# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.138
country_id: 1269750
description:
2026-07-15 02:49:11 dovecot_login authenticator failed for H=([178.178.194.128]) [182.95.181.138]:37872: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.73.243.243
country_id: 3625428
domain: globalgroupoman.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/globalgroupoman.com/assets/client/GR-65.jpg HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-15 02:52:58 dovecot_login authenticator failed for H=([115.95.23.226]) [210.177.143.61]:44286: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-15 02:54:54 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([103.111.6.121]) [202.62.129.18]:64639: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.207.225.55
country_id: 6252001
description:
2026-07-15 02:55:09 dovecot_login authenticator failed for H=wsip-64-207-225-55.tu.ok.cox.net (2-55-88-51.orange.net.il) [64.207.225.55]:57656: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.28||T:APACHE||MVN:ARGS:jform[defaultvalue][f_textarea_attribute_class]||MV: inputbox visCSSinput ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-15 02:56:03 dovecot_login authenticator failed for H=([98.170.57.251]) [122.185.101.50]:46884: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.137.230
country_id: 1269750
description:
2026-07-15 02:56:27 dovecot_login authenticator failed for H=([186.239.240.127]) [122.160.137.230]:43077: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.47.146
country_id: 1819730
description:
2026-07-15 03:00:40 dovecot_login authenticator failed for H=146.47.246.220.static.netvigator.com (201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [220.246.47.146]:52916: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.204.67
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/true-4k-uhd-ultra-short-throw-laser-projector-v5000i?Itemid=101&catid=18 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-15 03:08:57 dovecot_login authenticator failed for H=([115.93.117.61]) [182.95.226.138]:41626: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.63
country_id: 1733045
description:
2026-07-15 03:13:53 dovecot_login authenticator failed for H=(221-120-78-177.emome-ip.hinet.net) [49.124.151.63]:44194: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-15 03:14:05 dovecot_login authenticator failed for H=([197.219.208.38]) [94.16.17.141]:37866: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 158.69.22.136
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://crm.sinknews.it.com/\">bigtechoro</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-15 03:17:03 dovecot_login authenticator failed for H=(6.40.48.59.broad.cz.sx.dynamic.163data.com.cn) [128.185.235.110]:44476: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 80.94.95.202
country_id: 798549
domain: elegantautomotives.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-21.80.94.95.202||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.198.13.212
country_id: 241170
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.google.az/url?q=https://serveursio.ovh/index.php/Ein_Umfassender_Leitfaden_f%C3%BCr_Sportwetten:_Tipps_f%C3%BCr_Einsteiger_in_Deutschland\">https://www.google.az/url?q=https://serveursio.ovh/index.php/Ein_Umfassender_Leitfaden_f%C3%BCr_Sportwetten:_Tipps_f%C3%BCr_Einsteiger_in_Deutschland</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 172.255.83.134
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://sboagen.com/\">sboagen</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-15 03:25:20 dovecot_login authenticator failed for H=([213.33.182.183]) [125.19.182.118]:60000: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.99.181.123
country_id: 2661886
description:
2026-07-15 03:24:56 dovecot_login authenticator failed for H=([61.111.255.216]) [65.99.181.123]:48032: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-07-15 03:29:50 dovecot_login authenticator failed for H=([80.233.12.109]) [218.233.182.39]:13118: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-15 03:30:07 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([68.71.251.130]) [220.246.40.63]:37437: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-15 03:32:36 dovecot_login authenticator failed for H=([185.65.238.251]) [101.13.5.39]:47198: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.160.140.138
country_id: 1562822
description:
2026-07-15 03:33:34 dovecot_login authenticator failed for H=(mail.toptronicsinc.com) [113.160.140.138]:52894: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.29.145.171
country_id: 294640
description:
2026-07-15 03:33:55 dovecot_login authenticator failed for H=([103.134.0.250]) [5.29.145.171]:51310: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77469916
abuser: 23.248.170.199
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jf66720.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.157.252.162
country_id: 2260494
description:
2026-07-15 03:35:21 dovecot_login authenticator failed for H=([103.148.206.99]) [197.157.252.162]:36156: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-15 03:35:53 dovecot_login authenticator failed for H=([192.111.135.19]) [101.13.6.86]:54846: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.206.194.29
country_id: 1269750
description:
2026-07-15 03:36:52 dovecot_login authenticator failed for H=([174.64.199.69]) [49.206.194.29]:38044: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.183.125.51
country_id: 798544
description:
2026-07-15 03:37:04 dovecot_login authenticator failed for H=178.183.125.51.mobile.static.t-mobile.pl ([112.160.57.196]) [178.183.125.51]:50616: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.68.226.171
country_id: 3017382
description:
2026-07-15 03:37:55 dovecot_login authenticator failed for H=vps-b674cd8d.vps.ovh.net (ipmapt-72-195-34-45.oc.oc.cox.net) [51.68.226.171]:53056: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-15 03:38:27 dovecot_login authenticator failed for H=(wsip-184-178-172-10.rn.hr.cox.net) [119.92.76.210]:32808: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.232.66
country_id: 1269750
description:
2026-07-15 03:43:34 dovecot_login authenticator failed for H=([192.111.137.33]) [182.95.232.66]:34876: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.171.39.147
country_id: 1269750
description:
2026-07-15 03:43:17 dovecot_login authenticator failed for H=([14.51.12.142]) [103.171.39.147]:48048: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-15 03:45:47 dovecot_login authenticator failed for H=([184.170.245.145]) [122.185.146.166]:35420: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-15 03:46:46 dovecot_login authenticator failed for H=([98.170.57.236]) [98.122.215.23]:48994: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-15 03:47:02 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net (broadband-109-173-39-103.ip.moscow.rt.ru) [111.70.3.122]:57522: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-15 03:48:03 dovecot_login authenticator failed for H=([202.72.193.36]) [196.188.93.169]:4822: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.72.46.152
country_id: 1562822
description:
2026-07-15 03:48:26 dovecot_login authenticator failed for H=([87.106.245.167]) [27.72.46.152]:48955: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-15 03:51:46 dovecot_login authenticator failed for H=([85.117.232.42]) [62.201.228.210]:50482: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.53.193.47
country_id: 2661886
description:
2026-07-15 03:52:13 dovecot_login authenticator failed for H=h77-53-193-47.cust.bredband2.com ([192.111.130.1]) [77.53.193.47]:37478: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-15 03:52:38 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([121.139.106.117]) [93.241.232.14]:34266: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.17.214
country_id: 1668284
description:
2026-07-15 03:52:54 dovecot_login authenticator failed for H=111-70-17-214.emome-ip.hinet.net ([36.141.89.67]) [111.70.17.214]:48141: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-15 03:54:06 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net (ip-142-54-232-1.hosts.zerolag.com) [110.25.105.240]:38252: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-15 03:54:12 dovecot_login authenticator failed for H=([61.36.134.212]) [103.130.207.227]:58740: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-15 03:54:31 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net (90-230-226-175-no2550.tbcn.telia.com) [111.70.29.132]:43798: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.174.170.34
country_id: 6252001
description:
2026-07-15 03:54:39 dovecot_login authenticator failed for H=([36.137.38.119]) [70.174.170.34]:38607: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.192
country_id: 2287781
description:
2026-07-15 03:55:31 dovecot_login authenticator failed for H=([80.233.77.136]) [160.154.84.192]:57143: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-15 03:54:46 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [196.188.187.21]:52576: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.171.95.112
country_id: 1835841
description:
2026-07-15 03:55:51 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc0-112.dhcp.inet.fi) [121.171.95.112]:34234: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.155.110
country_id: 1269750
description:
2026-07-15 03:56:25 dovecot_login authenticator failed for H=(191.34.34.41.static.adsl.gvt.net.br) [125.23.155.110]:45056: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.141.202
country_id: 99237
description:
2026-07-15 03:58:01 dovecot_login authenticator failed for H=(static-172.84.12.61-tataidc.co.in) [65.20.141.202]:36043: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-15 04:03:35 dovecot_login authenticator failed for H=([98.170.57.251]) [220.240.104.100]:57204: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.36.117
country_id: 1562822
description:
2026-07-15 04:03:54 dovecot_login authenticator failed for H=(48.211.41.34.bc.googleusercontent.com) [222.252.36.117]:53204: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:photos-4|FULLPATH}||MVN:REQUEST_URI||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 91.132.125.164
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://meneercasino.com/online-casino-tips/10-hoogste-jackpots-holland-casino\">penis enlargement surgery cost maryland</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.171.125.179
country_id: 587116
description:
2026-07-15 04:07:06 dovecot_login authenticator failed for H=(104-2-88-64.lightspeed.miamfl.sbcglobal.net) [31.171.125.179]:39339: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.204.74
country_id: 1269750
description:
2026-07-15 04:08:43 dovecot_login authenticator failed for H=([192.111.139.161]) [125.23.204.74]:48200: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.127.42
country_id: 1269750
description:
2026-07-15 04:09:10 dovecot_login authenticator failed for H=([98.178.72.4]) [182.95.127.42]:55266: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:photos-6|FULLPATH}||MVN:REQUEST_URI||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-15 04:09:51 dovecot_login authenticator failed for H=(187.058.067.17.static.host.gvt.net.br) [182.95.106.138]:34302: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.209.30
country_id: 1269750
description:
2026-07-15 04:12:01 dovecot_login authenticator failed for H=([72.205.0.69]) [128.185.209.30]:38008: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:photos-3|FULLPATH}||MVN:REQUEST_URI||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-15 04:13:27 dovecot_login authenticator failed for H=([199.102.105.241]) [182.95.230.74]:35202: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:photos-5|FULLPATH}||MVN:REQUEST_URI||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.58
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-13.196.196.53.58||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.58
country_id: 458258
domain: idealloanz.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-12.196.196.53.58||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-15 04:14:56 dovecot_login authenticator failed for H=(abts-west-static-211.232.201.106.airtelbroadband.in) [182.95.102.190]:46190: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.147.253
country_id: 1733045
description:
2026-07-15 04:15:14 dovecot_login authenticator failed for H=([142.54.231.33]) [49.124.147.253]:56920: 535 Incorrect authentication data (set_id=nirmal)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.103.60.136
country_id: 2782113
domain: ahsmarine.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:04-15.212.103.60.136||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.248
country_id: 1668284
description:
2026-07-15 04:17:35 dovecot_login authenticator failed for H=111-70-38-248.emome-ip.hinet.net ([104.37.132.51]) [111.70.38.248]:56674: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 167.254.240.75
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: PHP Injection Low value||MV:<?php error_reporting(0);$t=\"d571c5599aa6\";if(!isset($_GET[\"t\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-15 04:16:39 dovecot_login authenticator failed for H=([182.95.215.113]) [112.160.57.196]:36146: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 167.254.240.75
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/tx_af0e01a9.phtml.json?t=d571c5599aa6||SC:/home/alnay/public_html/images/tx_af0e01a9.phtml.json||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-15 04:17:47 dovecot_login authenticator failed for H=mail.sotus.co.th ([189.59.210.1]) [171.100.156.38]:34431: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.90.128.97
country_id: 6252001
description:
2026-07-15 04:19:06 dovecot_login authenticator failed for H=(111-70-38-54.emome-ip.hinet.net) [172.90.128.97]:53602: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-15 04:19:39 dovecot_login authenticator failed for H=(77x106x78x215.dynamic.barnaul.ertelecom.ru) [118.220.149.121]:46952: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.66
country_id: 1269750
description:
2026-07-15 04:20:04 dovecot_login authenticator failed for H=(nsg-static-153.77.71.182.airtel.in) [27.123.94.66]:54448: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:a8f0:b833:1025:88ec:e82f
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:photos-2|FULLPATH}||MVN:REQUEST_URI||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.181.79.60
country_id: 1819730
description:
2026-07-15 04:21:15 dovecot_login authenticator failed for H=([49.124.159.196]) [65.181.79.60]:51779: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.157.13.210
country_id: 3686110
description:
2026-07-15 04:22:31 dovecot_login authenticator failed for H=([49.124.152.208]) [190.157.13.210]:46582: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-15 04:25:13 dovecot_login authenticator failed for H=([182.95.178.174]) [122.185.44.206]:46058: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-15 04:25:37 dovecot_login authenticator failed for H=([49.124.151.58]) [95.82.7.89]:32802: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-15 04:26:39 dovecot_login authenticator failed for H=(ip-68-71-242-113.hosts.zerolag.com) [175.203.199.118]:56133: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a6639.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.219.193.151
country_id: 1861060
description:
2026-07-15 04:27:18 dovecot_login authenticator failed for H=l193151.ppp.asahi-net.or.jp ([14.29.204.161]) [218.219.193.151]:36852: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.187.2
country_id: 1269750
description:
2026-07-15 04:27:34 dovecot_login authenticator failed for H=([111.35.36.48]) [128.185.187.2]:59756: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-15 04:32:32 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([102.211.7.162]) [174.168.146.152]:45091: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 140.245.68.143
country_id: 1835841
description:
[2026-07-15 04:32:33 +0530] info [whostmgrd] 140.245.68.143 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-15 04:33:06 dovecot_login authenticator failed for H=(46-10-56-170.ip.btc-net.bg) [203.252.10.3]:15345: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.211.15.93
country_id: 1269750
description:
2026-07-15 04:35:54 dovecot_login authenticator failed for H=(119.92.76.214.static.pldt.net) [117.211.15.93]:40488: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-15 04:36:33 dovecot_login authenticator failed for H=([210.183.167.169]) [220.240.104.100]:56085: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: elegantautomotives.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a7266.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.58
country_id: 458258
domain: idealloanz.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-40.196.196.53.58||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.150.106
country_id: 1269750
description:
2026-07-15 04:42:51 dovecot_login authenticator failed for H=([68.71.242.113]) [182.95.150.106]:52302: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-15 04:43:11 dovecot_login authenticator failed for H=([174.75.211.196]) [182.95.106.138]:46924: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-15 04:51:41 dovecot_login authenticator failed for H=([121.22.99.2]) [50.187.155.130]:54272: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.61.18
country_id: 6252001
description:
2026-07-15 04:51:52 dovecot_login authenticator failed for H=wsip-68-225-61-18.pn.at.cox.net (static.ill.103.225.15.98.bsnl.co.in) [68.225.61.18]:45075: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.228.86
country_id: 1269750
description:
2026-07-15 04:51:55 dovecot_login authenticator failed for H=([49.124.152.33]) [125.23.228.86]:55060: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-15 04:52:02 dovecot_login authenticator failed for H=(dsl-94-233-127-218.avtlg.ru) [182.95.12.178]:43314: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-15 04:53:02 dovecot_login authenticator failed for H=([184.185.2.1]) [47.223.212.176]:39498: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.100.156.38
country_id: 1605651
description:
2026-07-15 04:54:22 dovecot_login authenticator failed for H=mail.sotus.co.th ([152.52.240.162]) [171.100.156.38]:60876: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-15 04:54:41 dovecot_login authenticator failed for H=(abts-tn-static-181.6.185.136.airtelbroadband.in) [94.16.17.140]:41742: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: travelinbh.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-15 05:03:34 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net (189-56-31-177.customer.tdatabrasil.net.br) [221.120.73.24]:50458: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.162.61.229
country_id: 1835841
description:
2026-07-15 05:03:46 dovecot_login authenticator failed for H=([192.252.208.66]) [121.162.61.229]:63101: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.56.228.149
country_id: 6252001
description:
2026-07-15 05:07:36 dovecot_login authenticator failed for H=ool-6038e495.static.optonline.net ([122.187.142.185]) [96.56.228.149]:49296: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.2.48
country_id: 3202326
description:
2026-07-15 05:07:56 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [5.181.2.48]:54842: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.88.25
country_id: 1269750
description:
2026-07-15 05:08:31 dovecot_login authenticator failed for H=([196.190.220.168]) [202.62.88.25]:54788: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a9441.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-15 05:16:15 dovecot_login authenticator failed for H=([68.71.251.130]) [123.212.9.122]:56873: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-15 05:16:34 dovecot_login authenticator failed for H=(177-61-176-110.dsl.telesp.net.br) [41.219.149.74]:8536: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-15 05:19:08 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com (static-193-217-0-16.cust.tele2.lt) [24.142.170.231]:48350: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.72.102.106
country_id: 1269750
description:
2026-07-15 05:19:37 dovecot_login authenticator failed for H=([218.156.8.97]) [182.72.102.106]:34008: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.178.174
country_id: 1269750
description:
2026-07-15 05:19:38 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [182.95.178.174]:43054: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.132
country_id: 1668284
description:
2026-07-15 05:19:53 dovecot_login authenticator failed for H=110-25-112-132.adsl.fetnet.net ([202.138.229.190]) [110.25.112.132]:48021: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.133.4.22
country_id: 1522867
description:
2026-07-15 05:23:34 dovecot_login authenticator failed for H=2.133.4.22.dynamic.telecom.kz ([58.18.80.18]) [2.133.4.22]:45697: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.62.129.18
country_id: 2077456
description:
2026-07-15 05:23:37 dovecot_login authenticator failed for H=202-62-129-18.ip.vocus.network ([121.128.84.224]) [202.62.129.18]:56612: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.71.9.31
country_id: 1835841
description:
2026-07-15 05:24:25 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [180.71.9.31]:47900: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-15 05:24:31 dovecot_login authenticator failed for H=(92x255x190x68.static-business.omsk.ertelecom.ru) [93.95.241.150]:35531: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 4.154.182.80
country_id: 6252001
domain: apkmetal.in
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-15 05:27:26 dovecot_login authenticator failed for H=(104-12-19-114.lightspeed.chrlnc.sbcglobal.net) [182.95.229.110]:54888: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-15 05:27:54 dovecot_login authenticator failed for H=([61.84.4.230]) [197.242.170.10]:53846: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.215.1.201
country_id: 2635167
description:
2026-07-15 05:34:29 dovecot_login authenticator failed for H=([183.171.155.166]) [88.215.1.201]:37146: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-15 05:34:11 dovecot_login authenticator failed for H=(154.205.26.218.internet.sx.cn) [222.108.109.37]:52561: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-15 05:38:56 dovecot_login authenticator failed for H=([121.139.106.117]) [122.160.11.40]:54332: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.249.6
country_id: 1269750
description:
2026-07-15 05:39:16 dovecot_login authenticator failed for H=([70.166.167.35]) [122.186.249.6]:39258: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 82.22.255.121
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://id.pinterest.com/ufabetxx/\">ufabet \xe0\xb9\x80\xe0\xb8\xa7\xe0\xb9\x87\xe0\xb8\x9a\xe0\xb8\x95\xe0\xb8\xa3\xe0\xb8\x87</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.222.142.226
country_id: 241170
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/images/2024/10/10/reliability.png HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.58
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:05-41.196.196.53.58||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.118.224.138
country_id: 1835841
