33]:59840: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-08 19:12:40 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [203.192.247.84]:58992: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-08 19:13:20 dovecot_login authenticator failed for H=([221.167.50.229]) [174.134.45.64]:33098: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-08 19:13:34 dovecot_login authenticator failed for H=([183.56.238.70]) [196.207.177.56]:43678: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-08 19:15:35 dovecot_login authenticator failed for H=([49.124.149.213]) [122.187.116.110]:38494: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-08 19:15:00 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [183.104.220.152]:41092: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.23.246
country_id: 895949
description:
2026-07-08 19:15:13 dovecot_login authenticator failed for H=([196.191.151.172]) [41.60.23.246]:56417: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-08 19:15:24 dovecot_login authenticator failed for H=([102.210.149.132]) [41.89.128.6]:38028: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-07-08 19:18:25 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com ([49.124.153.64]) [95.155.228.189]:39278: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.243.200.248
country_id: 1861060
description:
2026-07-08 19:18:44 dovecot_login authenticator failed for H=([174.75.211.196]) [20.243.200.248]:39474: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.223.89.149
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-08 19:21:37 dovecot_login authenticator failed for H=([118.250.183.25]) [117.205.2.250]:57913: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-08 19:22:00 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([213.33.182.183]) [50.121.186.125]:63638: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 178.173.236.189
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.26||T:APACHE||RA:178.173.236.189||TA:178.173.236.189||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 180.251.182.115
country_id: 1643084
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94300.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3022edcffdd6c5b82334b373f6183b3d85a54140||Title:jqlbcx0b93zosl||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2026-07-08 19:24:25 dovecot_login authenticator failed for H=([183.171.7.171]) [210.56.12.205]:56981: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-08 19:27:40 dovecot_login authenticator failed for H=([222.113.166.158]) [93.95.241.150]:56784: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-08 19:27:13 dovecot_login authenticator failed for H=([211.238.237.254]) [101.13.5.39]:32810: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-08 19:29:43 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [128.134.83.141]:57820: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-08 19:31:13 dovecot_login authenticator failed for H=([58.57.154.146]) [59.12.212.38]:33182: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.182
country_id: 1668284
description:
2026-07-08 19:35:27 dovecot_login authenticator failed for H=([210.90.216.105]) [101.13.2.182]:50085: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-08 19:36:13 dovecot_login authenticator failed for H=([49.124.151.25]) [101.13.5.49]:36600: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-08 19:41:24 dovecot_login authenticator failed for H=([106.247.22.181]) [65.20.133.56]:55725: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.5.124
country_id: 1269750
description:
2026-07-08 19:41:52 dovecot_login authenticator failed for H=([180.94.74.94]) [103.181.5.124]:38701: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-08 19:42:05 dovecot_login authenticator failed for H=([192.252.210.237]) [117.252.93.114]:38181: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-08 19:45:41 dovecot_login authenticator failed for H=([192.111.130.1]) [119.198.191.180]:53682: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-08 19:46:07 dovecot_login authenticator failed for H=([65.20.134.97]) [171.244.60.35]:46644: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-08 19:46:49 dovecot_login authenticator failed for H=([63.135.169.175]) [103.187.78.189]:34314: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2026-07-08 19:47:03 dovecot_login authenticator failed for H=110-25-109-53.adsl.fetnet.net ([182.95.178.174]) [110.25.109.53]:33885: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/agariounblockedschool?lang=EN\">unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.183.146
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/metro-digital-media-won-the-best-performance-in-home-theatre-projector HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.62.142.202
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-08 20:02:56 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.135.169.175
country_id: 6252001
description:
2026-07-08 20:09:30 dovecot_login authenticator failed for H=([142.54.239.4]) [63.135.169.175]:54969: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-08 20:09:34 dovecot_login authenticator failed for H=([111.26.177.215]) [182.95.176.122]:38050: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-07-08 20:09:01 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl (191-210-159-32.user.vivozap.com.br) [178.183.125.51]:53388: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2026-07-08 20:13:36 dovecot_login authenticator failed for H=110-25-112-145.adsl.fetnet.net ([49.124.153.51]) [110.25.112.145]:40973: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-08 20:13:18 dovecot_login authenticator failed for H=([45.178.227.128]) [14.42.47.150]:62950: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.193
country_id: 1269750
description:
2026-07-08 20:21:16 dovecot_login authenticator failed for H=(nsg-corporate-193.230.187.122.airtel.in) [122.187.230.193]:55766: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.96.101.200
country_id: 1562822
description:
2026-07-08 20:21:20 dovecot_login authenticator failed for H=([111.26.167.166]) [101.96.101.200]:56411: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-08 20:21:44 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net (host217-41-62-162.in-addr.btopenworld.com) [174.168.146.152]:34924: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-07-08 20:21:52 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-08 20:21:02 dovecot_login authenticator failed for H=([68.71.243.10]) [222.108.109.37]:47632: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-08 20:21:31 dovecot_login authenticator failed for H=([49.124.151.9]) [218.248.19.102]:54622: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-07-08 20:22:06 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:47905: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.70
country_id: 1733045
description:
2026-07-08 20:22:44 dovecot_login authenticator failed for H=([220.82.50.65]) [49.125.201.70]:60710: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.83.9.140
country_id: 1694008
description:
2026-07-08 20:23:18 dovecot_login authenticator failed for H=([196.190.220.168]) [124.83.9.140]:50454: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-08 20:23:31 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [220.118.190.204]:54145: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 61.5.147.237
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-08 20:29:32 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [200.107.163.195]:32644: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-08 20:29:01 dovecot_login authenticator failed for H=([98.178.72.4]) [185.66.234.228]:44074: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-08 20:30:04 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([174.75.211.217]) [155.4.31.215]:41232: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.232.25.54
country_id: 1512440
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/29/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-08 20:32:46 dovecot_login authenticator failed for H=([59.20.150.99]) [220.72.198.61]:32830: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.212.176.37
country_id: 6252001
description:
2026-07-08 20:33:14 dovecot_login authenticator failed for H=wsip-72-212-176-37.hr.hr.cox.net ([117.158.166.73]) [72.212.176.37]:38408: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.17
country_id: 1168579
description:
2026-07-08 20:33:37 dovecot_login authenticator failed for H=([72.206.74.97]) [210.56.28.17]:53472: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.124
country_id: 1668284
description:
2026-07-08 20:34:22 dovecot_login authenticator failed for H=111-70-29-124.emome-ip.hinet.net ([112.6.114.199]) [111.70.29.124]:46337: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.146.72
country_id: 587116
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783523216298.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 130.254.112.55
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-39.130.254.112.55||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.127.125
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-39.147.53.127.125||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 139.180.224.207
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-39.139.180.224.207||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.114.7
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-39.147.53.114.7||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-08 20:40:47 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [197.219.228.242]:46764: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-08 20:39:56 dovecot_login authenticator failed for H=([70.166.167.35]) [196.189.59.226]:40311: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-08 20:41:01 dovecot_login authenticator failed for H=([74.196.127.84]) [171.244.60.35]:64907: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-08 20:42:40 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([192.111.130.1]) [85.195.9.20]:51898: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.113.50
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77102143
abuser: 46.250.230.56
country_id: 1880251
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 216.144.249.137
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:dr.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 3.106.140.181
country_id: 2077456
domain: yukticlick.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.239.48.157
country_id: 1819730
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/admin.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.248.211
country_id: 1835841
description:
2026-07-08 20:49:47 dovecot_login authenticator failed for H=(l37-193-85-193.novotelecom.ru) [220.80.248.211]:36920: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.239.48.157
country_id: 1819730
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.27||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-08 20:49:32 dovecot_login authenticator failed for H=([197.219.228.242]) [49.206.201.253]:35576: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.239.48.157
country_id: 1819730
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-admin/images/index.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-08 20:49:10 dovecot_login authenticator failed for H=([180.94.75.202]) [1.250.67.114]:38796: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 20.239.48.157
country_id: 1819730
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 8.234.185.133
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.27||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.239.48.157
country_id: 1819730
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 8.234.185.133
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-08 20:51:12 dovecot_login authenticator failed for H=([192.252.216.83]) [122.186.202.58]:38210: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.56
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 \xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb9\x8a\xe0\xb8\xab\xe0\xb8\xb5 (<a href=\"https://yedhod18.com/video-tag/%E0%B8%84%E0%B8%A5%E0%B8%B4%E0%B8%9B%E0%B8%AB%E0%B8%A5%E0%B8%B8%E0%B8%94/\">yedhod18.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.87
country_id: 1668284
description:
2026-07-08 20:54:32 dovecot_login authenticator failed for H=111-70-9-87.emome-ip.hinet.net (105.84.107.200.flamingotv.net) [111.70.9.87]:37299: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-08 20:54:45 dovecot_login authenticator failed for H=([121.66.63.186]) [182.95.106.138]:48316: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-08 20:56:25 dovecot_login authenticator failed for H=([125.19.218.50]) [101.13.5.30]:35922: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-08 20:58:21 dovecot_login authenticator failed for H=([217.150.37.249]) [182.95.127.42]:38192: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.87.152
country_id: 6251999
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-08 21:02:48 dovecot_login authenticator failed for H=([49.124.151.27]) [122.169.40.221]:34404: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-08 21:03:36 dovecot_login authenticator failed for H=([116.236.43.254]) [122.185.44.206]:38496: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
country_id: 1562822
description:
2026-07-08 21:06:25 dovecot_login authenticator failed for H=([98.178.72.4]) [113.160.140.138]:36118: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.73.22
country_id: 1835841
description:
2026-07-08 21:12:03 dovecot_login authenticator failed for H=([112.28.73.142]) [58.65.73.22]:54495: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.203.101.30
country_id: 3624060
description:
2026-07-08 21:14:16 dovecot_login authenticator failed for H=([210.183.167.169]) [201.203.101.30]:36485: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-08 21:14:45 dovecot_login authenticator failed for H=(n51-h64.smr-rsk.metromax.ru) [103.120.116.162]:39992: 535 Incorrect authentication data (set_id=prameela)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 188.119.26.49
country_id: 298795
domain: jaashsupplies.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/jaashsupplies/public_html/index.php||User:jaashsupplies||WPU:||


plugin: modsec
rule: 77209353
abuser: 188.119.26.49
country_id: 298795
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.223
country_id: 130758
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/images/cache.php||SC:/home/ahsmarine/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-08 21:17:31 dovecot_login authenticator failed for H=(mx-ll-171.6.10-57.dynamic.3bb.in.th) [119.92.76.210]:58714: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-08 21:17:55 dovecot_login authenticator failed for H=([174.75.211.203]) [210.123.87.143]:52478: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-08 21:20:20 dovecot_login authenticator failed for H=(189-20-84-129.customer.tdatabrasil.net.br) [211.63.34.149]:35495: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783526311927.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783526311820.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.239.48.157
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.239.48.157
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ahsmarine/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-08 21:30:40 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([174.75.211.198]) [89.68.245.7]:44179: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-08 21:30:20 dovecot_login authenticator failed for H=([36.135.62.79]) [78.189.17.35]:47126: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-07-08 21:32:46 dovecot_login authenticator failed for H=([196.191.212.236]) [14.40.114.86]:34260: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-08 21:33:14 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfbe-179.dhcp.inet.fi) [197.219.208.38]:54288: 535 Incorrect authentication data (set_id=prameela)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.95.72.138
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/contact-us HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/images/cache.php||SC:/home/kallanigroup/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.65.38.234
country_id: 1269750
description:
2026-07-08 21:42:13 dovecot_login authenticator failed for H=([70.166.167.60]) [182.65.38.234]:51104: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-08 21:42:30 dovecot_login authenticator failed for H=([183.6.44.239]) [182.95.226.138]:49292: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-07-08 21:43:28 dovecot_login authenticator failed for H=([117.248.201.39]) [152.52.227.94]:35102: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-08 21:43:47 dovecot_login authenticator failed for H=([67.201.39.9]) [23.30.11.253]:58404: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.107.107.32
country_id: 2589581
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:90978.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eb8497bc656d92071efda4fba2b5293ff670fed0||Title:0xf5471c87||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-08 21:46:41 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([115.94.121.82]) [210.0.90.82]:56720: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.100.45
country_id: 1835841
description:
2026-07-08 21:46:15 dovecot_login authenticator failed for H=([49.124.153.47]) [211.43.100.45]:39212: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.88
country_id: 1668284
description:
2026-07-08 21:47:04 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [101.13.5.88]:37284: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.96.69
country_id: 1835841
description:
2026-07-08 21:47:57 dovecot_login authenticator failed for H=([113.219.177.95]) [14.39.96.69]:46453: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 149.22.83.213
country_id: 3865483
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-08 21:49:23 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([210.13.99.68]) [89.68.245.7]:37548: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-08 21:49:55 dovecot_login authenticator failed for H=([201.218.0.23]) [210.177.143.61]:57338: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-08 21:50:20 dovecot_login authenticator failed for H=([192.252.220.90]) [62.164.148.87]:50324: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.89.23.116
country_id: 2328926
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.236.155
country_id: 1168579
description:
2026-07-08 21:59:53 dovecot_login authenticator failed for H=([27.24.141.112]) [119.152.236.155]:34430: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-08 22:02:19 dovecot_login authenticator failed for H=([180.76.104.208]) [220.72.138.160]:5288: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.104.102.113
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/malik-malayalam-movie-experience-metro-digital-media HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-08 22:02:37 dovecot_login authenticator failed for H=([27.128.162.146]) [203.193.168.136]:40040: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.212.239
country_id: 6251999
domain: yukticlick.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:104.253.212.239||TA:104.253.212.239||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.89.75.69
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 165.245.188.197
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.3
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://yedhod18.com/video-tag/hongteskykub/\">YEDHOD18</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 34.87.110.115
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:burka.txt||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-08 22:22:40 dovecot_login authenticator failed for H=([92.126.223.175]) [210.5.117.238]:51034: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-08 22:29:35 dovecot_login authenticator failed for H=a4.ucndns.in ([199.116.114.10]) [103.252.168.4]:46386: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-08 22:29:37 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net (42-200-66-116.static.imsbiz.com) [221.120.73.25]:60822: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.82
country_id: 2186224
description:
2026-07-08 22:30:19 dovecot_login authenticator failed for H=(static.vnpt.vn) [121.73.163.82]:48302: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.87
country_id: 798544
domain: globalgroupoman.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.27||T:APACHE||MVN:ARGS:data[2][value]||SC:/home/globalgroupoman/public_html/||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-mahipalpur.html\">Mahipalpur Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-08 22:38:32 dovecot_login authenticator failed for H=([201.203.101.30]) [220.77.214.59]:55280: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: travelinbh.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:travelinbh||SC:/home/travelinbh/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350977
abuser: 84.200.33.158
country_id: 2921044
domain: travelinbh.com
description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/cash.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.14.223.70
country_id: 3703430
description:
2026-07-08 22:39:02 dovecot_login authenticator failed for H=([49.124.153.56]) [190.14.223.70]:35574: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.209
country_id: 1733045
description:
2026-07-08 22:41:36 dovecot_login authenticator failed for H=(187-50-27-129.customer.tdatabrasil.net.br) [49.124.149.209]:46328: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-08 22:41:10 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([192.111.137.33]) [81.236.211.54]:39954: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.173
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-08 22:43:02 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [195.222.43.138]:57538: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-08 22:43:17 dovecot_login authenticator failed for H=([218.23.95.14]) [89.121.255.194]:33957: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-08 22:47:09 dovecot_login authenticator failed for H=([49.124.151.11]) [113.193.187.154]:43792: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-08 22:49:14 dovecot_login authenticator failed for H=([190.182.166.19]) [85.105.255.56]:51877: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.158.42
country_id: 1269750
description:
2026-07-08 22:48:57 dovecot_plain authenticator failed for H=(ferchs) [152.52.158.42]:53212: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.175.22
country_id: 1835841
description:
2026-07-08 22:49:01 dovecot_login authenticator failed for H=([103.230.176.152]) [175.198.175.22]:56874: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.231.5.204
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es20?Itemid=101&catid=18 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-08 22:52:16 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [50.190.89.138]:37176: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-08 22:52:30 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com (vm-creative-db01.madavor.cl.zerolag.com) [90.230.226.175]:49848: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.227.251
country_id: 192950
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/acoustic-treatments HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.247.135.61
country_id: 1269750
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.165.46
country_id: 2077456
description:
2026-07-08 23:01:04 dovecot_login authenticator failed for H=([121.173.245.152]) [118.211.165.46]:43198: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-08 23:01:13 dovecot_login authenticator failed for H=([112.48.16.186]) [185.15.82.135]:50998: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:cochinbigbandsho||SC:/home/cochinbigbandsho/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77281327
abuser: 34.87.110.115
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2026-07-08 23:03:27 dovecot_login authenticator failed for H=111-70-29-158.emome-ip.hinet.net (faculdadeunica.static.gvt.net.br) [111.70.29.158]:53619: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 66.187.5.228
country_id: 6252001
domain: www.idealloanz.com.au
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:idealloanzcom||


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 91.196.152.250
country_id: 3017382
domain: ibmcglobal.com
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-08 23:11:39 dovecot_login authenticator failed for H=([188.126.240.80]) [94.16.17.140]:49236: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-08 23:11:19 dovecot_login authenticator failed for H=(nsg-corporate-54.234.187.122.airtel.in) [210.5.117.238]:59952: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-08 23:13:31 dovecot_login authenticator failed for H=([149.54.40.222]) [103.142.184.55]:35068: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.96.69
country_id: 1835841
description:
2026-07-08 23:14:01 dovecot_login authenticator failed for H=([179.183.114.175]) [14.39.96.69]:35397: 535 Incorrect authentication data (set_id=pan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.146
country_id: 1835841
description:
2026-07-08 23:15:48 dovecot_login authenticator failed for H=(187-50-194-182.customer.tdatabrasil.net.br) [218.149.228.146]:45562: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-08 23:15:35 dovecot_login authenticator failed for H=(42-200-73-3.static.imsbiz.com) [98.122.215.23]:39590: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 162.254.36.150
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-08 23:19:38 dovecot_login authenticator failed for H=([210.204.28.60]) [182.95.181.138]:55480: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 111.92.145.67
country_id: 1168579
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:72998.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0b11be441d165d9c79254ba69c22fa6fe43d2494||Title:shhi5wtqol89n8f||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-08 23:19:57 dovecot_login authenticator failed for H=([174.64.199.77]) [128.185.33.241]:35744: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-08 23:22:54 dovecot_login authenticator failed for H=([98.170.57.236]) [121.185.89.74]:58518: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-08 23:23:34 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th [171.100.121.127]:60792: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.177
country_id: 1269750
description:
2026-07-08 23:23:49 dovecot_login authenticator failed for H=(nsg-corporate-177.230.187.122.airtel.in) [122.187.230.177]:37687: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-08 23:24:34 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([65.20.217.64]) [68.7.114.69]:47353: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-08 23:25:20 dovecot_login authenticator failed for H=([120.29.140.188]) [70.91.135.181]:41192: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.16.67
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ahsmarine/public_html/wp-content/uploads/index.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 88.130.159.209
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:97807.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57da545a0d22f4528256c7186f26b524c02e6f69||Title:0x92812dc6||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-07-08 23:33:25 dovecot_login authenticator failed for H=([192.111.131.4]) [182.95.185.158]:55622: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-07-08 23:37:43 dovecot_login authenticator failed for H=([74.196.127.84]) [196.28.226.124]:39658: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.180.129
country_id: 1835841
description:
2026-07-08 23:38:03 dovecot_login authenticator failed for H=([49.124.151.83]) [175.198.180.129]:42555: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.197.170.18
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://sboagen.com/\">situs sbobet</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://technical-seo.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 199.192.16.214
country_id: 6252001
description:
[2026-07-08 23:48:54 +0530] info [whostmgrd] 199.192.16.214 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 34.87.110.115
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:hrj.gif||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.87
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.27||T:APACHE||MVN:ARGS:data[5][value]||SC:/home/cochinbigbandsho/public_html/contact-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-08 23:54:06 dovecot_login authenticator failed for H=([142.54.225.52]) [103.171.55.242]:59832: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-08 23:54:25 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [154.146.238.122]:59510: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 194.33.191.14
country_id: 3017382
domain: stcinemas.co
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:stcinemas||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-09 00:00:26 dovecot_login authenticator failed for H=([184.181.178.35]) [41.219.149.74]:54992: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-09 00:00:38 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net ([184.181.217.198]) [221.120.73.24]:47378: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-09 00:00:58 dovecot_login authenticator failed for H=([103.147.248.44]) [38.141.252.55]:48107: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-09 00:00:57 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([192.111.135.19]) [89.68.245.7]:35553: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-09 00:01:42 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([36.135.107.57]) [83.191.176.93]:60140: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-09 00:05:59 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([111.118.47.8]) [210.0.90.82]:51042: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-09 00:06:18 dovecot_login authenticator failed for H=([70.166.167.49]) [103.171.39.147]:40488: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-09 00:06:31 dovecot_login authenticator failed for H=(122-117-30-20.hinet-ip.hinet.net) [122.160.142.194]:51966: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-09 00:06:53 dovecot_login authenticator failed for H=([178.178.194.123]) [182.95.176.122]:47048: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 125.167.113.228
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shadowxfriska_joijjw.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.211.44.230
country_id: 289688
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:22977.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a68503bff1c31523312b84eacd7c96a3f3452262||Title:elv6nmcxo18l20v||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 125.167.113.228
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/shadowxfriska_joijjw.php||SC:/home/globalgroupoman/public_html/images/shadowxfriska_joijjw.php||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 125.167.113.228
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/shadowxfriska_joijjw.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-09 00:14:36 dovecot_login authenticator failed for H=([174.64.199.77]) [45.82.109.136]:45100: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-09 00:15:05 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([27.123.107.154]) [221.120.78.177]:56903: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.185
country_id: 1733045
description:
2026-07-09 00:15:26 dovecot_login authenticator failed for H=([222.120.176.6]) [49.124.159.185]:38992: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.222
country_id: 6252001
description:
2026-07-09 00:17:16 dovecot_login authenticator failed for H=([211.178.165.251]) [107.85.14.222]:36640: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.163
country_id: 1269750
description:
2026-07-09 00:19:45 dovecot_login authenticator failed for H=(nsg-corporate-163.227.187.122.airtel.in) [122.187.227.163]:46082: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.148
country_id: 1269750
description:
2026-07-09 00:19:49 dovecot_login authenticator failed for H=(nsg-corporate-148.230.187.122.airtel.in) [122.187.230.148]:44222: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.139
country_id: 1269750
description:
2026-07-09 00:19:50 dovecot_login authenticator failed for H=(nsg-corporate-139.227.187.122.airtel.in) [122.187.227.139]:37144: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.235
country_id: 1269750
description:
2026-07-09 00:19:50 dovecot_login authenticator failed for H=(nsg-corporate-235.229.187.122.airtel.in) [122.187.229.235]:36036: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.198
country_id: 1269750
description:
2026-07-09 00:20:10 dovecot_login authenticator failed for H=(nsg-corporate-198.227.187.122.airtel.in) [122.187.227.198]:49259: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.167
country_id: 1269750
description:
2026-07-09 00:20:11 dovecot_login authenticator failed for H=(nsg-corporate-167.227.187.122.airtel.in) [122.187.227.167]:39546: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.104
country_id: 1269750
description:
2026-07-09 00:20:10 dovecot_login authenticator failed for H=(nsg-corporate-104.230.187.122.airtel.in) [122.187.230.104]:56294: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-07-09 00:20:35 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:56913: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-09 00:20:37 dovecot_login authenticator failed for H=([223.109.200.181]) [154.146.238.122]:47364: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.197
country_id: 1269750
description:
2026-07-09 00:20:51 dovecot_login authenticator failed for H=(nsg-corporate-197.227.187.122.airtel.in) [122.187.227.197]:58720: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-09 00:21:02 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:40411: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.87
country_id: 798544
domain: idealloanz.com.au
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.27||T:APACHE||MVN:ARGS:data[3][value]||SC:/home/idealloanzcom/public_html/contact||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-09 00:24:32 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (27-32-45-241.static.tpgi.com.au) [218.219.193.151]:51153: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-09 00:24:44 dovecot_login authenticator failed for H=([42.247.107.130]) [193.46.192.20]:33187: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-09 00:27:46 dovecot_login authenticator failed for H=([194.154.92.163]) [103.163.44.10]:51532: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-karol-bagh.html\">call girl in Karol Bagh</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.3
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.bankeela.com/lotto/339659/\">BANKEELA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.223.230
country_id: 3703430
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-theater-products/v5010i-4k-rgb-laser-tv-projector HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-07-09 00:39:52 dovecot_login authenticator failed for H=([123.163.52.74]) [118.200.42.112]:44040: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.113.73
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.28.5
country_id: 2963597
description:
2026-07-09 00:44:09 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [207.254.28.5]:63662: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-09 00:44:51 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([45.170.50.2]) [85.195.9.20]:35656: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-09 00:48:26 dovecot_login authenticator failed for H=([118.122.196.230]) [14.38.177.105]:48931: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-09 00:48:49 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com (185.255.212.178.ip.karnobat.net) [90.230.212.29]:54420: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77469916
abuser: 144.225.204.148
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-7x7kqfyj.xml.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:fefkadirectors||SC:/home/fefkadirectors/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350977
abuser: 51.79.180.235
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/fbi.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.220.226.39
country_id: 6251999
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/alnay/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-09 00:54:39 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net (static.ill.117.250.19.91.bsnl.co.in) [221.120.73.25]:46275: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.239
country_id: 99237
description:
2026-07-09 00:55:04 dovecot_login authenticator failed for H=([192.111.134.12]) [65.20.149.239]:37840: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-09 00:56:21 dovecot_login authenticator failed for H=([41.65.118.172]) [197.219.228.246]:51296: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/kebmwxid/fonts/kjpticva.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-09 00:56:55 dovecot_login authenticator failed for H=([49.124.159.186]) [172.90.128.97]:53116: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-09 00:58:52 dovecot_login authenticator failed for H=([72.37.216.65]) [206.62.136.130]:55122: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-09 00:59:04 dovecot_login authenticator failed for H=([184.170.245.145]) [65.20.204.41]:56113: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.194.9.138
country_id: 6252001
domain: mail.fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Lanciau_1783539704140.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 104.194.9.138
country_id: 6252001
domain: mail.fefkadirectorsunion.com
description:
IM360 WAF: Attempt to upload malware||Action:upload||Scan duration:108248||Sizes:448||Combined size:448||User:fefkadirectors||WPU:||Filename:Lanciau_649831.svg||Scanned:/tmp//20260709-011140-ak6n9LdBCuZKEPRyXNF6KwAAAVY-file-3J480x||SC:/home/fefkadirectors/public_html/administrator/index.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 104.194.9.138
country_id: 6252001
domain: mail.fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Lanciau_1783539711963.php5||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 34.87.110.115
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:up.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 34.87.110.115
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/up.php||SC:/home/ogocindia/public_html/images/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.211
country_id: 294640
description:
2026-07-09 01:17:13 dovecot_login authenticator failed for H=([98.181.137.69]) [84.111.136.211]:38817: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-09 01:17:29 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([74.119.144.57]) [80.1.51.168]:42390: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-09 01:18:48 dovecot_login authenticator failed for H=([185.15.82.135]) [14.46.58.104]:55664: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-09 01:20:27 dovecot_login authenticator failed for H=(105.217.146.34.bc.googleusercontent.com) [122.160.11.40]:54498: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-09 01:24:35 dovecot_login authenticator failed for H=([1.250.67.114]) [101.13.4.120]:43956: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 188.119.26.49
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||User:globalgroupoman||WPU:||


plugin: modsec
rule: 77469916
abuser: 34.87.110.115
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:up.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 91.224.92.82
country_id: 2635167
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:BDKR28_3lf2sh.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-07-09 01:34:23 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th (110-174-154-152.tpgi.com.au) [58.8.48.178]:58339: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-09 01:34:37 dovecot_login authenticator failed for H=(150.120.103.218.static.netvigator.com) [162.251.93.214]:44960: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 125.164.16.151
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/6w17wvx6oq.php.inc||User:futuracarecom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 125.164.16.151
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/2026/07/6w17wvx6oq.php||SC:/home/futuracarecom/public_html/images/2026||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-09 01:36:55 dovecot_login authenticator failed for H=([49.124.152.33]) [182.95.122.110]:58992: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-09 01:42:31 dovecot_login authenticator failed for H=(78.189.17.35.static.ttnet.com.tr) [76.49.199.97]:36282: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-09 01:45:31 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([83.239.0.202]) [71.229.1.186]:57222: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 5.45.37.210
country_id: 2921044
domain: metrodigitals.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:metrodigitals||SC:/home/metrodigitals/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 188.119.26.49
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceyi0t085l.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-09 01:51:03 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([111.26.106.118]) [65.73.230.102]:51096: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.212.190.89
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ahsmarine/public_html/wp-admin/images/index.php||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 172.212.190.89
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.27||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-07-09 01:51:23 dovecot_login authenticator failed for H=(mission-web-hosting.com) [196.190.220.168]:54996: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-09 01:52:13 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi (syn-075-080-069-106.biz.spectrum.com) [80.223.200.184]:59874: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-09 01:52:29 dovecot_login authenticator failed for H=([14.102.101.248]) [182.95.228.194]:51318: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-07-09 01:57:09 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [122.170.97.94]:35011: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.7.144.60
country_id: 1605651
description:
2026-07-09 01:57:24 dovecot_login authenticator failed for H=([107.181.161.85]) [61.7.144.60]:51994: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-09 01:58:43 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([24.45.137.84]) [202.62.129.18]:60626: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.190.201.155
country_id: 6252001
description:
2026-07-09 01:59:17 dovecot_login authenticator failed for H=syn-108-190-201-155.biz.spectrum.com (h-155-4-31-215.A2204.priv.bahnhof.se) [108.190.201.155]:45291: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-09 02:01:13 dovecot_login authenticator failed for H=([146.255.228.189]) [91.86.88.24]:34140: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.52.161.203
country_id: 6252001
description:
2026-07-09 02:03:41 dovecot_login authenticator failed for H=([31.173.8.170]) [64.52.161.203]:50754: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.61.162.132
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:48419.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:560b819a17e429ebb7f828c331cc6d6470b22920||Title:0x707d6fc8||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.76
country_id: 1835841
description:
2026-07-09 02:04:18 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.149.170.76]:59542: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-07-09 02:05:49 dovecot_login authenticator failed for H=([101.13.4.128]) [122.160.85.144]:45570: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-09 02:06:04 dovecot_login authenticator failed for H=([184.181.217.198]) [49.206.201.253]:41602: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.59.154.71
country_id: 1269750
description:
2026-07-09 02:11:45 dovecot_plain authenticator failed for H=(localhost) [152.59.154.71]:56368: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.135
country_id: 1733045
description:
2026-07-09 02:12:18 dovecot_login authenticator failed for H=(h77-53-193-47.cust.bredband2.com) [49.124.142.135]:58352: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 5.45.37.19
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:yukticlick||SC:/home/yukticlick/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 45.133.170.157
country_id: 2635167
domain: fefkadirectorsunion.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:fefkadirectors||SC:/home/fefkadirectors/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 37.143.62.137
country_id: 2921044
domain: idealloanz.com.au
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:idealloanzcom||SC:/home/idealloanzcom/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 45.8.255.167
country_id: 2635167
domain: ogocindia.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:ogocindia||SC:/home/ogocindia/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.39.40
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-automation-systems HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-09 02:24:51 dovecot_login authenticator failed for H=([183.233.85.194]) [1.250.67.114]:43306: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.182.76
country_id: 1835841
description:
2026-07-09 02:25:07 dovecot_login authenticator failed for H=([112.160.57.196]) [124.153.182.76]:60698: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 37.143.62.56
country_id: 2921044
domain: jaashsupplies.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:jaashsupplies||SC:/home/jaashsupplies/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-09 02:26:07 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [170.233.29.157]:50216: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-09 02:26:32 dovecot_login authenticator failed for H=(host-45-145-203-68.mywic.eu) [220.235.225.112]:49726: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 140.245.98.40
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:ahsmarine||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)
abuser: 140.245.98.40
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)||MV:wp-system||MVN:ARGS:log||WPU:wp-system||User:ahsmarine||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-09 02:28:54 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com ([207.219.222.29]) [90.230.226.175]:56002: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-09 02:29:08 dovecot_login authenticator failed for H=(244.252.163.220.broad.bs.yn.dynamic.163data.com.cn) [221.167.50.229]:45902: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-09 02:32:37 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([112.29.109.174]) [83.191.181.23]:58994: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-07-09 02:32:20 dovecot_login authenticator failed for H=([111.26.167.37]) [211.62.73.218]:42468: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.14.223.70
country_id: 3703430
description:
2026-07-09 02:36:13 dovecot_login authenticator failed for H=([121.179.119.34]) [190.14.223.70]:60236: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-09 02:36:46 dovecot_login authenticator failed for H=a4.ucndns.in ([106.246.89.72]) [103.252.168.4]:41403: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-09 02:36:25 dovecot_login authenticator failed for H=([36.135.93.37]) [210.123.87.143]:40456: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-09 02:36:33 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([67.201.59.67]) [80.223.198.246]:46044: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-09 02:37:31 dovecot_login authenticator failed for H=([1.237.155.150]) [182.78.112.174]:38690: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-09 02:38:11 dovecot_login authenticator failed for H=([88.215.1.201]) [122.176.21.104]:35407: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.19.102.99
country_id: 3865483
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/facelift/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.231.172
country_id: 1269750
description:
2026-07-09 02:48:48 dovecot_login authenticator failed for H=([67.201.58.185]) [122.187.231.172]:53100: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 151.19.82.251
country_id: 3175395
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82965.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:261c963a058407a910d56ee5f120ed0254eb4cac||Title:0x9d07fc23||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-09 02:51:34 dovecot_login authenticator failed for H=(2-74-192-250.kcell.kz) [121.73.169.149]:50532: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.172
country_id: 1835841
description:
2026-07-09 02:51:51 dovecot_login authenticator failed for H=([98.181.137.75]) [61.80.161.172]:50269: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2026-07-09 02:54:36 dovecot_login authenticator failed for H=([111.26.62.45]) [49.124.151.53]:39300: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-09 02:54:42 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net ([49.124.153.29]) [111.70.3.122]:39576: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-09 02:59:12 dovecot_login authenticator failed for H=([174.64.199.87]) [103.176.160.146]:48650: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.57
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.bankeela.com/lotto/350743/\">\xe0\xb8\xa2\xe0\xb8\xb9\xe0\xb8\x9f\xe0\xb9\x88\xe0\xb8\xb2 \xe0\xb9\x80\xe0\xb8\x99\xe0\xb8\x8a\xe0\xb8\xb1\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb9\x8c\xe0\xb8\xa5\xe0\xb8\xb5\xe0\xb8\x81</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-09 03:01:12 dovecot_login authenticator failed for H=(apn-46-77-69-201.static.gprs.plus.pl) [218.159.144.187]:43979: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-09 03:03:32 dovecot_login authenticator failed for H=(ol182-153.fibertel.com.ar) [76.49.199.97]:35052: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-09 03:04:11 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([178.178.194.136]) [94.255.255.26]:57828: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-07-09 03:10:59 dovecot_login authenticator failed for H=([211.40.224.34]) [101.13.4.128]:36024: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-09 03:11:34 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([142.54.229.253]) [80.223.190.179]:54648: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-09 03:19:30 dovecot_login authenticator failed for H=(39.85.165.220.broad.yx.yn.dynamic.163data.com.cn) [51.162.194.94]:39909: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.193.69