description:
2026-07-15 05:46:01 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [210.118.224.138]:39197: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.69.106
country_id: 6252001
description:
2026-07-15 05:50:29 dovecot_login authenticator failed for H=syn-075-080-069-106.biz.spectrum.com (150.120.103.218.static.netvigator.com) [75.80.69.106]:46346: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://azbongda.com/index.php/L%C3%A0m_n%C3%B4ng_th%C3%B4ng_minh_trong_th%E1%BB%9Di_%C4%91%E1%BA%A1i_m%E1%BB%9Bi\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-15 05:50:14 dovecot_login authenticator failed for H=([218.92.251.198]) [94.16.17.140]:47752: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.110.150
country_id: 660013
description:
2026-07-15 05:50:50 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [45.82.110.150]:48990: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.95.241.150
country_id: 1522867
description:
2026-07-15 05:51:07 dovecot_login authenticator failed for H=(centavo.ddsfma.uz) [93.95.241.150]:56731: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a9954.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-15 05:58:40 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se (201-91-242-197.customer.tdatabrasil.net.br) [83.191.176.93]:58482: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.11.34.221
country_id: 1210997
description:
2026-07-15 05:59:06 dovecot_login authenticator failed for H=113-11-34-221.broadband.smile.com.bd ([103.147.248.44]) [113.11.34.221]:54284: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-aligarh.html\">Aligarh Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.148.99.59
country_id: 6252001
description:
2026-07-15 05:59:26 dovecot_login authenticator failed for H=(187-51-198-202.customer.tdatabrasil.net.br) [38.148.99.59]:47963: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-15 06:00:14 dovecot_login authenticator failed for H=([49.124.145.56]) [119.92.76.210]:37322: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-07-15 06:00:27 dovecot_login authenticator failed for H=([68.71.249.154]) [122.170.97.94]:48415: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.23.246
country_id: 895949
description:
2026-07-15 06:05:20 dovecot_login authenticator failed for H=([67.201.59.67]) [41.60.23.246]:60288: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.92.76.210
country_id: 1694008
description:
2026-07-15 06:06:02 dovecot_login authenticator failed for H=([60.174.35.18]) [119.92.76.210]:54178: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"reason\":-1,\"status\":\"resolved_model\",\"x_9bd0e499\":\"rejected\",\"$5ae423be\":[],\"_response\":{\"_prefix\":\"var ofu=[].slice.call(arguments,1)[0];var gybm=ofu;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.214.75.248
country_id: 298795
description:
2026-07-15 06:07:28 dovecot_login authenticator failed for H=(nsg-static-62.36.76.182-airtel.com) [81.214.75.248]:40638: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.244.60.35
country_id: 1562822
description:
2026-07-15 06:06:41 dovecot_login authenticator failed for H=([222.190.110.210]) [171.244.60.35]:61856: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.190
country_id: 1835841
description:
2026-07-15 06:07:05 dovecot_login authenticator failed for H=([183.171.155.166]) [1.250.67.190]:36784: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.142.184.55
country_id: 1210997
description:
2026-07-15 06:07:16 dovecot_login authenticator failed for H=([65.20.146.109]) [103.142.184.55]:44176: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-15 06:11:18 dovecot_login authenticator failed for H=([182.95.187.86]) [92.62.74.41]:53534: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://trans.hiragana.jp/ruby/http://www.god123.xyz/home.php?mod=space&uid=1363896&do=profile\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat \xc4\x90\xe1\xba\xafk L\xe1\xba\xafk\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.101.138.172
country_id: 597427
description:
2026-07-15 06:19:46 dovecot_login authenticator failed for H=static-213-101-138-172.cust.tele2.lt (pool-108-35-129-132.nwrknj.fios.verizon.net) [213.101.138.172]:47772: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-15 06:20:23 dovecot_login authenticator failed for H=([74.119.144.57]) [197.219.228.246]:60130: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-15 06:20:58 dovecot_login authenticator failed for H=([58.34.62.66]) [203.192.211.180]:49320: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.252.16.237
country_id: 1562822
description:
2026-07-15 06:21:44 dovecot_login authenticator failed for H=([203.252.10.3]) [222.252.16.237]:42346: 535 Incorrect authentication data


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-15 06:26:34 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.63.34.149
country_id: 1835841
description:
2026-07-15 06:27:47 dovecot_login authenticator failed for H=(nsg-static-16.107.76.182-airtel.com) [211.63.34.149]:59679: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-15 06:29:39 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([196.189.126.10]) [24.142.170.231]:44684: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.66.197.199
country_id: 2661886
description:
2026-07-15 06:29:09 dovecot_login authenticator failed for H=213-66-197-199-no2550.tbcn.telia.com ([92.84.21.186]) [213.66.197.199]:52022: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-15 06:36:10 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [103.130.207.227]:48170: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.38
country_id: 1036973
description:
2026-07-15 06:35:43 dovecot_login authenticator failed for H=([70.166.167.58]) [197.219.208.38]:35274: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-15 06:37:22 dovecot_login authenticator failed for H=([98.181.137.69]) [219.248.65.30]:39241: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 179.65.193.139
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:146848||Sizes:21||Combined size:21||User:alnay||WPU:||Filename:woji1qcb.txt||Scanned:/tmp//20260715-063736-albdWDlJWnrbHGznwzuZEwAAAUU-file-PLkdyE||SC:/home/alnay/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-15 06:37:08 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [94.16.17.141]:48052: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 179.65.193.139
country_id: 1643084
domain: www.alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:150163||Sizes:21||Combined size:21||User:alnay||WPU:||Filename:okp60e21.txt||Scanned:/tmp//20260715-063736-albdWLL-JCm3wcozWNyNrQAAAFc-file-OPuBU6||SC:/home/alnay/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-15 06:39:33 dovecot_login authenticator failed for H=(fabfibernet.com) [61.32.68.66]:16778: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-15 06:40:24 dovecot_login authenticator failed for H=(host-176.111.64.38.userland.magintov.ru) [220.126.215.120]:50856: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-15 06:39:52 dovecot_login authenticator failed for H=([102.38.3.107]) [182.95.102.190]:36776: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-15 06:40:43 dovecot_login authenticator failed for H=([118.250.183.25]) [175.203.199.118]:9666: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-15 06:41:10 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([103.154.64.185]) [35.130.111.98]:46071: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.1.105.105
country_id: 1269750
description:
2026-07-15 06:41:27 dovecot_login authenticator failed for H=([148.170.156.248]) [61.1.105.105]:59709: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.69
country_id: 1733045
description:
2026-07-15 06:42:08 dovecot_login authenticator failed for H=([210.204.28.60]) [49.124.151.69]:37598: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-15 06:50:23 dovecot_login authenticator failed for H=([49.125.201.90]) [59.145.160.134]:36350: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://319ch.com/cgi/ro/vv_kakiko4/vv_kakiko2.cgi\">\xe2\x80\x9cViencaytrong.com\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.155.228.189
country_id: 2661886
description:
2026-07-15 06:52:47 dovecot_login authenticator failed for H=h95-155-228-189.cust.bredband2.com ([142.54.229.253]) [95.155.228.189]:45719: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.85
country_id: 1733045
description:
2026-07-15 06:56:01 dovecot_login authenticator failed for H=([65.20.204.41]) [49.124.151.85]:47794: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-15 06:57:20 dovecot_login authenticator failed for H=([49.124.152.145]) [182.95.228.194]:37028: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.34
country_id: 1668284
description:
2026-07-15 06:57:38 dovecot_login authenticator failed for H=(27-33-247-46.tpgi.com.au) [101.13.5.34]:46182: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.231.243.28
country_id: 6252001
description:
2026-07-15 06:59:12 dovecot_login authenticator failed for H=([125.19.171.114]) [50.231.243.28]:47926: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-15 06:58:48 dovecot_login authenticator failed for H=([175.200.217.128]) [218.159.144.187]:47407: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-15 06:58:57 dovecot_login authenticator failed for H=([174.94.236.211]) [41.219.149.74]:15867: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-15 06:59:02 dovecot_login authenticator failed for H=(static.ill.117.250.19.91.bsnl.co.in) [119.192.219.77]:59154: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-15 07:03:18 dovecot_login authenticator failed for H=([192.252.208.66]) [182.95.189.66]:43372: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.220.90
country_id: 1269750
description:
2026-07-15 07:03:43 dovecot_login authenticator failed for H=([174.64.199.85]) [128.185.220.90]:45464: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-15 07:04:10 dovecot_login authenticator failed for H=(111-70-32-10.emome-ip.hinet.net) [188.122.37.97]:34782: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-15 07:04:38 dovecot_login authenticator failed for H=([183.6.115.88]) [218.159.144.187]:58671: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-15 07:04:42 dovecot_login authenticator failed for H=(hpot-141-39-221-152.rdns.hnet.measurement.network) [51.162.192.62]:46862: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 179.65.193.139
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:140861||Sizes:21||Combined size:21||User:globalgroupoman||WPU:||Filename:s9ex7ouq.txt||Scanned:/tmp//20260715-071027-alblC6x4lY1oDIYoZFkjUgAAAQw-file-XUu10W||SC:/home/globalgroupoman/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.224.81
country_id: 1269750
description:
2026-07-15 07:09:48 dovecot_login authenticator failed for H=([212.132.64.89]) [103.112.224.81]:45392: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 179.65.193.139
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:190586||Sizes:21||Combined size:21||User:globalgroupoman||WPU:||Filename:ghbzq6s7.txt||Scanned:/tmp//20260715-071027-alblCzQRgVDXbql2hLZexgAAABM-file-zAxlYR||SC:/home/globalgroupoman/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-15 07:16:05 dovecot_login authenticator failed for H=([103.230.176.152]) [152.52.198.42]:52242: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-15 07:16:23 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net (ip-199-102-107-147.hosts.zerolag.com) [68.7.114.69]:58394: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.187.230.168
country_id: 298795
description:
2026-07-15 07:19:37 dovecot_login authenticator failed for H=(www01.irishtitan.ul.zerolag.com) [78.187.230.168]:60267: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-15 07:20:02 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com (broadband-95-84-137-185.ip.moscow.rt.ru) [217.211.208.125]:57374: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-15 07:20:27 dovecot_login authenticator failed for H=([111.70.38.248]) [76.49.199.97]:53252: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-15 07:20:44 dovecot_login authenticator failed for H=([36.134.178.245]) [220.86.176.134]:47410: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77469916
abuser: 37.122.149.53
country_id: 6251999
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a5470.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2026-07-15 07:27:14 dovecot_login authenticator failed for H=([199.102.105.241]) [136.185.6.181]:60506: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.38.3.184
country_id: 2215636
description:
2026-07-15 07:27:30 dovecot_login authenticator failed for H=([142.54.231.33]) [102.38.3.184]:59483: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.76.71.82
country_id: 1269750
description:
2026-07-15 07:31:18 dovecot_login authenticator failed for H=([49.124.149.213]) [182.76.71.82]:40924: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.192
country_id: 2287781
description:
2026-07-15 07:31:30 dovecot_login authenticator failed for H=([212.104.70.143]) [160.154.84.192]:22631: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.152
country_id: 1835841
description:
2026-07-15 07:31:34 dovecot_login authenticator failed for H=([106.0.165.219]) [121.131.220.152]:54226: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.226.175
country_id: 2661886
description:
2026-07-15 07:37:08 dovecot_login authenticator failed for H=90-230-226-175-no2550.tbcn.telia.com (ipmapt-72-195-114-165.oc.oc.cox.net) [90.230.226.175]:33418: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce31mskkpc.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.114.8
country_id: 1668284
description:
2026-07-15 07:38:37 dovecot_login authenticator failed for H=110-25-114-8.adsl.fetnet.net ([36.92.174.85]) [110.25.114.8]:41515: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceqkrbdlwb.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 13.67.51.171
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-15 07:39:00 dovecot_login authenticator failed for H=([49.125.203.170]) [165.101.222.22]:50131: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.108.2
country_id: 1643084
description:
2026-07-15 07:40:19 dovecot_login authenticator failed for H=ns1.sinergi.net.id ([70.166.167.33]) [223.25.108.2]:44680: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2026-07-15 07:39:40 dovecot_login authenticator failed for H=([27.123.107.154]) [136.185.6.181]:58674: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: www.reach.ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ddgalaxy/reach.ddgalaxy.in/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 185.235.16.12
country_id: 163843
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://vird.co/go/syairangka\">Syair Togel Hari Ini</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.214.166.141
country_id: 1835841
domain: ibmctradeflow.com
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/ibmctradeflow/public_html/wp-includes||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-15 07:48:19 dovecot_login authenticator failed for H=([183.171.56.104]) [45.82.109.136]:38890: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-15 07:48:34 dovecot_login authenticator failed for H=([142.54.228.195]) [109.248.156.49]:34220: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.161.126
country_id: 99237
description:
2026-07-15 07:50:02 dovecot_login authenticator failed for H=([49.124.153.2]) [65.20.161.126]:40394: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.10.205
country_id: 1668284
description:
2026-07-15 07:50:57 dovecot_login authenticator failed for H=116-59-10-205.emome-ip.hinet.net ([49.124.149.48]) [116.59.10.205]:34604: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.255.189.50
country_id: 298795
description:
2026-07-15 07:51:38 dovecot_login authenticator failed for H=(pipenode.vds-host.org) [88.255.189.50]:34629: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-15 07:51:38 dovecot_login authenticator failed for H=(dsl-hkibng42-50dfc8-184.dhcp.inet.fi) [122.185.101.50]:59864: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.181.160.88
country_id: 2029969
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8d528496 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.57.125
country_id: 1668284
description:
2026-07-15 08:02:40 dovecot_login authenticator failed for H=221-120-57-125.emome-ip.hinet.net (187-51-198-202.customer.tdatabrasil.net.br) [221.120.57.125]:39738: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-15 08:07:06 dovecot_login authenticator failed for H=(5-100-120-147.ipoe.vladlink.net) [182.95.189.66]:41166: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-15 08:07:45 dovecot_login authenticator failed for H=(136-56-34-147.googlefiber.net) [125.23.203.138]:51774: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-15 08:10:55 dovecot_login authenticator failed for H=([218.4.110.186]) [182.95.123.50]:50288: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.218.21.212
country_id: 290557
domain: kallanigroup.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kallanigroup.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 162.212.170.230
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.Padel5000.com/\">slot depo 5k</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.200.168
country_id: 3437598
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b32872974 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.206
country_id: 1835841
description:
2026-07-15 08:21:29 dovecot_login authenticator failed for H=([220.78.112.243]) [218.156.93.206]:59779: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.193.147.183
country_id: 6252001
description:
2026-07-15 08:22:55 dovecot_login authenticator failed for H=(2-74-192-203.kcell.kz) [24.193.147.183]:41259: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 91.202.233.27
country_id: 1218197
domain: kallanigroup.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/kallanigroup/public_html/index.php||User:kallanigroup||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.20.229.150
country_id: 1269750
description:
2026-07-15 08:27:51 dovecot_plain authenticator failed for H=(bited) [125.20.229.150]:60932: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.221.130
country_id: 1269750
description:
2026-07-15 08:30:53 dovecot_login authenticator failed for H=([178.132.144.161]) [122.187.221.130]:54932: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.182.118
country_id: 1269750
description:
2026-07-15 08:30:43 dovecot_login authenticator failed for H=([199.58.184.102]) [125.19.182.118]:36896: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://fehse.blog/2014/12/owncloud-aktualisieren/\">\xe2\x80\x9cH\xe1\xbb\xa3p t\xc3\xa1c x\xc3\xa3 Khuy\xe1\xba\xbfn N\xc3\xb4ng\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.91.46.151
country_id: 6252001
description:
2026-07-15 08:44:28 dovecot_login authenticator failed for H=([49.124.131.248]) [173.91.46.151]:49774: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.228.194
country_id: 1269750
description:
2026-07-15 08:44:07 dovecot_login authenticator failed for H=([36.64.36.101]) [182.95.228.194]:59820: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-15 08:47:26 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl (203-221-144-203.tpgi.com.au) [89.67.39.124]:40848: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 91.202.233.27
country_id: 1218197
domain: keralapeople.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/keralapeople/public_html/index.php||User:keralapeople||WPU:||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.186.202.58
country_id: 1269750
description:
2026-07-15 08:47:49 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [122.186.202.58]:42950: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.114.40.60
country_id: 1835841
description:
2026-07-15 08:50:35 dovecot_login authenticator failed for H=([49.115.219.90]) [211.114.40.60]:59224: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-15 08:51:17 dovecot_login authenticator failed for H=([156.238.86.2]) [193.31.200.85]:48570: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 11009
name: WHM login success
abuser: 223.181.13.36
country_id: 1269750
description:
[2026-07-15 08:52:34 +0530] info [whostmgrd] 223.181.13.36 NEW root:glTkWeEktfkjZnro address=223.181.13.36,app=whostmgrd,creator=root,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 91.147.119.241
country_id: 1522867
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://elbashayer.com/%D9%85%D8%B1%D8%A7%D8%AC%D8%B9%D8%A7%D8%AA-%D8%A7%D9%8A-%D9%83%D9%8A%D9%88-%D8%A7%D9%88%D8%A8%D8%B4%D9%86-iq-option-%D9%88%D8%A7%D9%84%D8%AA%D8%AD%D9%84%D9%8A%D9%84-%D8%A7%D9%84%D8%A3%D9%85%D9%86/\">iq option is it legit</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.207.66.154
country_id: 6251999
description:
2026-07-15 08:57:35 dovecot_login authenticator failed for H=host-24-207-66-154.public.eastlink.ca ([191.44.113.143]) [24.207.66.154]:39982: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.131.76.71
country_id: 357994
description:
2026-07-15 08:57:52 dovecot_login authenticator failed for H=([111.26.106.117]) [213.131.76.71]:33860: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.65.30
country_id: 1835841
description:
2026-07-15 09:00:29 dovecot_login authenticator failed for H=(201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [219.248.65.30]:56009: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.41.207.112
country_id: 953987
description:
2026-07-15 09:01:05 dovecot_login authenticator failed for H=([174.64.199.74]) [196.41.207.112]:52021: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.134.97
country_id: 99237
description:
2026-07-15 09:01:48 dovecot_login authenticator failed for H=([220.126.215.120]) [65.20.134.97]:35799: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.197.220.5
country_id: 6252001
description:
2026-07-15 09:02:07 dovecot_login authenticator failed for H=(220-128-137-164.hinet-ip.hinet.net) [74.197.220.5]:43208: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-15 09:06:21 dovecot_login authenticator failed for H=([125.130.102.172]) [14.32.231.200]:64410: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.197.31.229
country_id: 3582678
description:
2026-07-15 09:06:50 dovecot_login authenticator failed for H=(reverse.anonet.in) [190.197.31.229]:37895: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 146.103.55.228
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:146.103.55.228||TA:146.103.55.228||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.173.211.201
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://maps.app.goo.gl/svba2GXJJii4D1Hw7\">dock building services</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-15 09:16:48 dovecot_login authenticator failed for H=(static.ill.61.2.246.139.bsnl.co.in) [122.187.230.250]:37770: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.130.210
country_id: 3865483
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5b2792850 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-rishikesh.html\">Rishikesh Call Girl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.251.0.147
country_id: 390903
description:
2026-07-15 09:33:28 dovecot_login authenticator failed for H=(server.first4systems.com) [212.251.0.147]:42281: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 129.222.206.235