country_id: 1819730
domain: mail.fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/fefkadirectors/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-09 03:32:02 dovecot_login authenticator failed for H=([37.238.45.202]) [128.185.197.42]:54992: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-09 03:32:17 dovecot_login authenticator failed for H=([222.236.155.146]) [122.187.116.110]:46760: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.217.80.124
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/retail-and-hospitality HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-09 03:33:55 dovecot_login authenticator failed for H=(172.43.246.220.static.netvigator.com) [183.89.208.174]:56828: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 180.149.243.14
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.2
country_id: 1733045
description:
2026-07-09 03:34:36 dovecot_login authenticator failed for H=([103.50.5.94]) [49.125.201.2]:60838: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.59.137.78
country_id: 798544
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.manoelsantos.com/\">SITUS TIDAK BAYAR WEDE</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 46.250.230.56
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783548402116.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-09 03:38:33 dovecot_login authenticator failed for H=([111.14.105.62]) [196.190.180.18]:58944: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-09 03:38:53 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz (static.ill.117.247.82.240.bsnl.co.in) [83.208.70.70]:51557: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 23.108.48.51
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://news.lex.bg/pregled-na-pechata/%D0%B4%D0%B5%D0%BB%D0%BE-%D1%81%D1%80%D0%B5%D1%89%D1%83-%D0%BA%D0%BC%D0%B5%D1%82%D0%B0-%D0%BD%D0%B0-%D0%B2%D0%B0%D1%80%D0%BD%D0%B0-%D0%B1%D0%BB%D0%B0%D0%B3%D0%BE%D0%BC%D0%B8%D1%80-%D0%BA%D0%BE%D1%86/\">{fuel rewards card|fuel rewards card login|fuel rewards card balance|shell fuel rewards card|fuel rewards shell|</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.58.229.153
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://ace90bet.bet\">\xd8\xb3\xd8\xa7\xdb\x8c\xd8\xaa \xd9\xbe\xdb\x8c\xd8\xb4 \xd8\xa8\xdb\x8c\xd9\x86\xdb\x8c \xd8\xac\xd8\xa7\xd9\x85 \xd8\xac\xd9\x87\xd8\xa7\xd9\x86\xdb\x8c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-09 03:41:35 dovecot_login authenticator failed for H=([98.170.57.251]) [65.191.211.33]:43542: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-09 03:42:00 dovecot_login authenticator failed for H=([197.157.252.162]) [170.233.29.157]:34967: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-09 03:42:53 dovecot_login authenticator failed for H=([179.181.133.153]) [74.209.100.246]:52800: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.188.18
country_id: 1835841
description:
2026-07-09 03:43:11 dovecot_login authenticator failed for H=([171.211.123.106]) [124.153.188.18]:33517: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.232.196.43
country_id: 3996063
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:40880.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ad722a94b0a89fdb36c3def97f5d1c63cfad4e0||Title:0xfe6c1ee2||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.172.170.111
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.youtube.com/watch?v=KG_ZgwZun4U\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 194.53.140.125
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.232.196.43
country_id: 3996063
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:49396.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ae894e8cbd766d8c5e52b7dc2b7bc3e7a29ffca||Title:0xa938c62d||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.211
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.bankeela.com/lotto/350741/\">BANKEELA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.220.162.242
country_id: 2077456
description:
2026-07-09 03:51:10 dovecot_login authenticator failed for H=([5.48.46.95]) [203.220.162.242]:35430: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.172.246.73
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 fuelrewards com activate (<a href=\"https://www.swap-bot.com/swap/show/360074\">https://www.swap-bot.com/swap/show/360074</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.252.216.81
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.wanbiaoku.com\">\xe7\x8e\xa9\xe9\x85\xb7\xe7\xbd\x91\xe7\xbb\x9c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-07-09 03:55:05 dovecot_login authenticator failed for H=([46.163.174.216]) [154.146.240.123]:46190: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-09 03:55:23 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [85.105.255.56]:52879: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.172.246.73
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 www fuelrewards com activate (<a href=\"https://www.blogger.com/comment/fullpage/post/13446965/4791163627544938916\">https://www.blogger.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-09 04:01:10 dovecot_login authenticator failed for H=([222.92.61.242]) [182.95.109.138]:38014: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-09 04:01:32 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc8-184.dhcp.inet.fi) [50.188.204.213]:40788: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://locksmith-cathedral-city-ca.zzz-1.com/\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.41.33
country_id: 99237
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/our-services/ HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 37.143.62.56
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-09 04:18:47 dovecot_login authenticator failed for H=([109.195.14.161]) [219.248.4.146]:59790: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-09 04:18:59 dovecot_login authenticator failed for H=([197.219.228.242]) [47.234.138.49]:41134: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.220.162.242
country_id: 2077456
description:
2026-07-09 04:19:48 dovecot_login authenticator failed for H=(customer.sntochl1.isp.starlink.com) [203.220.162.242]:40978: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-09 04:20:20 dovecot_login authenticator failed for H=([120.194.50.39]) [2.59.162.146]:51056: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-hvac-installation-llano-ca.zzz-1.com/\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-09 04:26:39 dovecot_login authenticator failed for H=([180.188.253.150]) [122.185.44.206]:41744: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-09 04:26:54 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([27.123.111.110]) [79.136.8.69]:36696: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 45.80.106.53
country_id: 294640
domain: ahsmarine.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 45.80.106.53
country_id: 294640
domain: ahsmarine.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:8.27||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: modsec
rule: 77469916
abuser: 125.164.16.151
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceiw7x7mvz.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.255.126.94
country_id: 4566966
description:
2026-07-09 04:30:07 dovecot_login authenticator failed for H=(n112120115152.netvigator.com) [38.255.126.94]:39348: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-09 04:30:33 dovecot_login authenticator failed for H=([49.124.153.38]) [122.53.106.124]:55003: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2026-07-09 04:33:39 dovecot_login authenticator failed for H=([119.203.4.207]) [46.210.95.88]:53448: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-09 04:34:09 dovecot_login authenticator failed for H=([68.71.247.133]) [182.95.228.106]:52132: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.49
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.bankeela.com/lotto/349363/\">BANKEELA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-09 04:39:49 dovecot_login authenticator failed for H=([220.180.107.193]) [218.156.93.202]:59800: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.175.22
country_id: 1835841
description:
2026-07-09 04:40:03 dovecot_login authenticator failed for H=([103.210.250.198]) [175.198.175.22]:41940: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.75.176
country_id: 294640
description:
2026-07-09 04:45:36 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [2.55.75.176]:58197: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-09 04:45:57 dovecot_login authenticator failed for H=([218.202.143.68]) [122.184.124.46]:53746: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-09 04:46:50 dovecot_login authenticator failed for H=([171.244.60.35]) [203.252.10.3]:54984: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-09 04:47:19 dovecot_login authenticator failed for H=([49.124.148.195]) [117.250.250.2]:47126: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.148.164.18
country_id: 6252001
description:
[2026-07-09 04:47:54 +0530] info [whostmgrd] 132.148.164.18 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-09 04:47:55 dovecot_login authenticator failed for H=([146.56.225.248]) [93.95.241.150]:34400: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-09 04:48:06 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([210.117.11.71]) [71.229.1.186]:37234: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.160.69.255
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-49.167.160.69.255||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.163.119.231
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-49.209.163.119.231||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 139.180.225.204
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-49.139.180.225.204||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 139.180.224.207
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-49.139.180.224.207||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.101.75
country_id: 1668284
description:
2026-07-09 04:51:23 dovecot_login authenticator failed for H=110-25-101-75.adsl.fetnet.net (spb-195-239-224-194.sovintel.ru) [110.25.101.75]:54357: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.193
country_id: 2287781
description:
2026-07-09 04:51:42 dovecot_login authenticator failed for H=([184.185.2.254]) [160.154.84.193]:11590: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-09 04:56:14 dovecot_login authenticator failed for H=(promosystem.static.gvt.net.br) [101.13.4.124]:39678: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-09 04:56:32 dovecot_login authenticator failed for H=([98.181.137.75]) [128.185.208.42]:45162: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/zoyrpdsy/fonts/ygqnvqni.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-09 04:56:59 dovecot_login authenticator failed for H=([98.181.137.69]) [117.252.93.114]:33186: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/pkmfjrxb/fonts/wgfdnaxg.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-09 04:59:07 dovecot_login authenticator failed for H=([182.95.185.158]) [101.13.6.91]:56509: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.58.74
country_id: 1522867
description:
2026-07-09 04:59:24 dovecot_login authenticator failed for H=37.151.58.74.dynamic.telecom.kz ([154.58.35.181]) [37.151.58.74]:56156: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.247.135.61
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/ahsmarine/public_html/wp-content/uploads/2021||


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 103.154.151.57
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:MATCHED_VAR||MV:<?php if($_get[c]==\"ganteng\"):$a=\"m\".\"o\".\"v\".\"e\".\"_\".\"u\".\"p\".\"l\".\"o\".\"a\".\"d\".\"e\".\"d\".\"_\".\"f\".\"i\".\"l\".\"e\";@$a($_files[\"f\


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 103.154.151.57
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Malformed URI Open Redirect Probe Detected||MV:/index.php?option=com_quix&task=api.storeCompiledCSs&compiled_css=<?php if($_GET[c]==\"ganteng\"):$a=\"m\".\"o\".\"v\".\"e\".\"_\".\"u\".\"p\".\"l\".\"o\".\"a\".\"d\".\"e\".\"d\".\"_\".\"f\".\"i\".\"l\".\"e\";@$a($_FILES[\"f\


plugin: modsec
rule: 77789665
abuser: 103.154.151.57
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:compiled_css_file_name||MV:../../../../media/fxawswt9.txt||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.154.151.57
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/fxawswt9.txt&font_families={}&30ad189d721d833fa503553b8d4b75ab=1 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77789665
abuser: 103.154.151.57
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:compiled_css_file_name||MV:../../../../media/ugktsn7g.txt||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.154.151.57
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/ugktsn7g.txt&font_families={}&cf9a77c6dacaccfe8cd0c92c7b00e15c=1 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 103.154.151.57
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Malformed URI Open Redirect Probe Detected||MV:/cgi-sys/ea-php82/index.php?option=com_quix&task=api.storeCompiledCSs&compiled_css=<?php if($_GET[c]==\"ganteng\"):$a=\"m\".\"o\".\"v\".\"e\".\"_\".\"u\".\"p\".\"l\".\"o\".\"a\".\"d\".\"e\".\"d\".\"_\".\"f\".\"i\".\"l\".\"e\";@$a($_FILES[\"f\


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.141.2.36
country_id: 1835841
domain: sriganapathyent.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/vrishenterprises/sriganapathyent.in/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.247.135.61
country_id: 1269750
domain: gsmex.global
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/gsmex/public_html/wp-content||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 139.228.161.54
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37301.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bbd2eab75c9f50675f2e08db0a9dc412c765bfcc||Title:0x747c54c9||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.16.61.42
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/lulfm9kp.txt&font_families={}&624bb6a3f58fce1f9a693788008fe3df=1 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-09 05:18:43 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com ([180.94.75.102]) [78.66.44.23]:46294: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-09 05:19:02 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [210.177.143.61]:33756: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-09 05:21:47 dovecot_login authenticator failed for H=([195.239.47.189]) [45.167.250.45]:60390: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.193
country_id: 2287781
description:
2026-07-09 05:22:45 dovecot_login authenticator failed for H=([203.147.89.38]) [160.154.84.193]:38064: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-09 05:22:04 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [122.160.137.230]:37233: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-09 05:27:26 dovecot_login authenticator failed for H=([192.252.214.22]) [122.169.40.221]:55056: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-09 05:27:51 dovecot_login authenticator failed for H=(203.92.36.109.reverse.spectranet.in) [210.5.117.238]:57478: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.120.2
country_id: 1835841
description:
2026-07-09 05:28:15 dovecot_login authenticator failed for H=([197.219.228.242]) [121.1.120.2]:47936: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 146.190.74.46
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcewcf96lru.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-09 05:29:21 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net (91-219-196-17.planeta.dn.ua) [67.85.146.216]:52103: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-07-09 05:29:02 dovecot_login authenticator failed for H=([174.77.111.220]) [138.118.215.192]:57430: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-09 05:30:11 dovecot_login authenticator failed for H=([183.171.61.211]) [89.218.247.234]:38826: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-09 05:30:32 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net (221-120-73-24.emome-ip.hinet.net) [221.120.57.125]:45574: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 45.8.255.111
country_id: 2635167
domain: ibmcglobal.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:ibmcglobal||SC:/home/ibmcglobal/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 95.173.222.58
country_id: 3017382
domain: vrishenterprises.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceh4kq5u70.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.59.137.78
country_id: 798544