country_id: 2328926
domain: www.ahsmarine.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:129.222.206.235||TA:129.222.206.235||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-15 09:35:26 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [102.210.148.41]:49806: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-15 09:36:02 dovecot_login authenticator failed for H=([36.138.44.211]) [210.5.117.238]:59371: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 62.60.130.228
country_id: 130758
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/images/images/images/images/images/cache.php||SC:/home/kallanigroup/public_html/images||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: metrodigitals.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/cucmabyt/fonts/gmuqgykz.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: kallanigroup.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/qkilgedo/fonts/ivqbdveq.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: cochinbigbandshow.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/vacqvspp/fonts/dovsqugi.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: keralapeople.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/mccgbuni/fonts/fsyhtarq.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: globalgroupoman.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/pruijzua/fonts/tmvdfpko.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: ddgalaxy.in
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/tujfrfpz/fonts/wixhbmwa.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-15 09:50:48 dovecot_login authenticator failed for H=(abts-north-static-238.45.176.122.airtelbroadband.in) [118.220.149.121]:33220: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-15 09:51:16 dovecot_login authenticator failed for H=([222.186.68.153]) [123.212.9.122]:60737: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: yukticlick.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/veldfyvl/fonts/frncnimm.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-15 09:51:45 dovecot_login authenticator failed for H=([119.200.244.102]) [197.219.228.242]:58420: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-15 09:52:52 dovecot_login authenticator failed for H=([192.111.138.28]) [220.72.198.61]:46372: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.89.208.174
country_id: 1605651
description:
2026-07-15 09:53:14 dovecot_login authenticator failed for H=([185.46.49.49]) [183.89.208.174]:46876: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: jaashsupplies.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/yldrtfae/fonts/aqxclxqx.PHP||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-07-15 09:55:18 dovecot_plain authenticator failed for H=(mindle) [109.226.27.227]:40303: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.226.138
country_id: 1269750
description:
2026-07-15 09:55:34 dovecot_login authenticator failed for H=([107.181.168.150]) [182.95.226.138]:57582: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.118
country_id: 1269750
description:
2026-07-15 09:55:45 dovecot_login authenticator failed for H=([49.124.152.22]) [182.95.106.118]:48368: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-15 09:56:23 dovecot_login authenticator failed for H=([182.95.88.181]) [38.108.83.2]:15362: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: ibmcglobal.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/pfbgycjb/fonts/ealquldh.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: travelinbh.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/pucriocl/fonts/ibiqbnuf.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: gsmex.global
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceq17lmn0i.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-15 10:03:31 dovecot_login authenticator failed for H=([49.124.151.83]) [188.122.37.97]:35662: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.197.31.229
country_id: 3582678
description:
2026-07-15 10:03:08 dovecot_login authenticator failed for H=([184.151.88.27]) [190.197.31.229]:37288: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: alnayza.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/idpkspnb/fonts/vwoywzra.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 141.255.164.66
country_id: 2658434
domain: fefkadirectorsunion.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/yvhhhert/fonts/khtrdhqo.PHP||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 169.224.36.229
country_id: 99237
domain: cochinbigbandshow.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:cochinbigbandsho||SC:/home/cochinbigbandsho/public_html/index.php||WPU:||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-15 10:07:09 dovecot_login authenticator failed for H=([125.19.163.58]) [175.203.199.118]:2440: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-15 10:08:09 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([72.223.188.94]) [200.105.141.172]:48198: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-15 10:08:23 dovecot_login authenticator failed for H=([27.110.176.222]) [220.77.214.59]:53671: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.218.50
country_id: 1269750
description:
2026-07-15 10:07:47 dovecot_login authenticator failed for H=(212-135-208-13.cyberverse.fun) [125.19.218.50]:38698: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.70.157.25
country_id: 6252001
description:
2026-07-15 10:12:13 dovecot_login authenticator failed for H=([110.25.110.135]) [152.70.157.25]:56636: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-15 10:14:06 dovecot_login authenticator failed for H=([144.24.209.174]) [103.163.44.10]:36104: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-15 10:14:18 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([210.204.28.60]) [83.208.70.70]:40956: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.181.23
country_id: 2661886
description:
2026-07-15 10:15:26 dovecot_login authenticator failed for H=c83-191-181-23.bredband.tele2.se ([184.185.2.1]) [83.191.181.23]:39024: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.155.175
country_id: 1733045
description:
2026-07-15 10:15:37 dovecot_login authenticator failed for H=([220.86.176.134]) [49.124.155.175]:57394: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: 220-mail.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/var/www/html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.116.171.98
country_id: 2510769
domain: jaashsupplies.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/jaashsupplies.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.126.227.5
country_id: 3017382
domain: www.jaashsupplies.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.jaashsupplies.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.47.132.66
country_id: 1643084
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-jnalmv-.htaccess||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.15.82.135
country_id: 798544
description:
2026-07-15 10:30:03 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [185.15.82.135]:43678: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-15 10:29:44 dovecot_login authenticator failed for H=([182.95.12.178]) [47.223.212.176]:46880: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-15 10:41:49 dovecot_login authenticator failed for H=([149.54.62.62]) [181.61.251.4]:45638: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-15 10:42:21 dovecot_login authenticator failed for H=([36.249.60.142]) [207.254.29.22]:58713: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.96.164.159
country_id: 290557
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/7b3241615 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-15 10:47:01 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([70.166.167.59]) [24.142.170.231]:58843: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.97.17.208
country_id: 1835841
description:
2026-07-15 10:46:45 dovecot_login authenticator failed for H=([70.166.167.33]) [61.97.17.208]:54493: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: www.metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/metrodigitals/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.32.17.8
country_id: 3017382
description:
2026-07-15 10:54:56 dovecot_login authenticator failed for H=vps-1f598509.vps.ovh.net ([112.27.38.203]) [213.32.17.8]:34964: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-15 10:55:18 dovecot_login authenticator failed for H=([142.54.235.12]) [51.162.192.62]:42118: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.17.181
country_id: 337996
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c43057282 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-07-15 11:10:23 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (imbulete) [73.199.161.144]:42056: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.190.89.138
country_id: 6252001
description:
2026-07-15 11:11:01 dovecot_login authenticator failed for H=(nsg-corporate-130.221.187.122.airtel.in) [50.190.89.138]:54493: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-15 11:11:31 dovecot_login authenticator failed for H=([142.54.228.195]) [182.95.119.30]:33092: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-15 11:12:25 dovecot_login authenticator failed for H=(47-143-208-202.fdr01.blpk.ca.ip.frontiernet.net) [201.46.124.0]:2628: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.217.40.11
country_id: 6252001
description:
2026-07-15 11:12:53 dovecot_login authenticator failed for H=([103.86.127.71]) [50.217.40.11]:40206: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.160.100
country_id: 6252001
description:
2026-07-15 11:15:25 dovecot_login authenticator failed for H=syn-024-105-160-100.biz.spectrum.com ([182.95.84.150]) [24.105.160.100]:36592: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-15 11:15:47 dovecot_login authenticator failed for H=([58.218.195.26]) [128.185.235.110]:43612: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.155.16.226
country_id: 953987
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e03467092 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-15 11:19:12 dovecot_login authenticator failed for H=([223.100.224.75]) [1.247.245.61]:39303: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.44.113.143
country_id: 798544
description:
2026-07-15 11:19:23 dovecot_login authenticator failed for H=(151.237.115.206.pronet.bg) [191.44.113.143]:42466: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.34.191.39
country_id: 2635167
description:
2026-07-15 11:19:30 dovecot_login authenticator failed for H=(62.36.19.41.static.abi.uni2.es) [149.34.191.39]:53794: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.53.106.124
country_id: 1694008
description:
2026-07-15 11:19:57 dovecot_login authenticator failed for H=([41.215.146.195]) [122.53.106.124]:39627: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-15 11:20:07 dovecot_login authenticator failed for H=(187-50-194-182.customer.tdatabrasil.net.br) [94.16.17.141]:46528: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.119
country_id: 1668284
description:
2026-07-15 11:25:29 dovecot_login authenticator failed for H=([65.20.163.103]) [101.13.4.119]:53204: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.171.74.60
country_id: 2635167
domain: alnayza.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:alnay||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.148.245.81
country_id: 2750405
domain: futuracare.com.au
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/database_backup.sql||User:futuracarecom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 81.171.74.60
country_id: 2635167
domain: alnayza.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/_vti_pvt/service.pwd||User:alnay||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-15 11:28:01 dovecot_login authenticator failed for H=([37.28.181.78]) [188.122.37.97]:44452: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-15 11:28:16 dovecot_login authenticator failed for H=([222.97.195.179]) [196.188.187.21]:48658: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-15 11:34:43 dovecot_login authenticator failed for H=([192.111.137.33]) [210.5.117.238]:62157: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.211.228
country_id: 1835841
description:
2026-07-15 11:35:02 dovecot_login authenticator failed for H=(62-20-205-17-no2360.tbcn.telia.com) [112.164.211.228]:41851: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-07-15 11:36:56 dovecot_login authenticator failed for H=([178.178.222.61]) [122.187.226.12]:40134: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.84.37.219
country_id: 3923057
description:
2026-07-15 11:37:18 dovecot_login authenticator failed for H=([58.57.154.146]) [138.84.37.219]:31374: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.197.174
country_id: 1835841
description:
2026-07-15 11:37:52 dovecot_login authenticator failed for H=([46.8.246.27]) [14.49.197.174]:58514: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.67.161.64
country_id: 2661886
description:
2026-07-15 11:39:01 dovecot_login authenticator failed for H=78-67-161-64-no2550.tbcn.telia.com ([49.124.159.192]) [78.67.161.64]:49744: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.33.227
country_id: 1269750
description:
2026-07-15 11:51:29 dovecot_login authenticator failed for H=([49.124.142.137]) [128.185.33.227]:47478: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_8c551dd4\":\"\",\"_94c25bd4\":\"\",\"status\":\"resolved_model\",\"reason\":-1,\"then\":\"$1:__proto__:then\",\"ns_bc848836\":\"idle\",\"_response\":{\"_prefix\":\"var tks=arguments[0x1];var df=tks;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.26
country_id: 1668284
description:
2026-07-15 11:56:31 dovecot_login authenticator failed for H=([192.111.138.28]) [101.13.5.26]:37106: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.159.191
country_id: 1733045
description:
2026-07-15 11:58:34 dovecot_login authenticator failed for H=(a4.ucndns.in) [49.124.159.191]:52300: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.123.87.143
country_id: 1835841
description:
2026-07-15 11:58:51 dovecot_login authenticator failed for H=([70.166.167.42]) [210.123.87.143]:59636: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-15 11:59:49 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([37.208.46.130]) [64.251.149.81]:39298: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.66.45.101
country_id: 2661886
description:
2026-07-15 11:59:49 dovecot_login authenticator failed for H=78-66-45-101-no2550.tbcn.telia.com ([111.26.62.38]) [78.66.45.101]:41992: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.1.80.17
country_id: 1835841
description:
2026-07-15 12:00:02 dovecot_login authenticator failed for H=(221-120-73-24.emome-ip.hinet.net) [121.1.80.17]:58828: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.250
country_id: 1269750
description:
2026-07-15 12:02:39 dovecot_login authenticator failed for H=([199.102.105.241]) [122.187.230.250]:42888: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-15 12:02:53 dovecot_login authenticator failed for H=([182.95.84.150]) [182.95.217.202]:35176: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.31.200.85
country_id: 1522867
description:
2026-07-15 12:03:06 dovecot_login authenticator failed for H=([74.119.144.57]) [193.31.200.85]:36392: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.16.192.32
country_id: 1835841
description:
2026-07-15 12:03:37 dovecot_login authenticator failed for H=([72.207.33.65]) [59.16.192.32]:45102: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.86
country_id: 1668284
description:
2026-07-15 12:15:04 dovecot_login authenticator failed for H=(2-55-75-176.orange.net.il) [101.13.6.86]:60036: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 57.159.30.22
country_id: 1269750
description:
[2026-07-15 12:17:38 +0530] info [whostmgrd] 57.159.30.22 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.106.49.149
country_id: 3932488
description:
2026-07-15 12:21:08 dovecot_login authenticator failed for H=([110.45.150.219]) [200.106.49.149]:59786: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.110.176.222
country_id: 1694008
description:
2026-07-15 12:21:26 dovecot_login authenticator failed for H=([222.252.24.6]) [27.110.176.222]:43081: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-15 12:25:13 dovecot_login authenticator failed for H=([68.71.240.212]) [24.187.213.29]:49422: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.58
country_id: 458258
domain: idealloanz.com.au
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:12-26.196.196.53.58||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.167.235.55
country_id: 6252001
description:
2026-07-15 12:26:37 dovecot_login authenticator failed for H=wsip-70-167-235-55.pn.at.cox.net ([196.189.51.64]) [70.167.235.55]:57186: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.176.21.104
country_id: 1269750
description:
2026-07-15 12:27:06 dovecot_login authenticator failed for H=(bl10-203-209.dsl.telepac.pt) [122.176.21.104]:43178: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-15 12:27:25 dovecot_login authenticator failed for H=(m121-202-138-181.smartone.com) [128.185.235.110]:52384: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-15 12:27:29 dovecot_login authenticator failed for H=(ipmapt-72-195-34-45.oc.oc.cox.net) [196.188.93.169]:2177: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.224.81
country_id: 1269750
description:
2026-07-15 12:27:47 dovecot_login authenticator failed for H=([31.173.8.170]) [103.112.224.81]:56887: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-07-15 12:28:03 dovecot_login authenticator failed for H=([59.24.131.89]) [65.20.250.180]:41233: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 41.233.149.132
country_id: 357994
description:
[2026-07-15 12:31:19 +0530] info [whostmgrd] 41.233.149.132 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.253.122
country_id: 1269750
description:
2026-07-15 12:34:52 dovecot_login authenticator failed for H=([183.6.44.239]) [128.185.253.122]:57968: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-15 12:35:25 dovecot_login authenticator failed for H=([95.35.26.164]) [197.219.210.94]:51394: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 84.201.4.212
country_id: 2921044
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/web.config||User:ddgalaxy||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-15 12:37:31 dovecot_login authenticator failed for H=(host-96-30-129-156.public.eastlink.ca) [197.219.210.94]:59510: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 202.88.209.51
country_id: 1269750
description:
2026-07-15 12:40:01 dovecot_login authenticator failed for H=([103.161.93.53]) [202.88.209.51]:59236: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-15 12:40:33 dovecot_login authenticator failed for H=(wsip-184-178-172-12.rn.hr.cox.net) [122.160.15.31]:45311: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.241.64.237
country_id: 1835841
description:
2026-07-15 12:40:56 dovecot_login authenticator failed for H=(mx-ll-223.204.203-127.dynamic.3bb.in.th) [1.241.64.237]:44502: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-15 12:41:31 dovecot_login authenticator failed for H=([216.16.101.175]) [182.95.106.138]:46178: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-15 12:41:45 dovecot_login authenticator failed for H=([174.75.211.204]) [182.78.86.62]:41424: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.111.148.83
country_id: 1835841
description:
2026-07-15 12:48:24 dovecot_login authenticator failed for H=(179.185.69.43.static.gvt.net.br) [222.111.148.83]:50313: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.39.124
country_id: 798544
description:
2026-07-15 12:48:35 dovecot_login authenticator failed for H=89-67-39-124.dynamic.play.pl (ip-199-102-107-147.hosts.zerolag.com) [89.67.39.124]:37992: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.12.212.38
country_id: 1835841
description:
2026-07-15 12:48:09 dovecot_login authenticator failed for H=(bl10-203-209.dsl.telepac.pt) [59.12.212.38]:44628: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.158
country_id: 1668284
description:
2026-07-15 12:48:22 dovecot_login authenticator failed for H=111-70-29-158.emome-ip.hinet.net ([175.200.178.138]) [111.70.29.158]:51509: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-15 12:48:42 dovecot_login authenticator failed for H=([189.20.109.209]) [125.138.166.217]:47450: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.28.66.246
country_id: 286963
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2f2066577 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 209.141.34.121
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_dcarzi_fm.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-jaipur.html\">Jaipur call girls</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.217.149.252
country_id: 587116
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b73317264 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-15 13:06:53 dovecot_login authenticator failed for H=([186.239.41.74]) [182.95.176.122]:52928: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.251.149.81
country_id: 6252001
description:
2026-07-15 13:13:09 dovecot_login authenticator failed for H=64-251-149-81.fidnet.com ([192.111.134.12]) [64.251.149.81]:34796: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.222.246.217
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/e22871700 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-15 13:22:37 dovecot_plain authenticator failed for H=(propens) [51.162.192.62]:51307: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.65.134.51
country_id: 2921044
description:
2026-07-15 13:23:29 dovecot_login authenticator failed for H=176.65.134.51.ptr.pfcloud.network (9wolf.pw) [176.65.134.51]:37596: 535 Incorrect authentication data (set_id=david.white@stcinemas.co)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 223.181.13.36
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: Special shell symbol in request||MV:director-photo|FULLPATH}||MVN:REQUEST_URI||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 223.181.13.36
country_id: 1269750
domain: fefkadirectorsunion.com
description:
IM360 WAF: Special shell symbol in request||MV:contact-person}||MVN:ARGS:jform[emailreceipttext]||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.0.127.22
country_id: 1835841
description:
2026-07-15 13:27:20 dovecot_login authenticator failed for H=(ns1.sinergi.net.id) [59.0.127.22]:45856: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.30
country_id: 1269750
description:
2026-07-15 13:26:53 dovecot_login authenticator failed for H=([184.181.217.198]) [27.123.113.30]:42842: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.44.71.176
country_id: 798544
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f33286758 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.191.210
country_id: 99237
description:
2026-07-15 13:31:29 dovecot_plain authenticator failed for H=(coary) [65.20.191.210]:38258: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-15 13:36:53 dovecot_login authenticator failed for H=(fabfibernet.com) [95.82.7.89]:52088: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.104.76.94
country_id: 1835841