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.eluxhungary.com/\">DELTA575 & DELICUAN SITUS SCAM</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.231.178.158
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.snyderfarmerscoop.com/markets/stocks.php?article=kisspr-2025-6-21-coody-unveils-official-us-website-for-premium-inflatable-tents\">best 8 person tent</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 146.190.74.46
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceco8xagxo.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.51.52.191
country_id: 1605651
description:
2026-07-09 05:36:34 dovecot_login authenticator failed for H=(host-104-171-247-183.midolt6.epbfi.com) [101.51.52.191]:55465: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.28.5
country_id: 2963597
description:
2026-07-09 05:36:52 dovecot_login authenticator failed for H=([222.109.73.135]) [207.254.28.5]:50720: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-09 05:50:11 dovecot_login authenticator failed for H=(111-70-32-52.emome-ip.hinet.net) [188.122.37.97]:35000: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-09 05:50:47 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca (mail.tataidc.com) [148.170.156.248]:46536: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.216.6.17
country_id: 2077456
description:
2026-07-09 05:50:50 dovecot_login authenticator failed for H=139-216-6-17.sta.dodo.net.au ([222.109.73.135]) [139.216.6.17]:38773: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-09 05:51:09 dovecot_login authenticator failed for H=([5.29.145.171]) [121.131.220.168]:55695: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.227.197.67
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-s-new-premium-4k-ultra-short-throw-projectors-v6000-v7050i HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-09 05:53:32 dovecot_login authenticator failed for H=(108-90-216-10.lightspeed.rcsntx.sbcglobal.net) [218.156.93.202]:52128: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2026-07-09 05:54:04 dovecot_login authenticator failed for H=([211.116.107.222]) [49.124.151.69]:50498: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-07-09 05:54:57 dovecot_login authenticator failed for H=([2.55.70.124]) [24.105.248.218]:56092: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-09 05:55:43 dovecot_login authenticator failed for H=(c-71-229-1-186.hsd1.al.comcast.net) [87.106.245.167]:44936: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.7.253
country_id: 1835841
description:
2026-07-09 05:59:45 dovecot_login authenticator failed for H=([192.111.130.1]) [59.8.7.253]:53738: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-09 06:01:48 dovecot_login authenticator failed for H=([220.78.112.243]) [113.193.187.154]:43344: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-09 06:02:13 dovecot_login authenticator failed for H=([174.75.211.198]) [210.5.117.238]:65081: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-09 06:03:49 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([184.185.2.1]) [121.6.81.59]:48091: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.197.170.18
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://kingslot96.godaddysites.com/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.241
country_id: 1733045
description:
2026-07-09 06:04:54 dovecot_login authenticator failed for H=(apn-46-77-69-201.static.gprs.plus.pl) [49.124.152.241]:37482: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.235.198
country_id: 1835841
description:
2026-07-09 06:05:18 dovecot_login authenticator failed for H=([120.198.61.146]) [118.43.235.198]:53051: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2026-07-09 06:05:41 dovecot_login authenticator failed for H=110-25-109-53.adsl.fetnet.net ([211.51.108.193]) [110.25.109.53]:38798: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.133
country_id: 1835841
description:
2026-07-09 06:07:29 dovecot_login authenticator failed for H=([111.26.106.119]) [121.131.220.133]:51246: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-09 06:10:40 dovecot_login authenticator failed for H=([174.64.199.69]) [103.168.241.32]:36665: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.64
country_id: 1733045
description:
2026-07-09 06:22:17 dovecot_login authenticator failed for H=(49-0-82-0.24.fixed-public.sila1-bcr.myaisfibre.com) [49.124.151.64]:53436: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-09 06:22:52 dovecot_login authenticator failed for H=([223.207.98.116]) [196.190.220.199]:52210: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77469916
abuser: 185.24.11.186
country_id: 2782113
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceygqmdfs3.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-09 06:32:05 dovecot_login authenticator failed for H=([70.166.167.50]) [147.148.205.252]:51608: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-09 06:32:37 dovecot_login authenticator failed for H=([174.64.199.87]) [196.0.113.110]:54471: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-07-09 06:37:23 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [182.78.69.178]:47794: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 140.235.169.214
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://meneercasino.com/slot-reviews/the-royal-family\">viagra upset stomach</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.148.34
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:173.208.148.34||TA:173.208.148.34||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 152.228.213.32
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.119.191.178
country_id: 2542007
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/contact/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-09 06:56:22 dovecot_login authenticator failed for H=([20.243.200.248]) [113.193.187.154]:38374: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-09 06:56:45 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [128.185.253.122]:58658: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.231.37.11
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/interactive-whiteboards-smartboards HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.74.46.76
country_id: 3703430
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 180.150.113.91
country_id: 2077456
domain: www.futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.27||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Minor||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.5.102
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hedgedoc.info.uqam.ca/s/56GwPcG93\">\xe0\xb8\x84\xe0\xb8\xb2\xe0\xb8\xaa\xe0\xb8\xb4\xe0\xb9\x82\xe0\xb8\x99\xe0\xb8\xad\xe0\xb8\xad\xe0\xb8\x99\xe0\xb9\x84\xe0\xb8\xa5\xe0\xb8\x99\xe0\xb9\x8c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 180.150.113.91
country_id: 2077456
domain: www.futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.27||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Moderate||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.58.83.79
country_id: 3923057
description:
2026-07-09 07:07:51 dovecot_login authenticator failed for H=static-200-58-83-79.supernet.com.bo (2-55-75-176.orange.net.il) [200.58.83.79]:23756: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-09 07:11:27 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th [171.100.121.127]:59292: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-07-09 07:12:08 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:34548: 535 Incorrect authentication data (set_id=dins)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.80.184.78
country_id: 6252001
description:
2026-07-09 07:14:59 dovecot_login authenticator failed for H=([115.245.172.214]) [50.80.184.78]:48316: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2026-07-09 07:15:15 dovecot_login authenticator failed for H=([49.124.151.28]) [130.185.102.59]:37663: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-coimbatore.html\">Coimbatore Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.15.112.12
country_id: 1643084
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/ship-chandlers-fresh-frozen-provision-boned-stores-suppliers/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-09 07:23:41 dovecot_login authenticator failed for H=([46.50.240.92]) [188.122.39.33]:57350: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-07-09 07:25:12 dovecot_plain authenticator failed for H=(gastric) [65.20.148.194]:41469: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-09 07:25:23 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([116.38.54.26]) [93.241.232.14]:37194: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-07-09 07:25:48 dovecot_login authenticator failed for H=([121.173.245.152]) [122.187.229.168]:53305: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-09 07:30:07 dovecot_login authenticator failed for H=([186.239.41.74]) [103.176.160.146]:46710: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-09 07:29:52 dovecot_login authenticator failed for H=([218.92.251.198]) [106.247.22.181]:48580: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.208.63
country_id: 1835841
description:
2026-07-09 07:31:47 dovecot_login authenticator failed for H=([67.201.38.131]) [182.31.208.63]:44179: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.141.62.234
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-32.38.141.62.234||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-09 07:32:04 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net ([109.248.156.49]) [27.124.111.122]:48114: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.80.105
country_id: 1269750
description:
2026-07-09 07:38:49 dovecot_login authenticator failed for H=([24.249.199.9]) [122.160.80.105]:41520: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 194.5.82.88
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.27||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 82.47.253.76
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.gomhuriaonline.com/Gomhuria/1767272.html\">\xd8\xa2\xd9\x8a \xd9\x83\xd9\x8a\xd9\x88 \xd8\xa3\xd9\x88\xd8\xa8\xd8\xb4\xd9\x86 \xd9\x87\xd9\x84 \xd9\x87\xd9\x88 \xd8\xad\xd9\x82\xd9\x8a\xd9\x82\xd9\x8a \xd8\xa3\xd9\x85 \xd9\x85\xd8\xb2\xd9\x8a\xd9\x81</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.202.113.103
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-gs50-portable-projector-review-little-lunchbox-of-light HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/vnhwcjuc/fonts/ckpceoxq.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.10.205
country_id: 1668284
description:
2026-07-09 07:49:23 dovecot_login authenticator failed for H=116-59-10-205.emome-ip.hinet.net ([112.164.209.49]) [116.59.10.205]:50124: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 14.226.23.222
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37219.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9b6d4245af1346c675fc1e787e1bcb0045032ebf||Title:0x446488e7||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.82.130.133
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/news HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.14.84.14
country_id: 2510769
description:
2026-07-09 07:54:20 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [45.14.84.14]:55651: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-09 07:54:37 dovecot_login authenticator failed for H=([49.124.155.177]) [182.95.189.66]:55998: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-09 07:54:57 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([182.90.248.108]) [80.223.190.179]:38098: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-09 07:55:14 dovecot_login authenticator failed for H=([154.73.4.144]) [220.72.138.160]:26828: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.223
country_id: 130758
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/images/cache.php||SC:/home/elegantautomotiv/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-09 07:56:07 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net ([149.54.62.2]) [27.124.111.122]:41957: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-09 07:56:22 dovecot_login authenticator failed for H=(111-70-23-253.emome-ip.hinet.net) [218.156.8.97]:56540: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.187.173.180
country_id: 6252001
description:
2026-07-09 07:58:15 dovecot_login authenticator failed for H=(89.187.173.180) [89.187.173.180]:55444: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.239.190
country_id: 1835841
description:
2026-07-09 07:58:22 dovecot_login authenticator failed for H=(93-122-239-57.orangero.net) [112.164.239.190]:58622: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.203.101.30
country_id: 3624060
description:
2026-07-09 07:58:38 dovecot_login authenticator failed for H=(164-53-26-103.intechonline.net) [201.203.101.30]:59091: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77469916
abuser: 23.180.120.145
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-e06d3e580f116873d609543acb088c7a.xml.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 23.180.120.145
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/tmp/jce-dumper.xml.php||WPU:||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-09 08:03:32 dovecot_login authenticator failed for H=([220.126.215.120]) [193.31.200.85]:47986: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.198.80
country_id: 3996063
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/28/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-09 08:03:03 dovecot_login authenticator failed for H=(82-209-148-60.cust.bredband2.com) [182.78.112.174]:58180: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 180.150.113.91
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.27||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Major||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-09 08:06:52 dovecot_login authenticator failed for H=([220.80.66.168]) [213.55.79.195]:38290: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-09 08:07:06 dovecot_login authenticator failed for H=([49.124.153.12]) [14.35.209.208]:45550: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.55.167.81
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers-2?Itemid=101&catid=18 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.113.220
country_id: 953987
description:
2026-07-09 08:12:19 dovecot_login authenticator failed for H=([67.201.59.67]) [196.25.113.220]:53109: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-09 08:12:53 dovecot_login authenticator failed for H=([94.228.240.2]) [203.252.10.3]:28413: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/nyavyqep/fonts/fqiwryyg.PHP||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.43.242.11
country_id: 3895114
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/finance/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-09 08:20:07 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([121.131.220.157]) [213.101.138.172]:59600: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.248.211
country_id: 1835841
description:
2026-07-09 08:21:10 dovecot_login authenticator failed for H=([59.98.41.27]) [220.80.248.211]:32839: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-09 08:21:31 dovecot_login authenticator failed for H=(activox.static.gvt.net.br) [175.200.217.128]:48208: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-07-09 08:22:09 dovecot_login authenticator failed for H=([34.29.104.32]) [182.78.69.178]:58326: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-09 08:22:18 dovecot_login authenticator failed for H=([58.56.128.190]) [103.55.89.5]:39676: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-09 08:22:26 dovecot_login authenticator failed for H=([60.174.39.82]) [182.95.176.122]:38340: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-09 08:22:46 dovecot_login authenticator failed for H=([180.76.52.146]) [175.200.217.128]:59580: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-09 08:23:11 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se (47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [83.255.209.245]:57226: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.101.237
country_id: 1282988
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-07-09 08:27:19 dovecot_login authenticator failed for H=([115.86.227.79]) [119.192.210.110]:34259: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-09 08:27:04 dovecot_login authenticator failed for H=([1.212.225.99]) [117.250.19.91]:56452: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-07-09 08:29:06 dovecot_plain authenticator failed for H=(palls) [65.20.148.194]:37353: 535 Incorrect authentication data (set_id=admin@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-09 08:31:51 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se (211-21-168-139.hinet-ip.hinet.net) [176.10.203.54]:47428: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.65.38.234
country_id: 1269750
description:
2026-07-09 08:32:07 dovecot_login authenticator failed for H=(111-70-38-54.emome-ip.hinet.net) [182.65.38.234]:40686: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-09 08:33:12 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [182.95.229.110]:37968: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-09 08:33:34 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net (ip-68-71-242-113.hosts.zerolag.com) [221.120.4.61]:60934: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-09 08:32:59 dovecot_login authenticator failed for H=([49.124.148.5]) [203.192.211.180]:55574: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 78.172.212.252
country_id: 298795
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico0lkmow/fonts/shfmza.phar||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 184.178.172.26
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.huanshi100.com/\">\xe6\x96\xb0\xe8\xa7\x86\xe7\x82\xb9\xe6\x96\xb0\xe9\x97\xbb\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.204
country_id: 1733045
description:
2026-07-09 08:42:29 dovecot_login authenticator failed for H=([121.55.64.44]) [49.124.148.204]:57382: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.222.172.38
country_id: 3895114
description:
2026-07-09 08:42:28 dovecot_login authenticator failed for H=([112.161.42.97]) [129.222.172.38]:56312: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-09 08:42:40 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([70.166.167.33]) [83.226.56.106]:50550: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-09 08:42:11 dovecot_login authenticator failed for H=([183.171.4.144]) [220.72.198.61]:50717: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-09 08:43:04 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([67.201.57.102]) [171.100.121.127]:58682: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-09 08:47:07 dovecot_login authenticator failed for H=([83.239.0.202]) [120.29.140.188]:46507: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-09 08:47:30 dovecot_login authenticator failed for H=(48.211.41.34.bc.googleusercontent.com) [190.157.13.210]:48154: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-09 08:47:32 dovecot_login authenticator failed for H=([65.20.167.78]) [121.73.169.149]:58240: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-09 08:47:57 dovecot_login authenticator failed for H=([195.190.126.122]) [144.24.209.174]:56621: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-09 08:48:14 dovecot_login authenticator failed for H=([210.204.28.60]) [45.191.91.81]:38079: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-09 08:49:14 dovecot_login authenticator failed for H=(60-249-251-88.hinet-ip.hinet.net) [103.147.248.23]:40074: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-09 08:49:45 dovecot_login authenticator failed for H=([142.54.231.33]) [85.152.57.60]:35508: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-09 08:49:04 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([27.123.114.190]) [71.229.1.186]:47286: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-09 08:50:21 dovecot_login authenticator failed for H=([27.39.128.68]) [41.128.181.196]:56322: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-09 08:55:36 dovecot_login authenticator failed for H=(dynamic-ip-181612514.cable.net.co) [188.122.37.97]:56534: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-09 08:55:09 dovecot_login authenticator failed for H=([74.119.144.57]) [182.95.123.50]:39650: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://media.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-07-09 08:59:43 dovecot_login authenticator failed for H=(wsip-24-120-10-18.lv.lv.cox.net) [118.200.42.112]:45146: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-09 08:59:59 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net (vps-36f1e8f3.vps.ovh.net) [27.124.111.122]:46425: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-09 09:02:54 dovecot_login authenticator failed for H=([125.62.129.188]) [65.20.131.63]:43633: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-09 09:03:11 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([49.124.151.15]) [78.66.44.246]:53388: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.6.11
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/audio-solutions-microphones-and-speakers HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.87.212.36
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/km/fonts/ahax.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.57
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 \xe0\xb8\x81\xe0\xb8\xb1\xe0\xb8\xa5\xe0\xb9\x82\xe0\xb8\x8a\xe0\xb9\x88 \xe0\xb9\x80\xe0\xb8\x8b\xe0\xb9\x80\xe0\xb8\xa3\xe0\xb8\xb5\xe0\xb8\xa2 \xe0\xb8\xad\xe0\xb8\xb2, <a href=\"https://www.bankeela.com/lotto/349363/\">https://www.bankeela.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783568978309.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783568978228.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-09 09:20:54 dovecot_login authenticator failed for H=(ip-179.48.229.118.fiberlinkpe.net.br) [103.67.152.201]:52576: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvac-maintenance-tune-up-kentfield-ca.zzz-1.com/\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-09 09:22:36 dovecot_login authenticator failed for H=(95x79x57x221.static-business.nn.ertelecom.ru) [117.250.107.180]:48602: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-09 09:22:54 dovecot_login authenticator failed for H=(46.191.197.143.dynamic.str.ufanet.ru) [65.73.230.102]:44692: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.63
country_id: 1733045
description:
2026-07-09 09:24:45 dovecot_login authenticator failed for H=([92.126.223.175]) [49.125.201.63]:45256: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-09 09:25:15 dovecot_login authenticator failed for H=([125.69.195.7]) [128.185.33.241]:32841: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.150.106.26
country_id: 3585968
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intrusion-detection-systems HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.195.163
country_id: 1835841
description:
2026-07-09 09:25:35 dovecot_login authenticator failed for H=([195.190.126.122]) [124.153.195.163]:50304: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-hvac-installation-fort-washington-pa.zzz-1.com/\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.111.96.170
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/category/products?Itemid=101 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-09 09:30:16 dovecot_login authenticator failed for H=([49.125.201.1]) [182.95.228.106]:38696: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-09 09:30:40 dovecot_login authenticator failed for H=([49.124.159.179]) [211.104.166.110]:50814: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-09 09:33:52 dovecot_login authenticator failed for H=(47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [14.32.231.200]:61132: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-09 09:34:27 dovecot_login authenticator failed for H=([182.132.164.178]) [119.92.76.210]:37148: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-09 09:35:23 dovecot_login authenticator failed for H=(abts-north-static-230.137.160.122.airtelbroadband.in) [101.13.5.34]:42724: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.107.179
country_id: 1835841
description:
2026-07-09 09:36:38 dovecot_login authenticator failed for H=([49.124.155.154]) [211.43.107.179]:59923: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-09 09:35:56 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([116.237.181.57]) [83.208.70.70]:34044: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.84
country_id: 1733045
description:
2026-07-09 09:36:03 dovecot_login authenticator failed for H=(static-185-2-228-48.cust.tele2.lt) [49.124.151.84]:49936: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-09 09:36:06 dovecot_login authenticator failed for H=([192.111.139.161]) [78.187.230.168]:38571: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-09 09:37:02 dovecot_login authenticator failed for H=([192.111.135.19]) [122.184.124.46]:54714: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-09 09:43:37 dovecot_login authenticator failed for H=(119247187188.ctinets.com) [103.206.131.33]:49531: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-09 09:43:52 dovecot_login authenticator failed for H=([116.74.77.163]) [125.19.158.2]:50148: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2026-07-09 09:44:36 dovecot_login authenticator failed for H=(static-172.84.12.61-tataidc.co.in) [91.149.142.17]:44627: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.38.180
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intercom-systems HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.192.144.212
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/true-4k-uhd-ultra-short-throw-laser-projector-v5000i?Itemid=101&catid=18 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-09 09:52:15 dovecot_login authenticator failed for H=([119.146.91.181]) [14.32.231.200]:50892: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.118.20.106
country_id: 2921044
description:
2026-07-09 09:52:25 dovecot_login authenticator failed for H=ip-084-118-020-106.um23.pools.vodafone-ip.de ([117.159.93.197]) [84.118.20.106]:14062: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-09 09:53:15 dovecot_login authenticator failed for H=([14.46.30.239]) [51.162.192.62]:38283: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-09 09:53:32 dovecot_login authenticator failed for H=([49.124.152.26]) [112.161.26.125]:45144: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-09 09:54:09 dovecot_login authenticator failed for H=(18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [219.248.65.30]:35221: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.235.148
country_id: 1269750
description:
2026-07-09 09:54:31 dovecot_login authenticator failed for H=(mx-ll-171.6.10-57.dynamic.3bb.in.th) [122.187.235.148]:42204: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-09 09:54:41 dovecot_login authenticator failed for H=(104-2-88-64.lightspeed.miamfl.sbcglobal.net) [193.46.192.20]:59181: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-09 09:55:33 dovecot_login authenticator failed for H=([184.170.249.69]) [85.105.255.56]:60168: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-09 09:56:07 dovecot_login authenticator failed for H=(88.255.189.50.static.ttnet.com.tr) [122.185.101.50]:45556: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-09 09:56:43 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [103.171.39.147]:60522: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-09 09:56:33 dovecot_login authenticator failed for H=([49.124.155.174]) [196.41.207.112]:52827: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.16.61.42
country_id: 2921044
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/df7gx4i6.txt&font_families={}&e61f4ecc68fdd530e4b18182f9cf0c2b=1 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-09 10:03:48 dovecot_login authenticator failed for H=([41.224.62.206]) [152.70.157.25]:54044: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-09 10:04:04 dovecot_login authenticator failed for H=([39.171.42.206]) [180.71.9.31]:38378: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: gsmex.global
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/gbfiruvl/fonts/xqubfjcf.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-09 10:09:19 dovecot_login authenticator failed for H=([101.13.5.30]) [119.192.219.77]:60610: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-09 10:09:34 dovecot_login authenticator failed for H=(biophormula.static.gvt.net.br) [119.92.76.210]:51640: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-09 10:22:49 dovecot_login authenticator failed for H=([200.58.83.79]) [207.188.158.216]:30162: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-ahmedabad.html\">call girl in Ahmedabad</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.78.246.52
country_id: 953987
description:
2026-07-09 10:22:45 dovecot_login authenticator failed for H=([117.191.83.250]) [41.78.246.52]:43548: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-09 10:23:13 dovecot_login authenticator failed for H=([207.254.29.22]) [64.49.97.15]:38378: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-09 10:23:16 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [116.98.104.138]:59258: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-09 10:23:25 dovecot_login authenticator failed for H=([223.107.146.186]) [50.188.204.213]:44165: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-09 10:23:31 dovecot_login authenticator failed for H=(104-2-88-64.lightspeed.miamfl.sbcglobal.net) [128.185.208.42]:38228: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.49
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.bankeela.com/lotto/350420/\">BANKEELA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.16.61.42
country_id: 2921044
domain: futuracare.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/fin1c43g.txt&font_families={}&1261e2f27971f6567be743e97c500520=1 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77789665
abuser: 185.16.61.42
country_id: 2921044
domain: futuracare.com.au
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:compiled_css_file_name||MV:../../../../media/fin1c43g.txt||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.212.119.226
country_id: 2029969
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/business-gravity-img-11-1170x710/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-09 10:34:15 dovecot_login authenticator failed for H=([111.118.47.8]) [38.108.83.2]:9169: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-09 10:34:29 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee (hebei.22.121.in-addr.arpa) [85.29.246.199]:51871: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.182.11
country_id: 1269750
description:
2026-07-09 10:37:35 dovecot_login authenticator failed for H=([117.205.2.250]) [14.139.182.11]:45114: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.8.73.100
country_id: 6254930
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-09 10:43:47 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([67.201.33.12]) [110.25.114.8]:45317: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-09 10:46:14 dovecot_login authenticator failed for H=([223.100.224.75]) [128.185.197.42]:36630: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-09 10:46:38 dovecot_login authenticator failed for H=(user20.85-195-9.netatonce.net) [182.95.106.138]:42718: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.16.61.42
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/yr5mlmbn.txt&font_families={}&9e3672f72bdf7526201dd485fce3bdf0=1 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-09 10:51:47 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [116.98.104.138]:55930: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-09 10:51:22 dovecot_login authenticator failed for H=([68.71.247.133]) [112.160.57.196]:40028: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77209353
abuser: 208.76.40.211
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/administrator/index.php/index.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 12.50.107.222
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-57.12.50.107.222||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 138.186.139.85
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://kings96.net/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-09 11:00:24 dovecot_login authenticator failed for H=([45.55.133.80]) [184.57.39.170]:49233: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-09 11:03:26 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([49.124.153.57]) [168.91.173.57]:59310: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-09 11:03:43 dovecot_login authenticator failed for H=([68.71.247.133]) [122.160.142.194]:43506: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-09 11:03:46 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([195.211.39.144]) [67.85.146.216]:48811: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.15
country_id: 1733045
description:
2026-07-09 11:04:08 dovecot_login authenticator failed for H=([183.171.47.61]) [49.124.153.15]:41918: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2026-07-09 11:06:27 dovecot_login authenticator failed for H=([220.182.14.60]) [117.245.138.2]:36184: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://technical.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-09 11:09:37 dovecot_login authenticator failed for H=(200-159-117-25.customer.tdatabrasil.net.br) [5.48.46.95]:43978: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-09 11:10:18 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (62.36.19.41.static.abi.uni2.es) [155.4.31.215]:46390: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-09 11:10:28 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([190.197.31.229]) [89.67.39.124]:52365: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-09 11:13:36 dovecot_login authenticator failed for H=([49.124.151.60]) [110.227.211.82]:49716: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.146
country_id: 1733045
description:
2026-07-09 11:14:44 dovecot_login authenticator failed for H=([192.111.134.12]) [49.124.152.146]:46638: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-09 11:14:00 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd ([68.71.253.70]) [113.11.34.221]:56576: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-09 11:14:13 dovecot_login authenticator failed for H=([98.170.57.236]) [129.45.84.119]:34106: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-09 11:14:24 dovecot_login authenticator failed for H=([221.224.133.98]) [76.49.199.97]:57256: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-09 11:18:38 dovecot_login authenticator failed for H=([70.166.167.42]) [182.95.181.50]:60920: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-09 11:18:09 dovecot_login authenticator failed for H=([111.42.175.101]) [116.98.104.138]:53240: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-09 11:20:03 dovecot_login authenticator failed for H=([174.75.211.198]) [181.54.70.40]:41720: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/kxddqtbg/fonts/gdqysoqf.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-09 11:20:12 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [94.16.17.140]:55028: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.80.17
country_id: 1835841
description:
2026-07-09 11:22:08 dovecot_login authenticator failed for H=([49.125.201.90]) [121.1.80.17]:46089: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783576437183.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: mail.ddgalaxy.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783576438140.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: www.ddgalaxy.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783576461908.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-09 11:26:40 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([117.205.2.250]) [111.70.38.53]:42049: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-07-09 11:27:08 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io (177-174-108-1.user.vivozap.com.br) [157.7.200.152]:56534: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-09 11:27:34 dovecot_login authenticator failed for H=([222.108.109.37]) [71.12.241.225]:34680: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-09 11:29:16 dovecot_login authenticator failed for H=(wsip-24-120-10-18.lv.lv.cox.net) [154.146.238.122]:33124: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-09 11:30:10 dovecot_login authenticator failed for H=(net-188-219-104-210.cust.vodafonedsl.it) [59.145.160.134]:36264: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-09 11:30:23 dovecot_login authenticator failed for H=([182.74.216.125]) [197.157.252.162]:52463: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.251.255.162
country_id: 3923057
description:
2026-07-09 11:33:58 dovecot_login authenticator failed for H=host-132-251-255-162.supernet.com.bo ([104.37.135.150]) [132.251.255.162]:59194: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77789665
abuser: 185.16.61.42
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:compiled_css_file_name||MV:../../../../media/czydbb6u.txt||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.16.61.42
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/czydbb6u.txt&font_families={}&ae808a442cf95c841e758c5b5fccf61b=1 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783577535176.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.187.64.92
country_id: 1562822
domain: idealloanz.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au/ HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: mail.fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783577730306.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783577850904.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-09 11:47:36 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [203.252.10.3]:11250: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-09 11:47:20 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [188.122.37.97]:38872: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783577847836.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: mail.keralapeople.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783577882366.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2026-07-09 11:49:01 dovecot_login authenticator failed for H=93-42-227-251.ip88.fastwebnet.it ([65.20.191.231]) [93.42.227.251]:54304: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783577944196.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.94.205.12
country_id: 2264397
description:
2026-07-09 11:49:22 dovecot_login authenticator failed for H=a95-94-205-12.cpe.netcabo.pt ([183.171.47.61]) [95.94.205.12]:44676: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-09 11:51:05 dovecot_login authenticator failed for H=([49.124.153.13]) [182.95.102.190]:56148: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: www.keralapeople.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783578047561.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783578061416.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783578148854.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 50.118.211.10
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:132363||Sizes:69488||Combined size:69488||User:keralapeople||WPU:||Filename:adminner.php||Scanned:/tmp//20260709-115326-ak8-Xo228HhOvAz2QA8C8AAAAIM-file-fpsszj||SC:/home/keralapeople/public_html/admin.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-09 11:53:00 dovecot_login authenticator failed for H=([112.27.38.203]) [103.168.241.32]:58960: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-09 11:53:24 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([49.124.153.47]) [94.61.159.91]:39014: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 50.118.211.10
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/keralapeople/public_html/admin.php||User:keralapeople||WPU:||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 50.118.211.10
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/keralapeople/public_html/index.php||User:keralapeople||WPU:||


plugin: modsec
rule: 77469916
abuser: 95.110.230.43
country_id: 3175395
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcel46tmfch.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-09 11:56:05 dovecot_login authenticator failed for H=([27.123.107.154]) [85.152.57.60]:33590: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.132.209.110
country_id: 6252001
description:
2026-07-09 11:58:19 dovecot_login authenticator failed for H=([61.1.105.105]) [47.132.209.110]:61948: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 95.110.230.43
country_id: 3175395
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcejr9jxw4g.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-09 12:01:12 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net ([183.171.61.211]) [111.70.29.132]:39354: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77350970
name: IM360 WAF: Amasty unauthenticated file-upload RCE - dangerous upload filename (WPT-2602)
abuser: 110.137.80.44
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Amasty unauthenticated file-upload RCE - dangerous upload filename (WPT-2602)||MVN:ARGS:fileContent.fileName_with_extension||MV:cmd.php||REQUEST_URI:/rest/V1/amasty_orderattr/uploadFile||SC:/home/globalgroupoman/public_html/rest||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-bangalore.html\">Bangalore Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.236.138
country_id: 6252001
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:173.208.236.138||TA:173.208.236.138||


plugin: modsec
rule: 77469916
abuser: 95.110.230.43
country_id: 3175395
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce83il1kx6.xml.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/images/cache.php||SC:/home/metrodigitals/public_html/images/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/images/images/images/images/images/images/images/cache.php||SC:/home/metrodigitals/public_html/images/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.208.86
country_id: 192950
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/index.php/contact HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/oyzfdaak/fonts/cdmccjet.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-09 12:07:06 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([196.189.51.64]) [125.59.252.103]:54773: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-09 12:07:18 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc9-173.dhcp.inet.fi) [31.171.125.179]:45101: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-09 12:09:53 dovecot_login authenticator failed for H=([49.124.154.169]) [119.92.76.210]:44642: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-09 12:10:29 dovecot_login authenticator failed for H=([49.124.152.240]) [94.16.17.141]:34274: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-09 12:12:40 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [103.130.91.83]:50136: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-09 12:12:20 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([49.124.153.47]) [82.209.191.11]:56168: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.2.228.48
country_id: 597427
description:
2026-07-09 12:12:30 dovecot_login authenticator failed for H=static-185-2-228-48.cust.tele2.lt (mx-ll-171.5.135-77.dynamic.3bb.co.th) [185.2.228.48]:59283: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.20.205.17
country_id: 2661886
description:
2026-07-09 12:13:21 dovecot_login authenticator failed for H=62-20-205-17-no2360.tbcn.telia.com ([182.74.216.125]) [62.20.205.17]:55593: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-09 12:19:47 dovecot_login authenticator failed for H=([218.236.107.228]) [182.78.87.2]:48554: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-09 12:20:04 dovecot_login authenticator failed for H=([182.73.164.228]) [41.219.149.74]:23623: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.77.163
country_id: 1269750
description:
2026-07-09 12:23:00 dovecot_login authenticator failed for H=([197.219.228.242]) [116.74.77.163]:53208: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.105.15.219
country_id: 6252001
description:
2026-07-09 12:23:47 dovecot_login authenticator failed for H=([111.70.21.178]) [174.105.15.219]:45628: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 70.36.99.82
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:124425||Sizes:6643||Combined size:6643||User:keralapeople||WPU:||Filename:i.php||Scanned:/tmp//20260709-122702-ak9GPo228HhOvAz2QA8FigAAAJQ-file-UnB7te||SC:/home/keralapeople/public_html/admin.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.240.165.10
country_id: 783754
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/about-us HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-09 12:31:10 dovecot_login authenticator failed for H=([222.76.248.54]) [222.109.73.135]:52255: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.240
country_id: 294640
description:
2026-07-09 12:32:49 dovecot_login authenticator failed for H=(nsg-corporate-144.227.187.122.airtel.in) [2.55.84.240]:50731: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-09 12:33:49 dovecot_login authenticator failed for H=([104.37.135.150]) [125.19.163.58]:58124: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-09 12:34:21 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net (187-50-193-126.customer.tdatabrasil.net.br) [111.70.22.153]:50023: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-09 12:35:29 dovecot_login authenticator failed for H=([111.206.233.34]) [62.164.148.87]:59722: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/cazjaibs/fonts/muasecem.PHP||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 38.247.165.210
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:91979||Sizes:21||Combined size:21||User:alnay||WPU:||Filename:hkdie65c.txt||Scanned:/tmp//20260709-124204-ak9JxIgXJkoGeWRYwbKKXQAAAQQ-file-thBpWX||SC:/home/alnay/public_html/index.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.247.165.210
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/o8619rs8.txt&font_families={}&620c170babaa4b0b02c0a4085f241a99=1 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 38.247.165.210
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-09 12:48:42 dovecot_login authenticator failed for H=([72.207.109.1]) [106.245.246.26]:39021: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-09 12:49:12 dovecot_login authenticator failed for H=([211.49.80.72]) [38.141.252.55]:46737: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-09 12:49:41 dovecot_login authenticator failed for H=([197.219.208.38]) [154.146.238.122]:55988: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-07-09 12:50:36 dovecot_login authenticator failed for H=([49.125.201.79]) [210.1.66.154]:59958: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-09 12:49:54 dovecot_login authenticator failed for H=(ipmapt-72-195-114-182.oc.oc.cox.net) [203.193.168.136]:40438: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-09 12:51:37 dovecot_login authenticator failed for H=([117.2.123.19]) [98.157.226.42]:44120: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.7.136
country_id: 1668284
description:
2026-07-09 12:51:46 dovecot_login authenticator failed for H=111-70-7-136.emome-ip.hinet.net (a4.ucndns.in) [111.70.7.136]:58250: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-09 12:51:28 dovecot_login authenticator failed for H=([174.64.199.74]) [220.118.190.204]:30960: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-09 12:52:04 dovecot_login authenticator failed for H=([188.219.104.210]) [65.20.237.191]:41205: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-09 12:58:11 dovecot_login authenticator failed for H=(broadband.actcorp.in) [59.25.212.83]:40216: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.210
country_id: 294640
description:
2026-07-09 12:58:23 dovecot_login authenticator failed for H=([122.55.75.218]) [84.111.136.210]:41687: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.148.180.19
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783582142742.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-09 12:59:58 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [117.211.15.93]:60666: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-09 13:00:11 dovecot_login authenticator failed for H=([183.171.15.68]) [119.192.219.77]:58286: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 139.59.99.58
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:13-01.139.59.99.58||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 103.197.69.100
country_id: 1819730
domain: www.travelinbh.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$3:\\\"$$:constructor:constructor\"}}}||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-09 13:05:40 dovecot_login authenticator failed for H=([192.252.208.66]) [152.52.192.162]:40450: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-09 13:06:02 dovecot_login authenticator failed for H=(31-154-126-88.orange.net.il) [182.95.109.138]:37642: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvac-hvac-installation-ansonia-ct.zzz-1.com/\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.78.54.14
country_id: 1668284
description:
2026-07-09 13:11:02 dovecot_login authenticator failed for H=([98.178.72.4]) [211.78.54.14]:36080: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-09 13:11:13 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net ([104.37.135.150]) [111.70.28.243]:41203: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.226.182.40
country_id: 1269750
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53717.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:de9621b6089664e56cf6d47e3d8fc3f739afb17b||Title:0x435bf3a6||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-09 13:18:34 dovecot_login authenticator failed for H=([211.175.71.57]) [13.68.214.34]:59270: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-09 13:23:44 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([72.207.33.65]) [93.241.232.14]:48890: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 23.108.46.59
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.youtube.com/watch?v=KG_ZgwZun4U\">garage door repair</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-09 13:26:05 dovecot_login authenticator failed for H=([82.162.56.186]) [191.44.113.143]:60978: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 102.129.252.228
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 15.235.118.20