description:
2026-07-15 13:37:20 dovecot_login authenticator failed for H=([219.146.75.30]) [222.104.76.94]:36936: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: idealloanz.com.au
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.86.176.134
country_id: 1835841
description:
2026-07-15 13:40:30 dovecot_login authenticator failed for H=([106.246.89.68]) [220.86.176.134]:43368: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-15 13:40:53 dovecot_login authenticator failed for H=([197.219.228.246]) [59.23.3.146]:45448: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.153.3.166
country_id: 6252001
description:
2026-07-15 13:43:52 dovecot_plain authenticator failed for H=c-73-153-3-166.hsd1.co.comcast.net (burass) [73.153.3.166]:47118: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-07-15 13:43:56 dovecot_plain authenticator failed for H=(shistat) [75.97.190.237]:58771: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 173.225.100.133
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://wiki.familie-rosche.de/index.php?title=User:JosieLynn64\">automotive furniture</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 15.204.114.164
country_id: 6252001
domain: futuracare.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:galexbot-kb19fg0n.xml.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: interceptorglobal.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/interceptorgloba/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.241.232.14
country_id: 2921044
description:
2026-07-15 13:53:00 dovecot_login authenticator failed for H=p5df1e80e.dip0.t-ipconnect.de ([36.135.92.35]) [93.241.232.14]:39176: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.205.149.72
country_id: 1269750
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:40959.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:d41415a8b4dcdf2d89c6bcf92432f9e551333593||Title:3f7jeuqxl0hx55ajm||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-15 13:55:59 dovecot_login authenticator failed for H=(isp-31-222-7-68.saowifi.net) [74.209.100.246]:58340: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.32.68.66
country_id: 1835841
description:
2026-07-15 13:56:16 dovecot_login authenticator failed for H=([65.20.163.103]) [61.32.68.66]:48564: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: ahsmarine.com
description:


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.196.53.58
country_id: 458258
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:13-57.196.196.53.58||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.187.213.29
country_id: 6252001
description:
2026-07-15 14:02:25 dovecot_plain authenticator failed for H=(ousneerion) [24.187.213.29]:56980: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-15 14:02:56 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.42.61.64
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/3c2402390 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.25
country_id: 1668284
description:
2026-07-15 14:08:19 dovecot_login authenticator failed for H=110-25-107-25.adsl.fetnet.net (122.6.190.94.interra.ru) [110.25.107.25]:52551: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2026-07-15 14:08:45 dovecot_login authenticator failed for H=(177-0-238-161.bnut3703.dsl.brasiltelecom.net.br) [136.185.6.181]:59118: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.184.52.16
country_id: 1835841
description:
2026-07-15 14:14:50 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [112.184.52.16]:49895: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.227.94
country_id: 1269750
description:
2026-07-15 14:16:04 dovecot_login authenticator failed for H=(45-181-101-92.plugartelecom.net.br) [152.52.227.94]:41182: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.126.215.120
country_id: 1835841
description:
2026-07-15 14:16:40 dovecot_login authenticator failed for H=(223-197-166-78.static.imsbiz.com) [220.126.215.120]:34134: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.44.10
country_id: 1269750
description:
2026-07-15 14:19:25 dovecot_login authenticator failed for H=([70.166.167.58]) [103.163.44.10]:56826: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.108.83.2
country_id: 6251999
description:
2026-07-15 14:20:08 dovecot_login authenticator failed for H=([68.71.247.133]) [38.108.83.2]:45925: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.110.237.58
country_id: 1269750
description:
2026-07-15 14:25:57 dovecot_plain authenticator failed for H=(voete) [103.110.237.58]:9608: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 57.159.30.22
country_id: 1269750
description:
[2026-07-15 14:26:59 +0530] info [whostmgrd] 57.159.30.22 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.208.48.130
country_id: 1168579
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/ab2311017 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.107.172
country_id: 1668284
description:
2026-07-15 14:38:53 dovecot_login authenticator failed for H=110-25-107-172.adsl.fetnet.net (firewall01.practicetechnologies.ml.zerolag.com) [110.25.107.172]:59234: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.146.238.122
country_id: 2542007
description:
2026-07-15 14:40:17 dovecot_login authenticator failed for H=([65.20.198.159]) [154.146.238.122]:53218: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-15 14:42:04 dovecot_login authenticator failed for H=([121.202.146.144]) [206.62.136.109]:50418: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-15 14:42:18 dovecot_login authenticator failed for H=([70.166.167.49]) [65.20.233.110]:51068: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 107.2.22.2
country_id: 6252001
description:
2026-07-15 14:43:58 dovecot_plain authenticator failed for H=c-107-2-22-2.hsd1.az.comcast.net (galinsem) [107.2.22.2]:56842: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.148.194
country_id: 99237
description:
2026-07-15 14:44:01 dovecot_plain authenticator failed for H=(affum) [65.20.148.194]:42118: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-15 14:44:24 dovecot_login authenticator failed for H=([111.26.106.118]) [182.95.106.138]:35860: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-07-15 14:45:49 dovecot_login authenticator failed for H=(undefined.hostname.localhost) [182.95.230.74]:57030: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-15 14:46:02 dovecot_login authenticator failed for H=([14.38.177.105]) [103.176.160.146]:40082: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.104.24.6
country_id: 3923057
description:
2026-07-15 14:46:09 dovecot_login authenticator failed for H=([49.125.201.84]) [190.104.24.6]:58922: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.249.195
country_id: 1835841
description:
2026-07-15 14:46:21 dovecot_login authenticator failed for H=([60.172.23.9]) [119.192.249.195]:54192: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.189.17.35
country_id: 298795
description:
2026-07-15 14:48:27 dovecot_login authenticator failed for H=([149.54.62.58]) [78.189.17.35]:49357: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 198.57.172.249
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:cve-2026-48907-426v.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.73.230.102
country_id: 6252001
description:
2026-07-15 14:54:19 dovecot_login authenticator failed for H=65-73-230-102.3457ff10b7f3305facc44dbac08ed40f.ip.frontiernet.net ([128.185.208.42]) [65.73.230.102]:58040: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.10.205
country_id: 1668284
description:
2026-07-15 14:54:24 dovecot_login authenticator failed for H=116-59-10-205.emome-ip.hinet.net ([117.216.33.31]) [116.59.10.205]:37336: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.158.2
country_id: 1269750
description:
2026-07-15 14:54:56 dovecot_login authenticator failed for H=(209.66.246.220.static.netvigator.com) [125.19.158.2]:36120: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-15 14:58:45 dovecot_login authenticator failed for H=([60.174.39.82]) [197.219.228.246]:49348: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.209.100.246
country_id: 6252001
description:
2026-07-15 14:59:25 dovecot_login authenticator failed for H=(22.69.85.194.in-addr.arpa) [74.209.100.246]:34858: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-15 15:01:06 dovecot_login authenticator failed for H=(201-200-93-6.mad-05-p64.cantv.net.93.208.201.in-addr.arpa) [94.16.17.140]:59312: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-15 15:01:19 dovecot_login authenticator failed for H=([174.75.211.198]) [128.185.235.110]:55616: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77469916
abuser: 175.100.79.76
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce6ub4idl0.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-15 15:02:38 dovecot_login authenticator failed for H=([61.184.128.210]) [206.62.136.109]:59440: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-15 15:02:39 dovecot_login authenticator failed for H=([36.154.134.146]) [183.82.108.109]:60254: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.46.115
country_id: 6252001
description:
2026-07-15 15:02:51 dovecot_login authenticator failed for H=wsip-72-215-46-115.pn.at.cox.net ([116.171.27.248]) [72.215.46.115]:45814: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-15 15:03:06 dovecot_login authenticator failed for H=([174.64.199.77]) [50.212.27.150]:42988: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.135.208.32
country_id: 1861060
description:
2026-07-15 15:06:37 dovecot_login authenticator failed for H=(physicohsm.physico.cloud) [212.135.208.32]:54617: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.3.122
country_id: 1668284
description:
2026-07-15 15:06:26 dovecot_login authenticator failed for H=111-70-3-122.emome-ip.hinet.net (176-111-152-79.airmax.pl) [111.70.3.122]:50520: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.146.166
country_id: 1269750
description:
2026-07-15 15:06:56 dovecot_login authenticator failed for H=([70.166.167.35]) [122.185.146.166]:56586: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-15 15:18:50 dovecot_login authenticator failed for H=(134396.ip-ptr.tech) [203.192.211.180]:39482: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.39.140.2
country_id: 1835841
description:
2026-07-15 15:19:18 dovecot_login authenticator failed for H=([49.124.151.82]) [36.39.140.2]:59393: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77469916
abuser: 45.61.187.50
country_id: 6252001
domain: ns1.ddgalaxy.in
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce_zzdayf.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.102.190
country_id: 1269750
description:
2026-07-15 15:21:54 dovecot_login authenticator failed for H=([180.94.75.42]) [182.95.102.190]:36026: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.80.65.214
country_id: 6252001
description:
2026-07-15 15:22:58 dovecot_login authenticator failed for H=syn-075-080-065-214.biz.spectrum.com ([182.95.61.82]) [75.80.65.214]:55878: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.157.133.155
country_id: 1835841
description:
2026-07-15 15:23:18 dovecot_login authenticator failed for H=([186.233.71.79]) [218.157.133.155]:38390: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.158.208.139
country_id: 1668284
description:
2026-07-15 15:22:41 dovecot_login authenticator failed for H=([182.95.12.178]) [49.158.208.139]:60128: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-15 15:22:50 dovecot_login authenticator failed for H=(111-70-23-253.emome-ip.hinet.net) [197.219.228.246]:48808: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-15 15:23:50 dovecot_login authenticator failed for H=(nsg-static-217.97.72.182.airtel.in) [103.176.160.146]:47018: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-15 15:28:17 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [182.95.176.122]:48834: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-15 15:30:43 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([196.189.126.10]) [50.121.186.125]:61893: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.215.37.98
country_id: 6252001
description:
2026-07-15 15:30:49 dovecot_login authenticator failed for H=wsip-72-215-37-98.pn.at.cox.net (eth1.1172.vrrp.fw05.1739.la3.ml.zerolag.com) [72.215.37.98]:33854: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.233.110
country_id: 99237
description:
2026-07-15 15:31:21 dovecot_login authenticator failed for H=([110.227.211.82]) [65.20.233.110]:41392: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.34
country_id: 1269750
description:
2026-07-15 15:31:56 dovecot_plain authenticator failed for H=(lusees) [182.95.181.34]:39028: 535 Incorrect authentication data (set_id=info@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-15 15:35:28 dovecot_login authenticator failed for H=a4.ucndns.in ([192.252.210.237]) [103.252.168.4]:53243: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-15 15:35:48 dovecot_login authenticator failed for H=([183.171.61.218]) [122.185.101.50]:53634: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-15 15:39:42 dovecot_login authenticator failed for H=([65.20.233.110]) [122.160.11.40]:48426: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.247.82.240
country_id: 1269750
description:
2026-07-15 15:40:24 dovecot_login authenticator failed for H=(nsg-corporate-150.65.185.122.airtel.in) [117.247.82.240]:55010: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.248.4.146
country_id: 1835841
description:
2026-07-15 15:43:45 dovecot_login authenticator failed for H=([192.252.208.66]) [219.248.4.146]:35422: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.132.53
country_id: 1733045
description:
2026-07-15 15:44:26 dovecot_login authenticator failed for H=([49.124.149.214]) [49.124.132.53]:57026: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.180
country_id: 99237
description:
2026-07-15 15:45:10 dovecot_login authenticator failed for H=([107.181.161.85]) [65.20.250.180]:53794: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-15 15:46:14 dovecot_login authenticator failed for H=([46.163.174.216]) [203.252.10.3]:34776: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat||User:fefkadirectors||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.195.39.148
country_id: 3017382
domain: elegantautomotives.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/elegantautomotiv/public_html/images/images||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.dat.bak||User:fefkadirectors||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.119.36.72
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:15-48.92.119.36.72||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.23.136.109
country_id: 1831722
domain: fefkadirectorsunion.com
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/defunct.bak||User:fefkadirectors||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.5.205.174
country_id: 6252001
description:
2026-07-15 15:49:57 dovecot_login authenticator failed for H=ip-50-5-205-174.dynamic.fuse.net ([119.200.229.33]) [50.5.205.174]:34100: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.101.182
country_id: 1269750
description:
2026-07-15 15:49:41 dovecot_login authenticator failed for H=([61.36.134.212]) [182.95.101.182]:40964: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.86
country_id: 1036973
description:
2026-07-15 15:53:10 dovecot_login authenticator failed for H=([116.114.84.246]) [197.219.210.86]:33546: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.252.168.4
country_id: 1269750
description:
2026-07-15 15:53:22 dovecot_login authenticator failed for H=a4.ucndns.in ([180.100.212.177]) [103.252.168.4]:46042: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-15 15:53:36 dovecot_login authenticator failed for H=([172.167.156.153]) [207.254.29.22]:63937: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-15 15:54:56 dovecot_login authenticator failed for H=([112.28.153.193]) [121.128.84.224]:47088: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 23.180.120.148
country_id: 6252001
domain: ns2.ddgalaxy.in
description:
IM360 WAF: Special shell symbol in request||MV:+\xec]\xafl\xe8,r-lq\x98.B\xea\xe3(=\xbe\xc1\xbcWX tv\xa2.\x11\xcc\x87\xd8Q`\xd5X\xc7\x01\x17a\xbb\xb4\x8e\x0f\xc22G\xf7\xfa\xf0\xe5\xd9\x8a\xae\x05/\xfa~\x84}||MVN:ARGS:binary_wexommwq||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 23.180.120.148
country_id: 6252001
domain: ns2.ddgalaxy.in
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:\\u007b\"_res\\u0070\\u006fnse\\u0022:\\u007b\"_chu\\u006e\\u006bs\":\"$Q2\",\"\\u005ffo\\u0072m\\u0044a\\u0074\\u0061\":{\"ge\\u0074\"\\u003a\"$1:\\u0063onstructor\\u003a\\u0063o\\u006e\\u0073\\u0074\\u0072uctor\"},\"\\u005fpr\\u0065fi\\u0078\":\"v\\u0061r _\\u006cska=\\\"test\\u005c\";t\\u0068\\u0072ow Obj\\u0065ct.assign(new \\u0045rro\\u0072('\\u004e\\u0045\\u0058T_RE\\u0044I\\u0052E\\u0043T'),\\u007bd\\u0069gest:\\u005fl\\u0073\\u006b\\u0061})\\u003b\"},\"r\\u0065a\\u0073\\u006fn\":-\\u0031,\\u0022\\u0073tatu\\u0073\\u0022:\\u0022reso\\u006cv\\u0065d_m\\u006f\\u0064el\",\"\\u0074\\u0068\\u0065n\":\"\\u0024\\u0031:__proto__:\\u0074hen\",\\u0022val\\u0075e\\u0022:\"{\\\"th\\u0065n\\\\u0022:\\\"$B1\\u00333\\u0037\\\"}\"}||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.201.89.129
country_id: 357994
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c02942923 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.251.41
country_id: 99237
description:
2026-07-15 16:07:16 dovecot_login authenticator failed for H=([182.78.199.185]) [65.20.251.41]:37341: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.67.106.221
country_id: 3686110
description:
2026-07-15 16:09:24 dovecot_login authenticator failed for H=(166.200-59-41.ttcl.co.tz) [190.67.106.221]:52126: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.12.42.216
country_id: 6252001
description:
2026-07-15 16:09:43 dovecot_login authenticator failed for H=([182.95.150.106]) [71.12.42.216]:42354: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.15.98
country_id: 1269750
description:
2026-07-15 16:10:01 dovecot_login authenticator failed for H=([210.222.75.179]) [103.225.15.98]:39376: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.210.94
country_id: 1036973
description:
2026-07-15 16:10:19 dovecot_login authenticator failed for H=([111.198.53.188]) [197.219.210.94]:55908: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.208.89.91
country_id: 1819730
domain: ibmctradeflow.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/2021/02/index.php||SC:/home/ibmctradeflow/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.241.142.170
country_id: 3865483
description:
2026-07-15 16:15:34 dovecot_login authenticator failed for H=(static.ill.117.250.107.180.bsnl.co.in) [191.241.142.170]:60150: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.226.12
country_id: 1269750
description:
2026-07-15 16:15:20 dovecot_login authenticator failed for H=([103.79.16.52]) [122.187.226.12]:34556: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77469916
abuser: 107.170.3.52
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:masta6sh4do.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.188.204.213
country_id: 6252001
description:
2026-07-15 16:22:29 dovecot_login authenticator failed for H=([98.182.171.163]) [50.188.204.213]:56710: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.73
country_id: 1733045
description:
2026-07-15 16:21:46 dovecot_login authenticator failed for H=(nsg-corporate-129.229.187.122.airtel.in) [49.125.201.73]:52606: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.221.144.203
country_id: 2077456
description:
2026-07-15 16:21:54 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [203.221.144.203]:38052: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.30.223.119
country_id: 1835841
description:
2026-07-15 16:22:25 dovecot_login authenticator failed for H=(nsg-corporate-201.0.185.122.airtel.in) [114.30.223.119]:40923: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.38.53
country_id: 1668284
description:
2026-07-15 16:23:56 dovecot_login authenticator failed for H=111-70-38-53.emome-ip.hinet.net (vps-36f1e8f3.vps.ovh.net) [111.70.38.53]:57259: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.65.73.22
country_id: 1835841
description:
2026-07-15 16:25:26 dovecot_login authenticator failed for H=([220.189.196.134]) [58.65.73.22]:47978: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.54.99.50
country_id: 294640
description:
2026-07-15 16:25:45 dovecot_login authenticator failed for H=([207.254.71.129]) [2.54.99.50]:40622: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.150.226.139
country_id: 1835841
description:
2026-07-15 16:28:13 dovecot_login authenticator failed for H=(227.42.246.220.static.netvigator.com) [218.150.226.139]:19190: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.46.20.8
country_id: 1835841
description:
2026-07-15 16:28:28 dovecot_login authenticator failed for H=([124.195.255.12]) [14.46.20.8]:45222: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.112.224.81
country_id: 1269750
description:
2026-07-15 16:29:49 dovecot_login authenticator failed for H=([24.249.199.9]) [103.112.224.81]:34376: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.54.165.138
country_id: 3686110
description:
2026-07-15 16:30:11 dovecot_login authenticator failed for H=([65.20.143.45]) [181.54.165.138]:33578: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.72.9.151
country_id: 1269750
description:
2026-07-15 16:30:38 dovecot_login authenticator failed for H=([49.124.147.252]) [116.72.9.151]:58888: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.165.91.5
country_id: 1269750
description:
2026-07-15 16:30:54 dovecot_login authenticator failed for H=([198.8.94.171]) [122.165.91.5]:52290: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.148.192
country_id: 1733045
description:
2026-07-15 16:41:38 dovecot_login authenticator failed for H=(143.38.109.208.host.secureserver.net) [49.124.148.192]:48834: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.240.110
country_id: 1835841
description:
2026-07-15 16:40:41 dovecot_login authenticator failed for H=([199.116.114.10]) [112.164.240.110]:37623: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.210.148.41
country_id: 953987
description:
2026-07-15 16:40:57 dovecot_login authenticator failed for H=([36.163.227.186]) [102.210.148.41]:50174: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.234
country_id: 1733045
description:
2026-07-15 16:41:39 dovecot_login authenticator failed for H=(aes-static-225.77.144.59.airtel.in) [49.124.152.234]:52284: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.23.3.146
country_id: 1835841
description:
2026-07-15 16:42:32 dovecot_login authenticator failed for H=([200.199.32.174]) [59.23.3.146]:46896: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.212.29
country_id: 2661886
description:
2026-07-15 16:42:01 dovecot_login authenticator failed for H=90-230-212-29-no2550.tbcn.telia.com ([14.35.209.208]) [90.230.212.29]:43690: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-15 16:42:01 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [197.219.228.242]:38586: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.196.213.196
country_id: 1835841
description:
2026-07-15 16:47:05 dovecot_login authenticator failed for H=(93.102.230.82.rev.optimus.pt) [119.196.213.196]:45930: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.15.31
country_id: 1269750
description:
2026-07-15 16:47:23 dovecot_login authenticator failed for H=(wsip-24-120-10-18.lv.lv.cox.net) [122.160.15.31]:54889: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: modsec
rule: 77209353
abuser: 64.44.142.166
country_id: 6252001
domain: www.ogocindia.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/en/index.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: gsmex.global
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/gsmex/public_html/wp-content||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-mussoorie.html\">Mussoorie Call Girl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 179.65.193.139
country_id: 1643084
domain: fefkadirectorsunion.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:144839||Sizes:21||Combined size:21||User:fefkadirectors||WPU:||Filename:y5g6io06.txt||Scanned:/tmp//20260715-165626-alduYtiT8ry-AALXhAI7cwAAAUQ-file-aRAlVD||SC:/home/fefkadirectors/public_html/index.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.62.203
country_id: 6252001
description:
2026-07-15 16:57:00 dovecot_login authenticator failed for H=wsip-68-225-62-203.pn.at.cox.net ([196.188.187.21]) [68.225.62.203]:42601: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.203.17.220
country_id: 6252001
description:
2026-07-15 16:57:23 dovecot_login authenticator failed for H=c-73-203-17-220.hsd1.co.comcast.net ([189.108.156.41]) [73.203.17.220]:53730: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77562133
name: IM360 WAF: File upload on Joomla iCagenda endpoint - tracking (CVE-2026-48939)
abuser: 95.181.173.36
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: File upload on Joomla iCagenda endpoint - tracking (CVE-2026-48939)||MVN:FILES:jform[attachment]||MV:check_ryzfhycl.txt||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.83.114.193
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/0b186570 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77562133
name: IM360 WAF: File upload on Joomla iCagenda endpoint - tracking (CVE-2026-48939)
abuser: 95.181.173.36
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: File upload on Joomla iCagenda endpoint - tracking (CVE-2026-48939)||MVN:FILES:jform[attachment]||MV:check_mfsexpvq.txt||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.197.220.5
country_id: 6252001
description:
2026-07-15 17:00:12 dovecot_login authenticator failed for H=(abts-north-static-155.50.160.122.airtelbroadband.in) [74.197.220.5]:43122: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.133.97.153
country_id: 6252001
description:
2026-07-15 17:00:25 dovecot_login authenticator failed for H=c-76-133-97-153.hsd1.ca.comcast.net (red.138.118.213.204.ssservicios.com.ar) [76.133.97.153]:34223: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.179.11.115
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:32319.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:097c8a14a3daceec0c1536062b5f065924fd3a0b||Title:0xc19e6f9f||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.163.58
country_id: 1269750
description:
2026-07-15 17:05:10 dovecot_login authenticator failed for H=([182.95.20.55]) [125.19.163.58]:42238: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.101.50
country_id: 1269750
description:
2026-07-15 17:05:24 dovecot_login authenticator failed for H=(210.4.68-73.bdcom.com) [122.185.101.50]:38432: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.51.62
country_id: 3895114
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/2d2689480 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.228.229.182
country_id: 2661886
description:
2026-07-15 17:06:23 dovecot_login authenticator failed for H=90-228-229-182-no600.tbcn.telia.com ([27.39.128.127]) [90.228.229.182]:43888: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-15 17:07:00 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net ([49.124.151.71]) [68.7.114.69]:34798: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.189.51.64
country_id: 337996
description:
2026-07-15 17:07:24 dovecot_login authenticator failed for H=(111-70-23-248.emome-ip.hinet.net) [196.189.51.64]:34356: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-15 17:09:11 dovecot_login authenticator failed for H=([119.200.229.33]) [118.220.149.121]:44510: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-15 17:11:28 dovecot_login authenticator failed for H=([197.242.170.10]) [116.98.104.138]:35118: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.83.23.169
country_id: 1168579
description:
2026-07-15 17:10:44 dovecot_login authenticator failed for H=([182.95.87.80]) [103.83.23.169]:37034: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.228.198.230
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b41958900 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.252.10.3
country_id: 1835841
description:
2026-07-15 17:13:51 dovecot_login authenticator failed for H=([114.100.48.120]) [203.252.10.3]:46234: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.232.153.182
country_id: 3865483
description:
2026-07-15 17:14:05 dovecot_login authenticator failed for H=(abts-north-static-238.45.176.122.airtelbroadband.in) [24.232.153.182]:56276: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.116.117.203
country_id: 2921044
description:
2026-07-15 17:14:14 dovecot_login authenticator failed for H=([70.166.167.58]) [51.116.117.203]:34133: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-15 17:14:25 dovecot_login authenticator failed for H=(82-102-188-117.orange.net.il) [182.95.119.30]:34074: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.77.156.32
country_id: 1269750
domain: www.cochinbigbandshow.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cochinbigbandshow.com/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-15 17:16:44 dovecot_login authenticator failed for H=([171.244.60.35]) [103.250.160.76]:44422: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-15 17:16:59 dovecot_login authenticator failed for H=(ip-104-37-133-100.hosts.zerolag.com) [103.90.27.83]:43814: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.250.250.2
country_id: 1269750
description:
2026-07-15 17:18:21 dovecot_login authenticator failed for H=([114.202.80.152]) [117.250.250.2]:33622: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.195.39.148
country_id: 3017382
domain: ddgalaxy.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/ddgalaxy/public_html/images/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.217.102
country_id: 1861060
domain: alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/goods.php||SC:/home/alnay/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.190.231.137
country_id: 298795
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c42836290 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: www.reach.ddgalaxy.in
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-15 17:27:38 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([182.95.178.174]) [82.209.148.60]:57182: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-15 17:27:59 dovecot_login authenticator failed for H=([121.131.220.168]) [98.157.226.42]:59807: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-15 17:28:28 dovecot_login authenticator failed for H=([94.16.17.140]) [23.30.11.253]:57303: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.56.12
country_id: 1269750
description:
2026-07-15 17:28:37 dovecot_login authenticator failed for H=([31.173.2.182]) [183.82.56.12]:65387: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-07-15 17:32:15 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [90.173.78.90]:51042: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 209.141.34.121
country_id: 6252001
domain: metrodigitals.com
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icomersqc/fonts/fwawgyh.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-15 17:32:30 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se ([116.38.54.26]) [89.253.90.113]:38666: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.15.98
country_id: 1269750
description:
2026-07-15 17:36:09 dovecot_login authenticator failed for H=([98.181.137.69]) [103.225.15.98]:45144: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.167.186.25
country_id: 1282988
domain: ahsmarine.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahsmarine.com/category/facelift/index.html HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.240.94
country_id: 1269750
description:
2026-07-15 17:43:26 dovecot_login authenticator failed for H=(ppp075.bol-online.com) [182.78.240.94]:45664: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.149.204
country_id: 1733045
description:
2026-07-15 17:44:05 dovecot_login authenticator failed for H=(115.150.48.116.static.netvigator.com) [49.124.149.204]:36796: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.55.79.195
country_id: 337996
description:
2026-07-15 17:47:11 dovecot_login authenticator failed for H=([49.124.153.14]) [213.55.79.195]:37724: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.219.149.74
country_id: 2328926
description:
2026-07-15 17:47:25 dovecot_login authenticator failed for H=([182.90.248.108]) [41.219.149.74]:17103: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-15 17:53:21 dovecot_login authenticator failed for H=([36.135.103.29]) [144.24.209.174]:61200: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.191.11
country_id: 2661886
description:
2026-07-15 17:53:31 dovecot_login authenticator failed for H=82-209-191-11.cust.bredband2.com (c83-255-209-245.bredband.tele2.se) [82.209.191.11]:46540: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.255.134
country_id: 1269750
description:
2026-07-15 17:55:03 dovecot_login authenticator failed for H=(90-228-229-182-no600.tbcn.telia.com) [125.23.255.134]:53322: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.7.114.69
country_id: 6252001
description:
2026-07-15 17:55:53 dovecot_login authenticator failed for H=ip68-7-114-69.sd.sd.cox.net (testmft.sedgwick.com) [68.7.114.69]:49538: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.93.203
country_id: 1835841
description:
2026-07-15 18:03:35 dovecot_login authenticator failed for H=([117.244.16.6]) [218.156.93.203]:45305: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.56.12.205
country_id: 1168579
description:
2026-07-15 18:04:03 dovecot_login authenticator failed for H=([180.94.75.90]) [210.56.12.205]:40662: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 188.253.208.59
country_id: 587116
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85955.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:ff443912f399c6dc92e4a0f2e5776dc1574842f6||Title:fxqruor1uytoqau2w2||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.142.170.231
country_id: 6252001
description:
2026-07-15 18:05:06 dovecot_login authenticator failed for H=syn-024-142-170-231.biz.spectrum.com ([82.162.56.186]) [24.142.170.231]:38669: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.104.220.195
country_id: 1835841
description:
2026-07-15 18:05:22 dovecot_login authenticator failed for H=([49.124.151.57]) [183.104.220.195]:42992: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.80.105
country_id: 1269750
description:
2026-07-15 18:05:34 dovecot_login authenticator failed for H=(mx0.vdk.ru) [122.160.80.105]:54989: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77469916
abuser: 203.83.39.23
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcexniiesag.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.90.111.74
country_id: 1269750
description:
2026-07-15 18:07:24 dovecot_login authenticator failed for H=([70.166.167.58]) [59.90.111.74]:33488: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-15 18:07:37 dovecot_login authenticator failed for H=([210.117.11.71]) [197.219.208.58]:49120: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-15 18:10:25 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [211.105.229.237]:51086: 535 Incorrect authentication data (set_id=mail)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.18.115.154
country_id: 3175395
description:
2026-07-15 18:09:57 dovecot_login authenticator failed for H=(37-128-240-47.dynamic.customer.lanta-me.ru) [85.18.115.154]:55137: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.35.187
country_id: 1835841
description:
2026-07-15 18:10:16 dovecot_login authenticator failed for H=(75.97.176.147.res-cmts.blm.ptd.net) [182.31.35.187]:38637: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.239.145.229
country_id: 6252001
description:
2026-07-15 18:10:02 dovecot_login authenticator failed for H=(210-56-15-220.dialup.attock.comsats.net.pk) [72.239.145.229]:55684: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.168.146.152
country_id: 6252001
description:
2026-07-15 18:11:20 dovecot_login authenticator failed for H=c-174-168-146-152.hsd1.ct.comcast.net ([211.216.58.204]) [174.168.146.152]:35156: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.217.202
country_id: 1269750
description:
2026-07-15 18:19:05 dovecot_login authenticator failed for H=(dynamicip-95-79-108-51.pppoe.nn.ertelecom.ru) [182.95.217.202]:60170: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.75
country_id: 1733045
description:
2026-07-15 18:19:17 dovecot_login authenticator failed for H=([45.238.2.60]) [49.125.201.75]:46662: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-15 18:19:29 dovecot_login authenticator failed for H=(118-163-145-175.hinet-ip.hinet.net) [94.16.17.139]:60130: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-15 18:20:31 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net ([14.116.172.42]) [111.70.29.132]:54650: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.31.23.11
country_id: 1835841
description:
2026-07-15 18:21:18 dovecot_login authenticator failed for H=([14.116.172.42]) [182.31.23.11]:56780: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.108.109.37
country_id: 1835841
description:
2026-07-15 18:21:28 dovecot_login authenticator failed for H=([192.111.134.12]) [222.108.109.37]:53307: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.97.94
country_id: 1269750
description:
2026-07-15 18:22:50 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [122.170.97.94]:47338: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-15 18:23:27 dovecot_login authenticator failed for H=([218.150.226.139]) [98.157.226.42]:52532: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.121.186.125
country_id: 6252001
description:
2026-07-15 18:23:58 dovecot_login authenticator failed for H=50-121-186-125.static.chtn.wv.ip.frontiernet.net ([5.76.16.216]) [50.121.186.125]:57011: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.61.159.91
country_id: 2264397
description:
2026-07-15 18:23:14 dovecot_login authenticator failed for H=91.159.61.94.rev.vodafone.pt (ip-142-54-232-1.hosts.zerolag.com) [94.61.159.91]:54420: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 160.154.84.192
country_id: 2287781
description:
2026-07-15 18:26:56 dovecot_login authenticator failed for H=([70.166.167.58]) [160.154.84.192]:59968: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.207.59.5
country_id: 1269750
domain: ahsmarine.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53196.ahsmarine.com||ServerName:ahsmarine.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:baadd496adc101508464dc02d7e07b643a717600||Title:0x23adc1c0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 136.116.198.170
country_id: 6252001
domain: alnayza.com
description:


plugin: modsec
rule: 77469916
abuser: 139.162.9.212
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:s849650.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.111.223.51
country_id: 2635167
description:
2026-07-15 18:36:36 dovecot_login authenticator failed for H=cpc145672-oxfd28-2-0-cust818.4-3.cable.virginm.net ([60.220.241.51]) [81.111.223.51]:48136: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-15 18:36:14 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com ([36.135.100.48]) [81.237.155.113]:47702: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.42.47.150
country_id: 1835841
description:
2026-07-15 18:37:45 dovecot_login authenticator failed for H=([149.54.51.74]) [14.42.47.150]:3498: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-15 18:38:13 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([106.246.89.68]) [83.191.176.93]:56752: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-15 18:39:28 dovecot_login authenticator failed for H=([49.124.153.52]) [182.95.176.122]:39732: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.128.84.224
country_id: 1835841
description:
2026-07-15 18:41:08 dovecot_login authenticator failed for H=([67.201.59.67]) [121.128.84.224]:52232: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-15 18:42:21 dovecot_login authenticator failed for H=(dynamic-adsl.movitel.co.mz) [144.24.209.174]:59730: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.205
country_id: 337996
description:
2026-07-15 18:42:28 dovecot_login authenticator failed for H=([68.71.254.3]) [196.188.187.205]:57256: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.67.246.166
country_id: 798544
description:
2026-07-15 18:42:40 dovecot_login authenticator failed for H=89-67-246-166.dynamic.play.pl ([222.108.109.37]) [89.67.246.166]:37503: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-15 18:43:15 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([174.75.211.195]) [35.130.111.98]:32815: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.107.163.195
country_id: 3932488
description:
2026-07-15 18:47:01 dovecot_login authenticator failed for H=([218.13.214.18]) [200.107.163.195]:15494: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-15 18:47:57 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net ([200.164.226.113]) [200.105.141.172]:42266: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.123.219.137
country_id: 1835841
description:
2026-07-15 18:51:47 dovecot_login authenticator failed for H=([65.20.204.41]) [203.123.219.137]:42815: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.68.38.69
country_id: 298795
description:
2026-07-15 18:52:05 dovecot_login authenticator failed for H=(213-65-190-48-no2550.tbcn.telia.com) [212.68.38.69]:56419: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.128
country_id: 1668284
description:
2026-07-15 18:52:31 dovecot_login authenticator failed for H=([106.244.164.183]) [101.13.4.128]:56060: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.230.66.211
country_id: 1512440
description:
2026-07-15 18:53:44 dovecot_login authenticator failed for H=([112.28.73.142]) [213.230.66.211]:36394: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-15 18:54:39 dovecot_login authenticator failed for H=(host-119.84.45.129.djezzycloud.dz) [122.160.11.40]:60940: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.191.211.33
country_id: 6252001
description:
2026-07-15 18:54:19 dovecot_login authenticator failed for H=([74.119.144.57]) [65.191.211.33]:36720: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.198
country_id: 2328926
description:
2026-07-15 18:56:19 dovecot_login authenticator failed for H=([192.252.214.22]) [41.207.248.198]:47100: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-07-15 18:56:47 dovecot_login authenticator failed for H=([70.166.167.58]) [203.196.42.114]:47693: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.116.59.144
country_id: 1835841
description:
2026-07-15 19:00:36 dovecot_login authenticator failed for H=(wsip-184-178-172-20.rn.hr.cox.net) [222.116.59.144]:41148: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.159.144.187
country_id: 1835841
description:
2026-07-15 19:00:49 dovecot_login authenticator failed for H=(c-71-235-27-139.hsd1.vt.comcast.net) [218.159.144.187]:44317: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.36.7.196
country_id: 719819
description:
2026-07-15 19:01:35 dovecot_login authenticator failed for H=bc2407c4.catv.pool.telekom.hu (223-197-145-126.static.imsbiz.com) [188.36.7.196]:34682: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.29.22
country_id: 2963597
description:
2026-07-15 19:02:05 dovecot_login authenticator failed for H=([201.218.0.25]) [207.254.29.22]:53376: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 106.0.165.219
country_id: 1605651
description:
2026-07-15 19:06:03 dovecot_login authenticator failed for H=([65.20.250.180]) [106.0.165.219]:59330: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 139.84.134.148
country_id: 1269750
description:
[2026-07-15 19:07:33 +0530] info [whostmgrd] 139.84.134.148 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.96.189.27
country_id: 298795
description:
2026-07-15 19:08:12 dovecot_plain authenticator failed for H=(putonate) [85.96.189.27]:58674: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77469916
abuser: 95.181.173.36
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:nuclei-cf0610c9b185eea0dc3e18819a59846f.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.134.45.64
country_id: 6252001
description:
2026-07-15 19:12:36 dovecot_login authenticator failed for H=([182.95.101.182]) [174.134.45.64]:41835: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.238.86.2
country_id: 1819730
description:
2026-07-15 19:12:56 dovecot_login authenticator failed for H=(broadband-95-84-137-185.ip.moscow.rt.ru) [156.238.86.2]:35790: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77469916
abuser: 182.10.161.227
country_id: 1643084
domain: www.globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jcegbbng9o3.xml.php||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.119.30
country_id: 1269750
description:
2026-07-15 19:20:41 dovecot_login authenticator failed for H=([187.50.122.20]) [182.95.119.30]:53064: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.212.27.150
country_id: 6252001
description:
2026-07-15 19:20:56 dovecot_login authenticator failed for H=([49.124.152.143]) [50.212.27.150]:56192: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.224.27.65
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:ddgalaxy||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 34.229.190.157
country_id: 6252001
domain: interceptorglobal.in
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/dump.sql||User:interceptorgloba||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-15 19:25:19 dovecot_login authenticator failed for H=([68.71.240.212]) [103.176.160.146]:42240: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.53.55.252
country_id: 1605651
description:
2026-07-15 19:25:50 dovecot_login authenticator failed for H=([172.167.156.153]) [182.53.55.252]:57705: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.195.39.148
country_id: 3017382
domain: fefkadirectorsunion.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/images/images/cache.php||SC:/home/fefkadirectors/public_html/images/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.72.24.43
country_id: 3437598
domain: interceptorglobal.in
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/interceptorglobal.in/ HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.105.240
country_id: 1668284
description:
2026-07-15 19:31:09 dovecot_login authenticator failed for H=110-25-105-240.adsl.fetnet.net ([192.252.214.22]) [110.25.105.240]:43749: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.82.7.89
country_id: 2077456
description:
2026-07-15 19:31:46 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [95.82.7.89]:34846: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-15 19:35:14 dovecot_login authenticator failed for H=([70.166.167.58]) [157.119.70.200]:49363: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 51.252.152.190
country_id: 102358
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f13187655 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.241.32
country_id: 1269750
description:
2026-07-15 19:38:55 dovecot_login authenticator failed for H=(static-200-105-141-161.acelerate.net) [103.168.241.32]:53705: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.124.111.122
country_id: 2077456
description:
2026-07-15 19:39:25 dovecot_login authenticator failed for H=27-124-111-122.static.as58511.net (111-70-29-157.emome-ip.hinet.net) [27.124.111.122]:34195: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.246
country_id: 1036973
description:
2026-07-15 19:40:57 dovecot_login authenticator failed for H=(95.209.157.61.bredband.tre.se) [197.219.228.246]:35454: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.242.170.10
country_id: 1036973
description:
2026-07-15 19:41:12 dovecot_login authenticator failed for H=(111-70-3-106.emome-ip.hinet.net) [197.242.170.10]:57330: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.78.86.62
country_id: 1269750
description:
2026-07-15 19:42:49 dovecot_login authenticator failed for H=([13.68.214.34]) [182.78.86.62]:33762: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-15 19:43:01 dovecot_login authenticator failed for H=([218.15.224.102]) [201.46.124.0]:1499: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.203.199.118
country_id: 1835841
description:
2026-07-15 19:42:33 dovecot_login authenticator failed for H=([103.104.127.49]) [175.203.199.118]:50368: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.229.110
country_id: 1269750
description:
2026-07-15 19:43:12 dovecot_login authenticator failed for H=([149.54.51.82]) [182.95.229.110]:34762: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.174.49
country_id: 99237
description:
2026-07-15 19:43:21 dovecot_login authenticator failed for H=([103.104.127.49]) [65.20.174.49]:52153: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.214.44.117
country_id: 149590
description:
2026-07-15 19:44:00 dovecot_login authenticator failed for H=(78.187.9.111.dynamic.ttnet.com.tr) [102.214.44.117]:57900: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-15 19:46:42 dovecot_login authenticator failed for H=(mx-ll-223.204.180-222.dynamic.3bb.co.th) [222.97.195.179]:54724: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.55.75.176
country_id: 294640
description:
2026-07-15 19:47:12 dovecot_login authenticator failed for H=([74.119.147.213]) [2.55.75.176]:54393: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.209.148.60
country_id: 2661886
description:
2026-07-15 19:48:46 dovecot_login authenticator failed for H=82-209-148-60.cust.bredband2.com ([220.77.214.59]) [82.209.148.60]:36238: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.181.5.124
country_id: 1269750
description:
2026-07-15 19:48:57 dovecot_login authenticator failed for H=([49.124.152.33]) [103.181.5.124]:58353: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.2.99.72
country_id: 1694008
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/5d3715965 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: idealloanz.com.au
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.138
country_id: 1269750
description:
2026-07-15 19:54:47 dovecot_login authenticator failed for H=([183.171.49.181]) [182.95.182.138]:58794: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.141
country_id: 2921044
description:
2026-07-15 19:55:17 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [94.16.17.141]:59110: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.177.143.61
country_id: 1819730
description:
2026-07-15 19:58:03 dovecot_login authenticator failed for H=([27.39.130.144]) [210.177.143.61]:40614: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.82.109.136
country_id: 660013
description:
2026-07-15 19:58:38 dovecot_login authenticator failed for H=([142.54.228.195]) [45.82.109.136]:50736: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-15 19:58:57 dovecot_login authenticator failed for H=([14.51.12.142]) [221.167.50.229]:39014: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.197.42
country_id: 1269750
description:
2026-07-15 20:00:18 dovecot_login authenticator failed for H=([36.135.103.30]) [128.185.197.42]:32790: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.62.74.41
country_id: 1527747
description:
2026-07-15 20:00:35 dovecot_login authenticator failed for H=(253.pool90-160-113.dynamic.orange.es) [92.62.74.41]:38667: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 176.237.236.175
country_id: 298795
domain: cochinbigbandshow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85013.cochinbigbandshow.com||ServerName:cochinbigbandshow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:37c928da07e2447d5a6ce6d1a4591b323c31648b||Title:0x437505d9||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-15 20:01:49 dovecot_login authenticator failed for H=([70.166.167.47]) [47.223.212.176]:57080: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.253.90.113
country_id: 2661886
description:
2026-07-15 20:02:14 dovecot_login authenticator failed for H=89-253-90-113.customers.ownit.se ([103.57.224.221]) [89.253.90.113]:50944: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 189.232.196.43
country_id: 3996063
domain: combinations.in
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:12104.combinations.in||ServerName:combinations.in||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5cd070504632f76d5d6787c2512eeb0215834d77||Title:0xfc60e8fe||RSV:8.28||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.240.104.100
country_id: 2077456
description:
2026-07-15 20:09:10 dovecot_login authenticator failed for H=([192.252.215.6]) [220.240.104.100]:41446: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.118.126
country_id: 1269750
description:
2026-07-15 20:09:23 dovecot_login authenticator failed for H=([70.166.167.47]) [122.184.118.126]:56174: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.22.153
country_id: 1668284
description:
2026-07-15 20:09:39 dovecot_login authenticator failed for H=111-70-22-153.emome-ip.hinet.net ([218.92.251.198]) [111.70.22.153]:44196: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.161.51
country_id: 6252001
description:
2026-07-15 20:12:56 H=([64.89.161.51]) [64.89.161.51]:54030 F=<dpr@priv8shop.com> rejected RCPT <fredgrenville0@yahoo.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.234.202.231
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c7258083 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.47.73
country_id: 1880251
domain: apkmetal.in
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.131.220.168
country_id: 1835841
description:
2026-07-15 20:13:56 dovecot_login authenticator failed for H=([103.210.250.198]) [121.131.220.168]:48340: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-15 20:14:25 dovecot_login authenticator failed for H=(static.92.254.104.190.cps.com.ar) [211.105.229.237]:49826: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.151
country_id: 1668284
description:
2026-07-15 20:18:19 dovecot_login authenticator failed for H=110-25-112-151.adsl.fetnet.net ([213.186.233.10]) [110.25.112.151]:42492: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.105.141.172
country_id: 3923057
description:
2026-07-15 20:18:24 dovecot_login authenticator failed for H=static-200-105-141-172.acelerate.net (103-86-52-211.optix.pk) [200.105.141.172]:50436: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.91.83
country_id: 1269750
description:
2026-07-15 20:18:36 dovecot_login authenticator failed for H=([189.20.109.209]) [103.130.91.83]:41172: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.248.156.49
country_id: 1522867
description:
2026-07-15 20:19:07 dovecot_login authenticator failed for H=([112.162.71.248]) [109.248.156.49]:52890: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.77.214.59
country_id: 1835841
description:
2026-07-15 20:19:29 dovecot_login authenticator failed for H=([218.92.244.10]) [220.77.214.59]:56802: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.201.228.210
country_id: 99237
description:
2026-07-15 20:19:49 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [62.201.228.210]:49702: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.95.209
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/pasystems HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.191.91.81
country_id: 3437598
description:
2026-07-15 20:21:31 dovecot_login authenticator failed for H=([14.38.177.105]) [45.191.91.81]:51213: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.207.248.198
country_id: 2328926
description:
2026-07-15 20:23:05 dovecot_login authenticator failed for H=([111.26.106.119]) [41.207.248.198]:38092: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.35.209.208
country_id: 1835841
description:
2026-07-15 20:23:08 dovecot_login authenticator failed for H=([49.124.146.43]) [14.35.209.208]:38284: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-07-15 20:22:14 dovecot_login authenticator failed for H=(ip6d55bd65.fixed.kabel-deutschland.de) [1.247.245.61]:56400: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-15 20:23:20 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net (188-122-39-33.xdsl.5gdsl.com) [72.234.16.75]:42620: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 20.199.17.137
country_id: 3017382
domain: kallanigroup.com
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/phpunit/phpunit/phpunit.xsd||User:kallanigroup||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.127.225.231
country_id: 2510769
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d53543687 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.127.7.21
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/sitemap150.xml HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.15.98
country_id: 1269750
description:
2026-07-15 20:33:16 dovecot_login authenticator failed for H=([195.158.26.59]) [103.225.15.98]:48772: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 154.16.226.150
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://www.abnewswire.com/pressreleases/sussex-county-pressure-washing-company-removes-the-tiger-stripes-others-leave_824544.html\">pressure washing contractor</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.192.162
country_id: 1269750
description:
2026-07-15 20:34:30 dovecot_login authenticator failed for H=([46.101.9.55]) [152.52.192.162]:36480: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 167.254.240.75
country_id: 1880251
domain: 103.185.74.189
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77142114r77142193||MV:20-34.167.254.240.75||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.11.40
country_id: 1269750
description:
2026-07-15 20:36:09 dovecot_login authenticator failed for H=([67.201.38.131]) [122.160.11.40]:50755: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.40.63
country_id: 1819730
description:
2026-07-15 20:36:20 dovecot_login authenticator failed for H=063.40.246.220.static.netvigator.com ([220.94.124.233]) [220.246.40.63]:42949: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.207.197.171
country_id: 1835841
description:
2026-07-15 20:40:51 dovecot_login authenticator failed for H=(187-8-89-120.customer.tdatabrasil.net.br) [175.207.197.171]:48125: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-15 20:41:11 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net (isp-31-222-6-25.saowifi.net) [111.70.29.132]:36782: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-15 20:41:11 dovecot_login authenticator failed for H=([49.124.155.182]) [197.219.208.58]:43674: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.175.26.90
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://maps.app.goo.gl/MjYuoG5vhyenVnS47\">Pressure washing</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77281327
abuser: 216.144.249.150
country_id: 2921044
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated file write/delete via Helix3 com_ajax handler for Joomla before 3.1.1 (CVE-2026-49049)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.114.246.143
country_id: 614540
domain: ogocindia.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ogocindia.com/404 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-15 20:43:02 dovecot_login authenticator failed for H=(a4.ucndns.in) [182.95.176.122]:36846: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.176.122
country_id: 1269750
description:
2026-07-15 20:43:18 dovecot_login authenticator failed for H=([49.124.152.237]) [182.95.176.122]:36194: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.111.185.234
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/home-automation HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-15 20:49:58 dovecot_login authenticator failed for H=([103.106.193.17]) [65.20.138.3]:58072: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.250.161.226
country_id: 1269750
domain: ibmctradeflow.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:85920.ibmctradeflow.com||ServerName:ibmctradeflow.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:5de7d6df51109a163968a6453d3b5a1fa632a239||Title:sxnbd5y3y9f4d7k||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.220.149.121
country_id: 1835841
description:
2026-07-15 20:50:17 dovecot_login authenticator failed for H=(110-25-109-52.adsl.fetnet.net) [118.220.149.121]:37498: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.162.192.62
country_id: 1733045
description:
2026-07-15 20:50:32 dovecot_login authenticator failed for H=([111.118.47.8]) [51.162.192.62]:40189: 535 Incorrect authentication data (set_id=khalid)


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: alnayza.com
description:


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.250.161.226
country_id: 1269750
domain: ibmcglobal.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:52786.ibmcglobal.com||ServerName:ibmcglobal.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:94161c939385d5b2bee406fe4143ef2bdf0128e8||Title:0aee9wyb33ac96||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.140.99.220
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b13580114 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77209353
abuser: 15.204.254.129
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated file upload / RCE in Joomla SP Page Builder asset.uploadCustomIcon (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/index.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.193.168.136
country_id: 1269750
description:
2026-07-15 20:58:08 dovecot_login authenticator failed for H=([182.95.26.40]) [203.193.168.136]:54100: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.93.169
country_id: 337996
description:
2026-07-15 20:58:39 dovecot_login authenticator failed for H=([31.173.66.222]) [196.188.93.169]:4012: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.228.242
country_id: 1036973
description:
2026-07-15 20:58:43 dovecot_login authenticator failed for H=([61.169.6.99]) [197.219.228.242]:55736: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: modsec
rule: 77469916
abuser: 188.119.62.104
country_id: 298795
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:dr.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 4.193.175.44
country_id: 1880251
domain: cpcontacts.elegantautomotives.com
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/admin.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.89.152
country_id: 1861060
domain: ibmcglobal.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ibmcglobal.com/images/2022/05/13/advisors-to.jpg HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-15 21:02:37 dovecot_login authenticator failed for H=([221.195.208.238]) [23.30.11.253]:40622: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.101.222.22
country_id: 1210997
description:
2026-07-15 21:02:53 dovecot_login authenticator failed for H=([197.219.228.246]) [165.101.222.22]:33651: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.207.216
country_id: 1210997
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/malik-malayalam-movie-experience-metro-digital-media HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.8.52.102
country_id: 1835841
description:
2026-07-15 21:07:21 dovecot_login authenticator failed for H=([162.253.68.102]) [59.8.52.102]:42927: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: modsec
rule: 77102143
abuser: 168.144.36.86
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated front-end JCE editor-profile import in Joomla Content Editor before 2.9.99.5 (CVE-2026-48907)||MVN:REQUEST_FILENAME||MV:/index.php||RF:/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77316797
name: IM360 WAF: RCE in uri used by KashmirBlack
abuser: 209.38.23.228
country_id: 2077456
domain: stcinemas.co
description:
IM360 WAF: RCE in uri used by KashmirBlack||WPU:||RSV:8.29||T:APACHE||MV:/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.44.206
country_id: 1269750
description:
2026-07-15 21:10:16 dovecot_login authenticator failed for H=([49.124.159.191]) [122.185.44.206]:33303: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.49.240.150
country_id: 1835841
description:
2026-07-15 21:10:33 dovecot_login authenticator failed for H=([202.72.193.34]) [14.49.240.150]:45281: 535 Incorrect authentication data (set_id=sunil)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-mussoorie.html\">Mussoorie Call Girl</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/metrodigitals/public_html/wp-content||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 70.45.146.40
country_id: 4566966
domain: elegantautomotives.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:57474.elegantautomotives.com||ServerName:elegantautomotives.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:60bbe30919b0272fb3a5cd3afe9b5f98dce2f22b||Title:0x69691fdd||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.15.98
country_id: 1269750
description:
2026-07-15 21:12:47 dovecot_login authenticator failed for H=([121.66.63.186]) [103.225.15.98]:57406: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.115.191.84
country_id: 1835841
description:
2026-07-15 21:13:03 dovecot_login authenticator failed for H=([142.54.228.195]) [211.115.191.84]:59009: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.161.240.87
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/c23822001 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.119.116.30
country_id: 3175395
domain: cochinbigbandshow.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cochinbigbandshow.com/ HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.196.42.114
country_id: 2077456
description:
2026-07-15 21:26:13 dovecot_login authenticator failed for H=(nsg-static-089.77.71.182.airtel.in) [203.196.42.114]:58302: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-15 21:27:11 dovecot_login authenticator failed for H=([24.249.199.9]) [182.95.106.138]:54394: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.202.138.181
country_id: 1819730
description:
2026-07-15 21:27:29 dovecot_login authenticator failed for H=(red.138.118.213.204.ssservicios.com.ar) [121.202.138.181]:50584: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.223.190.179
country_id: 660013
description:
2026-07-15 21:31:16 dovecot_login authenticator failed for H=dsl-hkibng42-50dfbe-179.dhcp.inet.fi ([98.190.239.1]) [80.223.190.179]:41028: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.201.78
country_id: 1733045
description:
2026-07-15 21:31:51 dovecot_login authenticator failed for H=([196.0.113.110]) [49.125.201.78]:55514: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.120.115.152
country_id: 1819730
description:
2026-07-15 21:32:30 dovecot_login authenticator failed for H=n112120115152.netvigator.com ([49.124.159.185]) [112.120.115.152]:54948: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 68.183.27.85
country_id: 6252001
domain: ogocindia.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$3:\\\"$$:constructor:constructor\"}}}||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 180.75.232.119
country_id: 1733045
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://uea8my.asia/casino-slot-games/\">uea8</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.138.3
country_id: 99237
description:
2026-07-15 21:37:28 dovecot_login authenticator failed for H=(195-67-33-198.customer.telia.com) [65.20.138.3]:57720: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 155.4.31.215
country_id: 2661886
description:
2026-07-15 21:37:56 dovecot_login authenticator failed for H=h-155-4-31-215.a2204.priv.bahnhof.se ([174.75.211.196]) [155.4.31.215]:38898: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-15 21:40:42 dovecot_login authenticator failed for H=(abts-north-dynamic-59.213.66.182.airtelbroadband.in) [182.95.61.82]:49968: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.168.57.31
country_id: 1269750
description:
2026-07-15 21:41:25 dovecot_login authenticator failed for H=([103.250.160.76]) [103.168.57.31]:51184: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-15 21:47:58 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com (200-232-60-225.customer.tdatabrasil.net.br) [217.211.208.125]:37902: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 191.101.118.202
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"http://index.businessinsurance.com/businessinsurance/article/abnewswire-2026-7-10-sussex-county-pressure-washing-company-removes-the-tiger-stripes-others-leave\">Pressure washing Hollyville</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.195.39.148
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/images/images/cache.php||SC:/home/ahsmarine/public_html/images||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 51.195.39.148
country_id: 3017382
domain: ahsmarine.com
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.29||T:APACHE||MV:/assets/images/accesson.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 96.30.129.165
country_id: 6251999
description:
2026-07-15 21:48:29 dovecot_login authenticator failed for H=host-96-30-129-165.public.eastlink.ca ([178.178.194.134]) [96.30.129.165]:55798: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-15 21:49:54 +0530] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.203.138
country_id: 1269750
description:
2026-07-15 21:56:10 dovecot_login authenticator failed for H=([192.111.143.93]) [125.23.203.138]:53922: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/4.0 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-panchkula.html\">Panchkula Call Girl service</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 160.202.35.237
country_id: 1831722
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jceqboibbdi.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-15 21:57:57 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([104.37.135.150]) [72.234.16.75]:49954: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.205.169
country_id: 1733045
description:
2026-07-15 22:01:07 dovecot_login authenticator failed for H=([58.34.62.66]) [49.124.205.169]:58168: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-15 22:00:46 dovecot_login authenticator failed for H=([190.197.31.229]) [182.95.106.138]:54210: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.45.144.201
country_id: 6252001
description:
2026-07-15 22:01:20 dovecot_login authenticator failed for H=66-45-144-201-dynamic.midco.net ([210.104.222.189]) [66.45.144.201]:59632: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.169.149
country_id: 2186224
description:
2026-07-15 22:01:48 dovecot_login authenticator failed for H=([27.24.141.156]) [121.73.169.149]:36092: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 148.170.156.248
country_id: 6251999
description:
2026-07-15 22:03:23 dovecot_login authenticator failed for H=host-148-170-156-248.public.eastlink.ca ([98.181.137.75]) [148.170.156.248]:41978: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.29.132
country_id: 1668284
description:
2026-07-15 22:03:35 dovecot_login authenticator failed for H=111-70-29-132.emome-ip.hinet.net (karuna.divineled.com) [111.70.29.132]:41328: 535 Incorrect authentication data (set_id=corporate)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.144.49
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/b660405 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77142267
name: IM360 WAF: Special shell symbol in request
abuser: 2401:4900:8fdd:a8f0:4035:8585:d4b6:8435
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Special shell symbol in request||MV:modified_by}||MVN:ARGS:jform[editemailreceiptsettings][editemailreceipttext]||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.145.160.134
country_id: 1269750
description:
2026-07-15 22:05:24 dovecot_login authenticator failed for H=([184.170.249.69]) [59.145.160.134]:42612: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:4035:8585:d4b6:8435
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.29||T:APACHE||MVN:ARGS:jform[defaultvalue][f_radio_attribute_class]||MV: inputbox visCSSbot5 ||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.254.190.160
country_id: 3865483
description:
2026-07-15 22:07:35 dovecot_login authenticator failed for H=([209.173.10.75]) [128.254.190.160]:41106: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.29.30.135
country_id: 1527747
description:
2026-07-15 22:14:25 dovecot_login authenticator failed for H=([70.166.167.47]) [217.29.30.135]:45747: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.195.9.20
country_id: 2661886
description:
2026-07-15 22:14:49 dovecot_login authenticator failed for H=user20.85-195-9.netatonce.net (abts-north-static-104.21.176.122.airtelbroadband.in) [85.195.9.20]:41376: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-15 22:15:18 dovecot_login authenticator failed for H=([192.111.138.28]) [144.24.209.174]:58837: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.230.168.26
country_id: 2661886
description:
2026-07-15 22:15:28 dovecot_login authenticator failed for H=90-230-168-26-no600.tbcn.telia.com ([220.94.124.233]) [90.230.168.26]:34434: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.254.22.207
country_id: 6252001
description:
2026-07-15 22:15:37 dovecot_login authenticator failed for H=([117.244.16.6]) [207.254.22.207]:56729: 535 Incorrect authentication data (set_id=prasad.k)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.198.42
country_id: 1269750
description:
2026-07-15 22:15:44 dovecot_login authenticator failed for H=(static.ill.103.225.15.98.bsnl.co.in) [152.52.198.42]:47438: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 197.219.208.58
country_id: 1036973
description:
2026-07-15 22:17:09 dovecot_login authenticator failed for H=([72.207.113.126]) [197.219.208.58]:58470: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.164.217.142
country_id: 1835841
description:
2026-07-15 22:19:13 dovecot_login authenticator failed for H=(85.105.255.56.static.ttnet.com.tr) [112.164.217.142]:47452: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 90.173.78.90
country_id: 2510769
description:
2026-07-15 22:22:52 dovecot_login authenticator failed for H=(mx-ll-183.89.208-174.dynamic.3bb.in.th) [90.173.78.90]:50053: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.182.138
country_id: 1269750
description:
2026-07-15 22:23:11 dovecot_login authenticator failed for H=(109.43.246.220.static.netvigator.com) [182.95.182.138]:57416: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-15 22:24:23 dovecot_login authenticator failed for H=(a95-94-205-12.cpe.netcabo.pt) [211.105.229.237]:51416: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77350630
name: IM360 WAF: DB injection limit
abuser: 196.196.53.90
country_id: 458258
domain: ahsmarine.com
description:
IM360 WAF: DB injection limit||ARG:ARGS:your-message||Injection:Will You Be Next to Hit the $27,000,000 Jackpot http://freeurlredirect.com/dfxeo||User:ahsmarine||SC:/home/ahsmarine/public_html/||WPU:||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.107.154
country_id: 1269750
description:
2026-07-15 22:32:19 dovecot_login authenticator failed for H=([49.124.153.42]) [27.123.107.154]:42516: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.151.71
country_id: 1733045
description:
2026-07-15 22:32:53 dovecot_login authenticator failed for H=([142.54.236.102]) [49.124.151.71]:51624: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.197.174
country_id: 1269750
description:
2026-07-15 22:34:11 dovecot_plain authenticator failed for H=(banch) [152.52.197.174]:52674: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.82.78.171
country_id: 102358
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/benq-s-new-premium-4k-ultra-short-throw-projectors-v6000-v7050i HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.146.157.100
country_id: 1694008
domain: gsmex.global
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:55174.gsmex.global||ServerName:gsmex.global||Method:metaWeblog.newPost||BlogID:1||TitleSHA:52a0ec7f7cc09656b9c0dbcf0f5325a1889b0f7e||Title:0x41d32747||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.85.194.230
country_id: 1210997
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/f4389528 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.105.229.237
country_id: 1835841
description:
2026-07-15 22:42:08 dovecot_login authenticator failed for H=([119.207.15.192]) [211.105.229.237]:58502: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-15 22:44:15 dovecot_login authenticator failed for H=(distribution05-10gb.1560.la3.switches.zerolag.com) [125.130.102.172]:58209: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.223.212.176
country_id: 6252001
description:
2026-07-15 22:46:24 dovecot_login authenticator failed for H=(145.173.198.203.static.netvigator.com) [47.223.212.176]:44504: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.203.193.106
country_id: 1168579
description:
2026-07-15 22:46:44 dovecot_login authenticator failed for H=([200.216.172.182]) [113.203.193.106]:43775: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.223.166
country_id: 337996
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/latest-news/actor-vishnu-govindan-shared-his-experience-at-metro-digital-media-home-theatre-review HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 78.197.6.173
country_id: 3017382
description:
2026-07-15 22:48:13 dovecot_login authenticator failed for H=([189.108.156.41]) [78.197.6.173]:54791: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.195
country_id: 1668284
description:
2026-07-15 22:48:52 dovecot_login authenticator failed for H=([220.180.171.157]) [101.13.5.195]:40254: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 2401:4900:8fdd:a8f0:4035:8585:d4b6:8435
country_id: 1269750
domain: futuracare.com.au
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.29||T:APACHE||MVN:ARGS:jform[defaultvalue][f_text_attribute_class]||MV: inputbox visCSSinput ||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.56.174.45
country_id: 1269750
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a1629798 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-15 23:02:34 dovecot_login authenticator failed for H=([192.252.220.90]) [122.184.124.46]:54304: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.154.80.51
country_id: 2245662
description:
2026-07-15 23:02:39 dovecot_login authenticator failed for H=([192.111.135.19]) [213.154.80.51]:59387: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.56.205
country_id: 1269750
description:
2026-07-15 23:02:40 dovecot_login authenticator failed for H=(221-120-73-25.emome-ip.hinet.net) [128.185.56.205]:38100: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.5.39
country_id: 1668284
description:
2026-07-15 23:02:52 dovecot_login authenticator failed for H=(122.6.190.94.interra.ru) [101.13.5.39]:36064: 535 Incorrect authentication data (set_id=investmentmanager)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.198.180.129
country_id: 1835841
description:
2026-07-15 23:02:52 dovecot_login authenticator failed for H=(ip-199-102-107-147.hosts.zerolag.com) [175.198.180.129]:39192: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.76.16.216
country_id: 1522867
description:
2026-07-15 23:02:56 dovecot_login authenticator failed for H=(ipmapt-72-195-34-34.oc.oc.cox.net) [5.76.16.216]:34925: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 111.125.231.20
country_id: 1269750
domain: www.metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.metrodigitals.com/ HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.33.247.46
country_id: 2077456
description:
2026-07-15 23:04:58 dovecot_login authenticator failed for H=27-33-247-46.tpgi.com.au (221-120-57-172.emome-ip.hinet.net) [27.33.247.46]:34895: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.170.99.195
country_id: 1269750
description:
2026-07-15 23:04:14 dovecot_login authenticator failed for H=([36.151.68.6]) [122.170.99.195]:36756: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 58.65.195.231
country_id: 1168579
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/solutions/acoustic-consultancy HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.113.30
country_id: 1269750
description:
2026-07-15 23:10:51 dovecot_login authenticator failed for H=(201-91-242-197.customer.tdatabrasil.net.br) [27.123.113.30]:42152: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.72.234
country_id: 3489940
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a42018423 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.140
country_id: 2921044
description:
2026-07-15 23:11:08 dovecot_login authenticator failed for H=([222.90.233.165]) [94.16.17.140]:35614: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: modsec
rule: 77350977
abuser: 82.199.209.24
country_id: 99237
domain: elegantautomotives.com
description:
IM360 WAF: Joomla Page Builder CK webshell access - executable in media dir (CVE-2026-56290 / WPT-2603)||MVN:REQUEST_FILENAME||MV:/media/com_pagebuilderck/gfonts/fbi.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.47.132.66
country_id: 1643084
domain: globalgroupoman.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce-ucywaw-.htaccess||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 82.199.209.24
country_id: 99237
domain: elegantautomotives.com
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:url||MV:https://raw.githubusercontent.com/sagsooz/fonts/refs/heads/main/font.css||User:elegantautomotiv||SC:/home/elegantautomotiv/public_html/index.php||WPU:||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.87.30
country_id: 1835841
description:
2026-07-15 23:17:13 dovecot_login authenticator failed for H=([142.54.235.12]) [125.139.87.30]:58148: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.225.15.98
country_id: 1269750
description:
2026-07-15 23:18:07 dovecot_login authenticator failed for H=(167.43.246.220.static.netvigator.com) [103.225.15.98]:57894: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 35.184.28.196
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.yuejiw.com/\">\xe8\x97\xa4\xe6\x9c\xac\xe6\x9c\x88\xe5\xad\xa3</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.239.209.214
country_id: 3996063
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/a82897017 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 196.51.87.233
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://lovealba.co.kr/\">\xeb\x85\xb8\xeb\x9e\x98\xeb\xb0\xa9 \xec\x8b\xa4\xec\x9e\xa5 \xea\xb5\xac\xec\x9d\xb8</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 103.253.24.90
country_id: 1880251
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:jce0dd68a6o.xml.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.232.174
country_id: 1269750
description:
2026-07-15 23:21:10 dovecot_plain authenticator failed for H=(delival) [152.52.232.174]:42480: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.195.39.148
country_id: 3017382
domain: metrodigitals.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/images/images/cache.php||SC:/home/metrodigitals/public_html/images/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-15 23:23:53 dovecot_login authenticator failed for H=([113.200.216.246]) [172.191.74.151]:58240: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-15 23:23:21 dovecot_login authenticator failed for H=([49.124.147.96]) [116.98.104.138]:35876: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.97.195.179
country_id: 1835841
description:
2026-07-15 23:24:52 dovecot_login authenticator failed for H=([142.54.235.12]) [222.97.195.179]:47948: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.59.200.166
country_id: 149590
description:
2026-07-15 23:25:30 dovecot_login authenticator failed for H=([58.56.128.190]) [41.59.200.166]:50451: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.163.174
country_id: 2186224
description:
2026-07-15 23:27:38 dovecot_login authenticator failed for H=([192.252.208.66]) [121.73.163.174]:33114: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.235.110
country_id: 1269750
description:
2026-07-15 23:28:43 dovecot_login authenticator failed for H=(nsg-corporate-73.234.187.122.airtel.in) [128.185.235.110]:36458: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/vrishenterprises/sriganapathyent.in/wp-content||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 179.65.197.42
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:145170||Sizes:21||Combined size:21||User:metrodigitals||WPU:||Filename:4vuy55ht.txt||Scanned:/tmp//20260715-233348-alfLhIhg1_EezR5iuA0AHAAAAI0-file-FmOyQV||SC:/home/metrodigitals/public_html/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 179.65.197.42
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.29||T:APACHE||SC:/home/metrodigitals/public_html/index.php||User:metrodigitals||WPU:||


plugin: modsec
rule: 77350026
name: IM360 WAF: Track suspicious Spring Framework requests
abuser: 179.65.197.42
country_id: 1643084
domain: metrodigitals.com
description:
IM360 WAF: Track suspicious Spring Framework requests||RSV:8.29||T:APACHE||MVN:ARGS:class||MV:JFormFieldNRInlineFileUpload||


plugin: modsec
rule: 77469916
abuser: 5.83.135.102
country_id: 2921044
domain: idealloanz.com.au
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:file||MV:manager-validate.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469917
name: IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)
abuser: 5.83.135.102
country_id: 2921044
domain: idealloanz.com.au
description:
IM360 WAF: File upload on Joomla Content Editor JCE endpoint - tracking (CVE-2026-48907)||MVN:FILES:file||MV:manager-validate.jpg||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.192.211.180
country_id: 1269750
description:
2026-07-15 23:36:26 dovecot_login authenticator failed for H=([95.82.7.89]) [203.192.211.180]:38624: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.218.247.234
country_id: 1522867
description:
2026-07-15 23:37:27 dovecot_login authenticator failed for H=([87.106.245.167]) [89.218.247.234]:53734: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.109.54
country_id: 1668284
description:
2026-07-15 23:37:58 dovecot_login authenticator failed for H=110-25-109-54.adsl.fetnet.net ([185.94.182.35]) [110.25.109.54]:38971: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.234.16.75
country_id: 6252001
description:
2026-07-15 23:43:54 dovecot_login authenticator failed for H=dhcp-72-234-16-75.hawaiiantel.net ([111.46.77.2]) [72.234.16.75]:56408: 535 Incorrect authentication data (set_id=nirmal@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-15 23:44:09 dovecot_login authenticator failed for H=([174.75.211.195]) [103.90.27.83]:37508: 535 Incorrect authentication data (set_id=nirmal)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.61.82
country_id: 1269750
description:
2026-07-15 23:47:11 dovecot_login authenticator failed for H=([5.172.8.83]) [182.95.61.82]:36448: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.4.124
country_id: 1668284
description:
2026-07-15 23:47:58 dovecot_login authenticator failed for H=([46.44.40.82]) [101.13.4.124]:60782: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.119.70.200
country_id: 1282988
description:
2026-07-15 23:50:33 dovecot_login authenticator failed for H=([221.195.208.238]) [157.119.70.200]:52120: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.209.101.43
country_id: 2077456
description:
2026-07-15 23:51:03 dovecot_login authenticator failed for H=([223.223.194.187]) [123.209.101.43]:58364: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 185.177.72.10
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env.production||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.177.72.10
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/backup/wp-config.bak||User:globalgroupoman||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.30.11.253
country_id: 6252001
description:
2026-07-16 00:03:21 dovecot_plain authenticator failed for H=(sigambed) [23.30.11.253]:38692: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 185.177.72.10
country_id: 3017382
domain: globalgroupoman.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/resources/views/.env||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.146.157.100
country_id: 1694008
domain: kallanigroup.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:88910.kallanigroup.com||ServerName:kallanigroup.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c56d358aa280866c9169e8ceb1bb6af490c58ef2||Title:0xeeac1c7a||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.64.33.82
country_id: 1643084
description:
2026-07-16 00:10:48 dovecot_login authenticator failed for H=([49.124.151.12]) [36.64.33.82]:57298: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.186.25.255
country_id: 357994
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/d8304471 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.195.39.148
country_id: 3017382
domain: www.globalgroupoman.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/images/images/cache.php||SC:/home/globalgroupoman/public_html/images/images||


plugin: modsec
rule: 77264624
name: IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)
abuser: 51.195.39.148
country_id: 3017382
domain: www.globalgroupoman.com
description:
IM360 WAF: Polyshell accesson backdoor access (CVE-2025-54265 post-exploit)||MV:/assets/images/accesson.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 206.62.136.109
country_id: 3686110
description:
2026-07-16 00:13:20 dovecot_login authenticator failed for H=([222.97.195.179]) [206.62.136.109]:55856: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.219.77
country_id: 1835841
description:
2026-07-16 00:14:53 dovecot_login authenticator failed for H=(mission-web-hosting.com) [119.192.219.77]:51805: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.233.203.159
country_id: 2661886
description:
2026-07-16 00:15:02 dovecot_login authenticator failed for H=89-233-203-159.cust.bredband2.com ([95.165.25.233]) [89.233.203.159]:48056: 535 Incorrect authentication data (set_id=khalid)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.181.26
country_id: 1269750
description:
2026-07-16 00:20:29 dovecot_login authenticator failed for H=([198.52.177.150]) [182.95.181.26]:56596: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 217.211.208.125
country_id: 2661886
description:
2026-07-16 00:20:44 dovecot_login authenticator failed for H=217-211-208-125-no2550.tbcn.telia.com (111-70-23-248.emome-ip.hinet.net) [217.211.208.125]:47382: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-16 00:23:07 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se ([121.171.95.112]) [83.226.181.38]:33852: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.138.90.195
country_id: 2661886
description:
2026-07-16 00:22:52 dovecot_login authenticator failed for H=h79-138-90-195.cust.bredband2.com (212.42.246.220.static.netvigator.com) [79.138.90.195]:39172: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.56.174.63
country_id: 3686110
description:
2026-07-16 00:22:54 dovecot_login authenticator failed for H=(ip-179.48.229.118.fiberlinkpe.net.br) [181.56.174.63]:40232: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.227.145
country_id: 1269750
description:
2026-07-16 00:23:04 dovecot_login authenticator failed for H=([46.44.0.185]) [122.187.227.145]:51485: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 45.134.191.29
country_id: 1831722
domain: www.globalgroupoman.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icoamtbil.zip||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.111.136.210
country_id: 294640
description:
2026-07-16 00:23:50 dovecot_login authenticator failed for H=(wsip-24-120-10-18.lv.lv.cox.net) [84.111.136.210]:46563: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.73.24
country_id: 1668284
description:
2026-07-16 00:24:09 dovecot_login authenticator failed for H=221-120-73-24.emome-ip.hinet.net (180.151.254.218.reverse.spectranet.in) [221.120.73.24]:58339: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 45.134.191.29
country_id: 1831722
domain: www.globalgroupoman.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icoigxdqn.zip||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.220.16.51
country_id: 1269750
description:
2026-07-16 00:24:23 dovecot_login authenticator failed for H=([121.66.63.186]) [103.220.16.51]:57062: 535 Incorrect authentication data (set_id=cil)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.40.193.236
country_id: 286963
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es15?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77209354
name: IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)
abuser: 45.134.191.29
country_id: 1831722
domain: www.globalgroupoman.com
description:
IM360 WAF: File upload on Joomla SP Page Builder endpoint - tracking (CVE-2026-48908)||MVN:FILES:custom_icon||MV:icovbhjrc.zip||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.138.166.217
country_id: 1835841
description:
2026-07-16 00:27:40 dovecot_login authenticator failed for H=([117.205.2.250]) [125.138.166.217]:51082: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.211.96
country_id: 99237
description:
2026-07-16 00:28:12 dovecot_login authenticator failed for H=([220.179.87.203]) [65.20.211.96]:42596: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 101.13.6.91
country_id: 1668284
description:
2026-07-16 00:28:25 dovecot_login authenticator failed for H=([111.26.62.41]) [101.13.6.91]:36797: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 81.237.155.113
country_id: 2661886
description:
2026-07-16 00:33:23 dovecot_login authenticator failed for H=81-237-155-113-no2400.tbcn.telia.com ([182.95.189.66]) [81.237.155.113]:55254: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.191.176.93
country_id: 2661886
description:
2026-07-16 00:33:34 dovecot_login authenticator failed for H=c83-191-176-93.bredband.tele2.se ([1.240.101.2]) [83.191.176.93]:34626: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 103.87.142.137
country_id: 1269750
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://delhi.delhihotelsqueen.com/call-girl-in-borivali.html\">call girl in Borivali</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.189.66
country_id: 1269750
description:
2026-07-16 00:33:46 dovecot_login authenticator failed for H=([218.206.136.24]) [182.95.189.66]:41134: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.185.6.181
country_id: 1269750
description:
2026-07-16 00:33:52 dovecot_login authenticator failed for H=([110.166.80.135]) [136.185.6.181]:41879: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.214.10.178
country_id: 2245662
description:
2026-07-16 00:34:03 dovecot_login authenticator failed for H=([199.58.185.11]) [41.214.10.178]:47052: 535 Incorrect authentication data (set_id=cil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-16 00:36:07 dovecot_login authenticator failed for H=([174.64.199.88]) [182.95.123.50]:50978: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.116.110
country_id: 1269750
description:
2026-07-16 00:36:26 dovecot_login authenticator failed for H=([218.21.241.50]) [122.187.116.110]:35692: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.247.252.216
country_id: 3625428
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/component/content/article/signature-elite-series-es55-pair?Itemid=101&catid=18 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.176.160.146
country_id: 1269750
description:
2026-07-16 00:42:25 dovecot_login authenticator failed for H=(162-215-195-65.unifiedlayer.com) [103.176.160.146]:36588: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 135.125.199.17
country_id: 3017382
description:
2026-07-16 00:42:37 dovecot_login authenticator failed for H=vps-36f1e8f3.vps.ovh.net ([220.180.166.214]) [135.125.199.17]:34590: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.72.198.61
country_id: 1835841
description:
2026-07-16 00:43:25 dovecot_login authenticator failed for H=([222.108.109.37]) [220.72.198.61]:60300: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: ahsmarine.com
description:


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.5.117.238
country_id: 1694008
description:
2026-07-16 00:45:38 dovecot_login authenticator failed for H=([111.70.21.178]) [210.5.117.238]:63630: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.52.23
country_id: 1880251
domain: ibmcglobal.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/537.36||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 85.204.70.112
country_id: 3017382
domain: sriganapathyent.in.vrishenterprises.in
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.29||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.99.52.202
country_id: 1835841
description:
2026-07-16 00:47:55 dovecot_login authenticator failed for H=([49.124.151.82]) [222.99.52.202]:37364: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.152.174
country_id: 1733045
description:
2026-07-16 00:48:25 dovecot_login authenticator failed for H=(ipmapt-72-195-114-171.oc.oc.cox.net) [49.124.152.174]:54366: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.255.126.55
country_id: 3017382
domain: cochinbigbandshow.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.185.255.126.55||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.208.70.70
country_id: 3077311
description:
2026-07-16 00:53:34 dovecot_login authenticator failed for H=83-208-70-70.rcc.o2.cz ([103.210.250.198]) [83.208.70.70]:41096: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 193.95.24.117
country_id: 2464461
description:
2026-07-16 00:59:02 dovecot_login authenticator failed for H=([125.134.191.222]) [193.95.24.117]:40082: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 35.130.111.98
country_id: 6252001
description:
2026-07-16 00:59:21 dovecot_login authenticator failed for H=syn-035-130-111-098.biz.spectrum.com ([49.124.146.42]) [35.130.111.98]:52980: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.34.52.58
country_id: 1522867
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/ HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77469916
abuser: 37.122.149.28
country_id: 6251999
domain: alnayza.com
description:
IM360 WAF: Unauthenticated editor-profile/file upload in Joomla Content Editor JCE before 2.9.99.5 (CVE-2026-48907)||MVN:FILES:profile_file||MV:a4526.xml.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 179.65.193.176
country_id: 1643084
domain: ogocindia.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.29||T:APACHE||SC:/home/ogocindia/public_html/index.php||User:ogocindia||WPU:||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 179.65.193.176
country_id: 1643084
domain: ogocindia.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:138613||Sizes:21||Combined size:21||User:ogocindia||WPU:||Filename:igrh288i.txt||Scanned:/tmp//20260716-010838-alfhvt13-YSJw7O6fHPL6AAAAAw-file-Ld6rmq||SC:/home/ogocindia/public_html/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.155.212.164
country_id: 6252001
domain: fefkadirectorsunion.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/146.0.7680.165 Safari/537.36||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.16.17.139
country_id: 2921044
description:
2026-07-16 01:09:58 dovecot_login authenticator failed for H=([70.166.167.58]) [94.16.17.139]:43130: 535 Incorrect authentication data (set_id=cil@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 01:10:20 dovecot_login authenticator failed for H=([184.170.249.69]) [188.122.37.97]:54770: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.225.62.19
country_id: 6252001
description:
2026-07-16 01:10:30 dovecot_login authenticator failed for H=wsip-68-225-62-19.pn.at.cox.net ([222.75.225.206]) [68.225.62.19]:33312: 535 Incorrect authentication data (set_id=bernadetta@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.143.215.216
country_id: 1835841
description:
2026-07-16 01:10:39 dovecot_login authenticator failed for H=([72.37.217.1]) [125.143.215.216]:43770: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.157.226.42
country_id: 6252001
description:
2026-07-16 01:11:02 dovecot_login authenticator failed for H=(82-65-140-218.subs.proxad.net) [98.157.226.42]:52979: 535 Incorrect authentication data (set_id=bernadetta)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.120.78.177
country_id: 1668284
description:
2026-07-16 01:11:11 dovecot_login authenticator failed for H=221-120-78-177.emome-ip.hinet.net ([72.205.0.69]) [221.120.78.177]:38872: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 206.119.170.12
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.29||T:APACHE||SC:/home/alnay/public_html/components/com_jce/editor/tiny_mce/themes/advanced/skins/default/src/auth.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.32.231.200
country_id: 1835841
description:
2026-07-16 01:15:22 dovecot_login authenticator failed for H=([61.169.54.150]) [14.32.231.200]:52912: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.125.203.165
country_id: 1733045
description:
2026-07-16 01:15:38 dovecot_login authenticator failed for H=([174.75.211.198]) [49.125.203.165]:44590: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-07-16 01:15:54 dovecot_login authenticator failed for H=(110-174-154-152.tpgi.com.au) [103.130.207.227]:44660: 535 Incorrect authentication data (set_id=corporate)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 69.115.178.196
country_id: 6252001
description:
2026-07-16 01:16:54 dovecot_login authenticator failed for H=ool-4573b2c4.dyn.optonline.net ([185.15.82.135]) [69.115.178.196]:32988: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.49.199.97
country_id: 6252001
description:
2026-07-16 01:17:25 dovecot_login authenticator failed for H=([104.37.135.150]) [76.49.199.97]:48222: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.53.7.231
country_id: 6252001
description:
2026-07-16 01:19:25 dovecot_login authenticator failed for H=(static-200-105-141-161.acelerate.net) [64.53.7.231]:51130: 535 Incorrect authentication data (set_id=anoop.ps@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.192.210.110
country_id: 1835841
description:
2026-07-16 01:19:41 dovecot_login authenticator failed for H=(78-66-45-101-no2550.tbcn.telia.com) [119.192.210.110]:51109: 535 Incorrect authentication data (set_id=anoop.ps)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.105.255.56
country_id: 298795
description:
2026-07-16 01:22:28 dovecot_login authenticator failed for H=([70.166.167.33]) [85.105.255.56]:41061: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.181.2.48
country_id: 3202326
description:
2026-07-16 01:25:16 dovecot_login authenticator failed for H=([49.124.151.39]) [5.181.2.48]:58952: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.255.209.245
country_id: 2661886
description:
2026-07-16 01:25:34 dovecot_login authenticator failed for H=c83-255-209-245.bredband.tele2.se ([192.111.137.33]) [83.255.209.245]:50964: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.98.110.46
country_id: 3382998
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/lighting-control-systems HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.177.245.198
country_id: 357994
description:
2026-07-16 01:27:09 dovecot_login authenticator failed for H=([192.111.134.12]) [154.177.245.198]:54202: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.63.63.128
country_id: 6251999
domain: www.ibmcglobal.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/ibmcglobal/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.106.245.167
country_id: 3017382
description:
2026-07-16 01:30:06 dovecot_login authenticator failed for H=([59.110.5.198]) [87.106.245.167]:36628: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.217.242.59
country_id: 953987
description:
2026-07-16 01:30:07 dovecot_plain authenticator failed for H=(localhost) [102.217.242.59]:48691: 535 Incorrect authentication data (set_id=jijo@ddgalaxy.in)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.118.47.8
country_id: 1835841
description:
2026-07-16 01:30:22 dovecot_login authenticator failed for H=(vm-creative-db01.madavor.cl.zerolag.com) [111.118.47.8]:33546: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.246.153.125
country_id: 3865483
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/intercom-systems HTTP/1.1||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.208.92.111
country_id: 1819730
domain: kallanigroup.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/admin.php||SC:/home/kallanigroup/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.210.107.161
country_id: 294640
description:
2026-07-16 01:34:09 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [46.210.107.161]:38719: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.10.203.54
country_id: 2661886
description:
2026-07-16 01:36:56 dovecot_login authenticator failed for H=h-176-10-203-54.a463.priv.bahnhof.se ([68.71.254.3]) [176.10.203.54]:38704: 535 Incorrect authentication data (set_id=sunil@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.98.104.138
country_id: 1562822
description:
2026-07-16 01:37:15 dovecot_login authenticator failed for H=([49.124.154.172]) [116.98.104.138]:41138: 535 Incorrect authentication data (set_id=sunil)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.106.138
country_id: 1269750
description:
2026-07-16 01:39:02 dovecot_login authenticator failed for H=([49.124.153.22]) [182.95.106.138]:46876: 535 Incorrect authentication data (set_id=mbt)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.122.215.23
country_id: 6252001
description:
2026-07-16 01:38:21 dovecot_login authenticator failed for H=(starik.Obninsk.ru) [98.122.215.23]:38846: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 171.234.8.175
country_id: 1562822
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"http://319ch.com/cgi/ro/vv_kakiko4/vv_kakiko2.cgi\">\xe2\x80\x9cVi\xe1\xbb\x87n Eakmat\xe2\x80\x9d</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 83.226.181.38
country_id: 2661886
description:
2026-07-16 01:40:52 dovecot_login authenticator failed for H=c-83-226-181-38.bbcust.telenor.se ([192.252.220.90]) [83.226.181.38]:40458: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 144.24.209.174
country_id: 102358
description:
2026-07-16 01:41:07 dovecot_login authenticator failed for H=(6.40.48.59.broad.cz.sx.dynamic.163data.com.cn) [144.24.209.174]:62584: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.137.47.204
country_id: 6251999
description:
2026-07-16 01:44:53 dovecot_login authenticator failed for H=dhcp-4-bc-9f-70-1a-16.cpe.i-zoom.net (pool-108-35-129-132.nwrknj.fios.verizon.net) [24.137.47.204]:57092: 535 Incorrect authentication data (set_id=investmentmanager@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 143.202.162.196
country_id: 3624060
description:
2026-07-16 01:45:43 dovecot_login authenticator failed for H=([174.75.211.195]) [143.202.162.196]:56066: 535 Incorrect authentication data (set_id=uaeindiab2b@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.169.40.221
country_id: 1269750
description:
2026-07-16 01:45:54 dovecot_login authenticator failed for H=([37.204.111.153]) [122.169.40.221]:53424: 535 Incorrect authentication data (set_id=uaeindiab2b)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-16 01:49:19 dovecot_login authenticator failed for H=([14.98.28.43]) [221.167.50.229]:51402: 535 Incorrect authentication data (set_id=corporate@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.184.124.46
country_id: 1269750
description:
2026-07-16 01:49:42 dovecot_login authenticator failed for H=([184.181.217.198]) [122.184.124.46]:55132: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.212.9.122
country_id: 1835841
description:
2026-07-16 01:50:03 dovecot_login authenticator failed for H=([212.251.0.147]) [123.212.9.122]:56315: 535 Incorrect authentication data (set_id=rdcentre)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.41.105
country_id: 1733045
description:
2026-07-16 01:58:07 dovecot_login authenticator failed for H=(201.221.116.88.cidadei.com.br) [183.171.41.105]:50992: 535 Incorrect authentication data (set_id=support@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.205.3.26
country_id: 1269750
description:
2026-07-16 01:58:10 dovecot_login authenticator failed for H=([192.252.216.83]) [117.205.3.26]:42851: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.190.180.18
country_id: 337996
description:
2026-07-16 01:58:28 dovecot_login authenticator failed for H=(corporativo.static.gvt.net.br) [196.190.180.18]:46062: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.187.155.130
country_id: 6252001
description:
2026-07-16 01:58:34 dovecot_login authenticator failed for H=([103.156.26.25]) [50.187.155.130]:37551: 535 Incorrect authentication data (set_id=support)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 206.119.170.12
country_id: 6252001
domain: www.alnayza.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/components/com_sppagebuilder/addons/accordion/assets/images/template.php||SC:/home/alnay/public_html/components/com_sppagebuilder/addons/accordion/assets/images/template.php||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 103.154.151.57
country_id: 1643084
domain: alnayza.com
description:
IM360 WAF: Attempt to upload malware||Action:||Scan duration:155413||Sizes:19||Combined size:19||User:alnay||WPU:||Filename:7ssb20xt.txt||Scanned:/tmp//20260716-020326-alfulth4g7aLuq578ICqywAAAQI-file-yWEDPj||SC:/home/alnay/public_html/index.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 85.204.70.112
country_id: 3017382
domain: vrishenterprises.in
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.29||T:APACHE||REQUEST_URI:/wp/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.153.3.166
country_id: 6252001
description:
2026-07-16 02:07:22 dovecot_plain authenticator failed for H=c-73-153-3-166.hsd1.co.comcast.net (norilos) [73.153.3.166]:57364: 535 Incorrect authentication data (set_id=admin@ddgalaxy.in)


plugin: modsec
rule: 77350169
name: IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)
abuser: 15.204.254.129
country_id: 6252001
domain: ddgalaxy.in
description:
IM360 WAF: Improper access check in webservice endpoints in Joomla! (CVE-2023-23752)||MV:true||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.14.23
country_id: 294640
description:
2026-07-16 02:10:16 dovecot_login authenticator failed for H=([36.135.103.29]) [109.226.14.23]:59101: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.130.102.172
country_id: 1835841
description:
2026-07-16 02:14:52 dovecot_login authenticator failed for H=([192.111.137.33]) [125.130.102.172]:45191: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 200.10.37.227
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Opera/9.80 <a href=\"https://www.openpr.com/news/4574389\">Hose Bros Inc</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.250.160.76
country_id: 1269750
description:
2026-07-16 02:15:30 dovecot_login authenticator failed for H=(c74-197-220-5.dh.suddenlink.net) [103.250.160.76]:51372: 535 Incorrect authentication data (set_id=rdcentre)


plugin: modsec
rule: 77210831
name: IM360 WAF: Rogue web site crawler
abuser: 107.175.26.90
country_id: 6252001
domain: globalgroupoman.com
description:
IM360 WAF: Rogue web site crawler||MVN:REQUEST_HEADERS:User-Agent||MV:Mozilla/5.0 <a href=\"https://maps.app.goo.gl/oApNPj5CRvLZVrkH7\">Residential pressure washing</a> (Windows NT 5.1; U; en) Presto/2.10.229 Version/11.60||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-07-16 02:17:57 dovecot_login authenticator failed for H=([199.102.105.241]) [103.90.27.83]:49282: 535 Incorrect authentication data (set_id=rdcentre1@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.123.50
country_id: 1269750
description:
2026-07-16 02:18:39 dovecot_login authenticator failed for H=(144.121.245.65.lightower.net) [182.95.123.50]:52608: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.12.178
country_id: 1269750
description:
2026-07-16 02:18:51 dovecot_login authenticator failed for H=([49.125.201.67]) [182.95.12.178]:52616: 535 Incorrect authentication data (set_id=rdcentre1)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.160.57.196
country_id: 1835841
description:
2026-07-16 02:23:45 dovecot_login authenticator failed for H=([184.170.249.69]) [112.160.57.196]:33876: 535 Incorrect authentication data (set_id=rdcentre@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.61.251.4
country_id: 3686110
description:
2026-07-16 02:25:27 dovecot_login authenticator failed for H=(ip-142-54-226-210.hosts.zerolag.com) [181.61.251.4]:58528: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.28.243
country_id: 1668284
description:
2026-07-16 02:25:41 dovecot_login authenticator failed for H=111-70-28-243.emome-ip.hinet.net ([182.95.20.55]) [111.70.28.243]:48455: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.167.50.229
country_id: 1835841
description:
2026-07-16 02:27:32 dovecot_login authenticator failed for H=([221.182.185.190]) [221.167.50.229]:40210: 535 Incorrect authentication data (set_id=sajithkumar.pk@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.33.119.34
country_id: 1835841
description:
2026-07-16 02:27:43 dovecot_login authenticator failed for H=([121.189.198.60]) [118.33.119.34]:46788: 535 Incorrect authentication data (set_id=sajithkumar.pk)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.46.124.0
country_id: 3686110
description:
2026-07-16 02:29:09 dovecot_login authenticator failed for H=(karuna.divineled.com) [201.46.124.0]:4788: 535 Incorrect authentication data (set_id=prasad.k@ibmcglobal.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.159.146
country_id: 1562822
domain: metrodigitals.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/metrodigitals.com/home-theater-products/v5010i-4k-rgb-laser-tv-projector HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.251.73
country_id: 1269750
description:
2026-07-16 02:29:51 dovecot_login authenticator failed for H=([50.223.176.171]) [122.187.251.73]:55732: 535 Incorrect authentication data (set_id=prasad.k)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.163.62.65
country_id: 102358
domain: cochinbigbandshow.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cochinbigbandshow.com/videos HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.89.198.191
country_id: 2186224
description:
2026-07-16 02:42:48 dovecot_login authenticator failed for H=219-89-198-191.adsl.xtra.co.nz ([142.54.231.33]) [219.89.198.191]:42496: 535 Incorrect authentication data (set_id=support@ibmcglobal.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.188.187.21
country_id: 337996
description:
2026-07-16 02:43:33 dovecot_login authenticator failed for H=(ip-142-54-232-1.hosts.zerolag.com) [196.188.187.21]:39198: 535 Incorrect authentication data (set_id=support)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.2.228.48
country_id: 597427
description:
2026-07-16 02:43:35 dovecot_login authenticator failed for H=static-185-2-228-48.cust.tele2.lt (95-165-84-70.dynamic.spd-mgts.ru) [185.2.228.48]:34127: 535 Incorrect authentication data (set_id=mbt@globalgroupoman.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.122.37.97
country_id: 2635167
description:
2026-07-16 02:44:02 dovecot_login authenticator failed for H=(c-83-226-181-38.bbcust.telenor.se) [188.122.37.97]:49556: 535 Incorrect authentication data (set_id=mbt)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.122.130.156
country_id: 3437598
domain: keralapeople.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/keralapeople.com/detail/8e2784729 HTTP/1.1||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.191.74.151
country_id: 6252001
description:
2026-07-16 02:49:57 dovecot_login authenticator failed for H=([49.124.149.49]) [172.191.74.151]:41646: 535 Incorrect authentication data (set_id=evin.joseph@ibmcglobal.com)


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 206.119.170.12
country_id: 6252001
domain: 103.185.74.189
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/icoshyzhb/fonts/facygwe.PHP||RSV:8.29||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.45.200.87
country_id: 2077456
description:
2026-07-16 02:50:13 dovecot_login authenticator failed for H=(78-66-44-23-no2550.tbcn.telia.com) [203.45.200.87]:44888: 535 Incorrect authentication data (set_id=evin.joseph)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.82.108.109
country_id: 1269750
description:
2026-07-16 02:51:24 dovecot_login authenticator failed for H=([199.116.114.10]) [183.82.108.109]:37148: 535 Incorrect authentication data (set_id=mail@kallanigroup.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-07-16 02:51:40 dovecot_login authenticator failed for H=([72.207.33.65]) [103.187.78.189]:38584: 535 Incorrect authentication data (set_id=khalid@globalgroupoman.com)