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.91.20.113
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://keitai-sumaho.hatenablog.com/iframe/hatena_bookmark_comment?canonical_uri=https://rt.chat-rulet-18.com/all\">\xd1\x80\xd0\xb5\xd0\xb0\xd0\xbb\xd1\x8c\xd0\xbd\xd1\x8b\xd0\xb9 \xd0\xbf\xd0\xbe\xd1\x80\xd0\xbd\xd0\xbe \xd1\x87\xd0\xb0\xd1\x82</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.187.31
country_id: 1269750
description:
2026-07-09 13:33:27 dovecot_login authenticator failed for H=([114.30.180.58]) [122.160.187.31]:46537: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-09 13:36:33 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com (atlanta-1.cdn77.com) [82.209.148.60]:49774: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.114.134.130
country_id: 2077456
description:
2026-07-09 13:39:46 dovecot_login authenticator failed for H=([103.50.5.94]) [193.114.134.130]:24277: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-09 13:42:27 dovecot_login authenticator failed for H=([213.39.31.14]) [103.171.55.242]:45216: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-09 13:42:37 dovecot_login authenticator failed for H=([210.112.227.218]) [191.44.113.143]:56050: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-09 13:42:38 dovecot_login authenticator failed for H=([183.247.171.186]) [103.163.44.10]:47816: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-09 13:42:54 dovecot_login authenticator failed for H=(nsg-corporate-153.124.186.122.airtel.in) [182.95.106.138]:55606: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.57
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.bankeela.com/lotto/350743/\">\xe0\xb8\x9f\xe0\xb8\xb8\xe0\xb8\x95\xe0\xb8\x9a\xe0\xb8\xad\xe0\xb8\xa5\xe0\xb9\x82\xe0\xb8\xa5\xe0\xb8\x81 2026</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.98.13
country_id: 1880251
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2023/10/04/onkyo-150x150.png HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-09 13:47:06 dovecot_login authenticator failed for H=([49.115.219.90]) [121.73.169.149]:54938: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.14.127
country_id: 1835841
description:
2026-07-09 13:47:22 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [112.184.14.127]:43349: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.248.211
country_id: 1835841
description:
2026-07-09 13:46:56 dovecot_login authenticator failed for H=([45.178.227.128]) [220.80.248.211]:49620: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.251.121.103
country_id: 241170
description:
2026-07-09 13:51:49 H=([196.251.121.103]) [196.251.121.103]:59574 F=<storage-alerts@microsoft.com.uk> rejected RCPT <mbt@globalgroupoman.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-09 13:55:41 dovecot_login authenticator failed for H=([49.124.147.101]) [197.219.208.38]:54938: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://bbs.abcdv.net/home.php?mod=space&uid=936355&do=profile\">HTX Khuy\xe1\xba\xbfn N\xc3\xb4ng|N\xc3\xb4ng nghi\xe1\xbb\x87p T\xc3\xa2y Nguy\xc3\xaan|Vi\xe1\xbb\x87n Eakmat Daklak</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.18.77.223
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-bbc3b77326cf9b42a7bef315a123b9ea.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2026-07-09 14:03:48 dovecot_login authenticator failed for H=119-46-148-53.static.asianet.co.th ([31.173.2.33]) [119.46.148.53]:44812: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.18.77.223
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-6e03ddabaf935d3a12f12d1fdaa26a2f.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-09 14:04:08 dovecot_login authenticator failed for H=([211.217.26.2]) [62.220.236.203]:60870: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77222520
abuser: 160.202.167.53
country_id: 6252001
domain: globalgroupoman.com
name:
IM360 WAF: Unauthorized account creation and modification in Joomla! before 3.6.4 (CVE-2016-8870 CVE-2016-9836)

description:
IM360 WAF: Unauthorized account creation and modification in Joomla! before 3.6.4 (CVE-2016-8870 CVE-2016-9836)||MVN:REQUEST_FILENAME||MV:/index.php/component/users/||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 160.202.167.53
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/j1783586154.php||SC:/home/globalgroupoman/public_html/images/j1783586154.php||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 160.202.167.53
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/j1783586154.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-09 14:09:08 dovecot_login authenticator failed for H=([142.54.231.33]) [103.130.207.227]:36124: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-09 14:13:37 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([110.9.78.118]) [217.211.208.125]:34440: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-09 14:14:11 dovecot_login authenticator failed for H=(c-83-226-56-106.bbcust.telenor.se) [196.189.51.64]:43710: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 52.194.177.81
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:pSXyoM-567364354998.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-09 14:20:14 dovecot_login authenticator failed for H=(85-18-115-154.ip.mob-sol.it) [218.156.93.203]:39235: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.106
country_id: 1269750
description:
2026-07-09 14:20:33 dovecot_login authenticator failed for H=([49.124.152.252]) [122.185.146.106]:51878: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-09 14:20:49 dovecot_login authenticator failed for H=([103.156.26.25]) [182.95.127.42]:56598: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-09 14:21:07 dovecot_login authenticator failed for H=([27.100.188.204]) [218.156.8.97]:43114: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-09 14:21:42 dovecot_login authenticator failed for H=([184.170.245.145]) [182.95.228.194]:43598: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-09 14:21:55 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com (31.73.95.218.broad.yc.jx.dynamic.163data.com.cn) [34.41.211.48]:47368: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-09 14:22:23 dovecot_login authenticator failed for H=([199.187.210.51]) [182.95.123.50]:50932: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.217.142
country_id: 1835841
description:
2026-07-09 14:25:24 dovecot_login authenticator failed for H=(170.193.235.186.in-addr.arpa.verointernet.com.br) [112.164.217.142]:48115: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-09 14:25:52 dovecot_login authenticator failed for H=([41.220.3.113]) [222.104.76.94]:49486: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 78.138.14.34
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://barudakwin.win/\">JUDI</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 35.185.185.4
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:hrj.txt||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-09 14:29:48 dovecot_login authenticator failed for H=([91.215.108.149]) [49.206.27.37]:51456: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.14.223.70
country_id: 3703430
description:
2026-07-09 14:30:08 dovecot_login authenticator failed for H=([119.196.213.173]) [190.14.223.70]:52717: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.78.54.14
country_id: 1668284
description:
2026-07-09 14:30:28 dovecot_login authenticator failed for H=([119.196.213.196]) [211.78.54.14]:52376: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://bbs.abcdv.net/home.php?mod=space&uid=946587&do=profile\">\xe2\x80\x9cgi\xe1\xbb\x91ng c\xc3\xa2y ch\xe1\xba\xa5t l\xc6\xb0\xe1\xbb\xa3ng cao\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-09 14:32:46 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca (ipmapt-72-195-114-171.oc.oc.cox.net) [148.170.156.248]:42962: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-09 14:32:27 dovecot_login authenticator failed for H=([103.148.206.98]) [182.78.86.62]:58366: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.173.241.216
country_id: 2661886
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-35.158.173.241.216||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked?lang=EN\">1v1.lol unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 52.194.177.81
country_id: 1861060
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:tTYZRn-433292282432.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-09 14:47:40 dovecot_login authenticator failed for H=([46.44.40.82]) [211.63.34.149]:34377: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.48.108.213
country_id: 1269750
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:43670.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f653441a7c0855fb32428563ff53c57a0de54dca||Title:0xa2f121d2||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-09 14:51:01 dovecot_login authenticator failed for H=([49.124.151.76]) [147.148.205.252]:60342: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-09 14:51:12 dovecot_login authenticator failed for H=([182.74.216.122]) [50.188.204.213]:58628: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-09 14:51:35 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net (111-70-23-253.emome-ip.hinet.net) [71.235.27.139]:55162: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.87.30
country_id: 1835841
description:
2026-07-09 14:54:01 dovecot_login authenticator failed for H=([98.170.57.236]) [125.139.87.30]:54638: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.211
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 \xe0\xb8\x95\xe0\xb8\xb2\xe0\xb8\xa3\xe0\xb8\xb2\xe0\xb8\x87\xe0\xb8\x84\xe0\xb8\xb0\xe0\xb9\x81\xe0\xb8\x99\xe0\xb8\x99 - <a href=\"https://www.bankeela.com/lotto/349834/\">https://www.bankeela.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-09 15:01:06 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com ([182.78.10.145]) [90.230.226.175]:55648: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-09 15:01:04 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se (183.82.108.109.actcorp.in) [79.136.8.69]:48868: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-09 15:02:03 dovecot_login authenticator failed for H=(nsg-corporate-244.229.187.122.airtel.in) [78.187.9.111]:57730: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-09 15:02:14 dovecot_login authenticator failed for H=(c-71-235-27-139.hsd1.vt.comcast.net) [197.219.210.94]:34526: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.235.178
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/tx-nr696-7-2-channel-network-a-v-receiver?Itemid=101&catid=18 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-09 15:14:36 dovecot_login authenticator failed for H=([98.170.57.251]) [65.20.143.45]:50097: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-09 15:14:46 dovecot_login authenticator failed for H=([162.212.13.76]) [103.67.152.201]:55576: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 20.48.255.163
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.0||RSV:8.27||T:APACHE||REQUEST_URI:/wp-config.php.0||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.48.255.163
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/env.php.old||User:ahsmarine||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.253.224.42
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/b-drago666/BD/refs/heads/main/gecko.php||User:kallanigroup||SC:/home/kallanigroup/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 38.253.224.42
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/kallanigroup/public_html/index.php||User:kallanigroup||WPU:||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 51.79.180.235
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/fefkadirectors/public_html/index.php||User:fefkadirectors||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-09 15:20:14 dovecot_login authenticator failed for H=(111-70-32-6.emome-ip.hinet.net) [94.16.17.141]:48234: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-09 15:20:40 dovecot_login authenticator failed for H=([182.79.151.121]) [182.95.228.194]:58576: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-09 15:20:47 dovecot_login authenticator failed for H=(c-50-187-155-130.unallocated.comcastbusiness.net) [183.82.56.12]:65019: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-09 15:21:12 dovecot_login authenticator failed for H=([119.203.4.207]) [50.188.204.213]:49265: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-07-09 15:21:32 dovecot_login authenticator failed for H=([46.210.95.88]) [103.117.155.41]:35752: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.153.46.43
country_id: 1269750
description:
2026-07-09 15:21:40 dovecot_login authenticator failed for H=([206.220.175.5]) [202.153.46.43]:32980: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.33
country_id: 1668284
description:
2026-07-09 15:21:54 dovecot_login authenticator failed for H=([49.124.151.55]) [101.13.5.33]:33364: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.177.242
country_id: 3703430
description:
2026-07-09 15:23:21 dovecot_login authenticator failed for H=([103.55.89.5]) [200.46.177.242]:55023: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2026-07-09 15:23:34 dovecot_login authenticator failed for H=([103.55.89.5]) [122.187.250.250]:40900: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 80.94.95.202
country_id: 798549
domain: idealloanz.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:15-22.80.94.95.202||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.151
country_id: 1269750
description:
2026-07-09 15:27:09 dovecot_login authenticator failed for H=(nsg-corporate-151.229.187.122.airtel.in) [122.187.229.151]:43411: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.172.70.32
country_id: 3351879
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11481.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9968f8f74f58127e9a6e334e5ba2822b3698ed89||Title:0x1d9956fb||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-09 15:28:27 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([192.111.130.1]) [221.120.57.125]:56106: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-07-09 15:28:44 dovecot_login authenticator failed for H=([182.95.215.113]) [101.127.101.225]:49280: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.197.73.75
country_id: 1562822
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/business-gravity-img-3-1170x710/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-09 15:32:34 dovecot_login authenticator failed for H=(nsg-corporate-13.147.187.122.airtel.in) [65.20.233.110]:46443: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-07-09 15:32:35 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io ([174.64.199.87]) [157.7.200.152]:42104: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-09 15:32:46 dovecot_login authenticator failed for H=([49.124.153.26]) [128.185.187.2]:57326: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-09 15:36:28 dovecot_login authenticator failed for H=([4.35.66.245]) [202.62.88.25]:40198: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.234.154.138
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.youtube.com/watch?v=BvswJX8Xg3s\">garage door repair</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.212.190.89
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ddgalaxy/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 172.212.190.89
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ddgalaxy/public_html/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://www7a.biglobe.ne.jp/~Gokiburi/fantasy/fantasy.cgi?%5Dusread%20this%20Dragon-Slave.org%2Fcomics%2FRussellcaHopetounkv&pid=366&ar=497&pid=604\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 223.181.13.36
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: Special shell symbol in request||MV:director-photo|FULLPATH}||MVN:REQUEST_URI||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-09 15:45:12 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [103.55.89.5]:52044: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-09 15:45:45 dovecot_login authenticator failed for H=([218.93.229.230]) [182.95.228.194]:47650: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 83.167.245.57
country_id: 3077311
domain: gsmex.global
description:


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 83.167.245.57
country_id: 3077311
domain: gsmex.global
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.27||T:APACHE||SC:/home/gsmex/public_html/e6f00c9e3bindex.php||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 83.167.245.57
country_id: 3077311
domain: gsmex.global
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.27||T:APACHE||SC:/home/gsmex/public_html/e6f00c9e3bindex.php||


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL track known shells
abuser: 83.167.245.57
country_id: 3077311
domain: gsmex.global
description:


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 83.167.245.57
country_id: 3077311
domain: gsmex.global
description:


