# incident

plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.143.76.101
country_id: 1733045
description:
[2026-01-26 12:19:09 +0800] info [webmaild] 175.143.76.101 - brendon@mckd.com.my "GET /cPanel_magic_revision_0/webmail/jupiter/css/calendar.min.css HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 40.160.26.3
country_id: 6252001
domain: usfood.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-26 12:19:58 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess2961289908/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-26 12:19:59 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess2961289908/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-26 12:21:03 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:57982: 535 Incorrect authentication data (set_id=autoreply@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-26 12:21:14 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess7250384863/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-26 12:22:14 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess7250384863/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.32.75.127
country_id: 3585968
description:
Jan 26 12:22:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.32.75.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.32.75.127
country_id: 3585968
description:
2026-01-26 12:22:37 dovecot_login authenticator failed for H=([186.32.75.127]) [186.32.75.127]:41810: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-26 12:23:14 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess5696687972/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.225.217.184
country_id: 1269750
description:
Jan 26 12:23:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.225.217.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-26 12:23:49 H=([77.83.39.187]) [77.83.39.187]:53899 F=<info@sykboya.com> rejected RCPT <info@mkmetal.com.my>: SPF: 77.83.39.187 is not allowed to send mail from sykboya.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-26 12:25:50 H=([77.83.39.187]) [77.83.39.187]:57471 F=<info@sykboya.com> rejected RCPT <kasim_kn@ajplantations.com.my>: SPF: 77.83.39.187 is not allowed to send mail from sykboya.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 12:26:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51986: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Jan 26 12:26:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Jan 26 12:28:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.142.124
country_id: 1733045
description:
[2026-01-26 12:29:00 +0800] info [webmaild] 42.191.142.124 - nazurah@fkr.com.my "GET /cpsess3649793910/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [42.191.134.208] != Current IP Address [42.191.142.124]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - mustapa@astlog.com.my [01/26/2026:04:30:56 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: mustapa@astlog.com.my


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.187
country_id: 690791
description:
2026-01-26 12:31:41 H=([77.83.39.187]) [77.83.39.187]:51740 F=<info@sykboya.com> rejected RCPT <leeyw@fkr.com.my>: SPF: 77.83.39.187 is not allowed to send mail from sykboya.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 12:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:19028: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 104.236.196.180
country_id: 6252001
description:
Jan 26 12:31:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 104.236.196.180 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.142.124
country_id: 1733045
description:
[2026-01-26 12:32:33 +0800] info [webmaild] 42.191.142.124 - nazurah@fkr.com.my "GET /cpsess3649793910/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 12:33:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:32650: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-26 12:34:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:62242: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-26 12:34:36 H=([10.1.1.176]) [60.54.167.90]:49351 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Jan 26 12:42:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.235.151
country_id: 1562822
description:
Jan 26 12:44:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.122
country_id: 3865483
description:
Jan 26 12:47:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.210
country_id: 2510769
description:
Jan 26 12:48:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.113.84
country_id: 3996063
description:
Jan 26 12:48:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.113.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/team.php||SC:/home/indfinitydesign/public_html/img/photos/team.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-26 12:50:51 H=([10.1.1.176]) [60.54.167.90]:49502 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.177
country_id: 1269750
description:
Jan 26 12:53:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.177 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 12:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52049: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.85.254
country_id: 3469034
description:
Jan 26 12:54:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.85.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.243.89.60
country_id: 3585968
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpdocumentor/reflection-common/src/File.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 12:57:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.235.83
country_id: 3865483
description:
Jan 26 12:57:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.235.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 12:59:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:19600: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 13:00:49 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:26461: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 13:01:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:26462: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 162.216.166.75
country_id: 3489940
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/resources.xlf HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.123.0.191
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=7&sub=42 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:05:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.145
country_id: 3469034
description:
Jan 26 13:06:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.145
country_id: 3469034
description:
Jan 26 13:06:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:10:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.195.77.177
country_id: 1835841
description:
2026-01-26 13:18:39 dovecot_login authenticator failed for H=([119.195.77.177]) [119.195.77.177]:49378: 535 Incorrect authentication data (set_id=finance@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:18:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 13:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52077: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-26 13:23:15 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:34797: 535 Incorrect authentication data (set_id=finance@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:23:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 13:27:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:19605: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.101
country_id: 1269750
description:
Jan 26 13:29:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 13:29:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:26465: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 13:29:23 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.49.173
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-29.109.248.49.173||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.172.6
country_id: 1733045
description:
[2026-01-26 13:30:59 +0800] info [webmaild] 175.139.172.6 - pft_rnd@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.172.6
country_id: 1733045
description:
[2026-01-26 13:31:00 +0800] info [webmaild] 175.139.172.6 - pft_rnd@pftfood.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:31:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.141.24.5
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/sfComments.yml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.10.205
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=6672338432 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:36:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.28.247.66
country_id: 290557
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/images/c-4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 13:43:26 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.251
country_id: 3469034
description:
Jan 26 13:44:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.151.169
country_id: 99237
description:
Jan 26 13:44:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.151.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:45:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.13.194.107
country_id: 1282988
domain: empirelog.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.empirelog.com.my||ServerName:empirelog.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:49:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-26 13:49:46 H=([10.1.1.176]) [60.54.167.90]:49895 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 13:50:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52104: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.52
country_id: 953987
description:
Jan 26 13:51:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.3
country_id: 732800
description:
Jan 26 13:51:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.193
country_id: 3469034
description:
Jan 26 13:51:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.3
country_id: 732800
description:
Jan 26 13:52:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.3 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.22
country_id: 6252001
description:
2026-01-26 13:54:48 752551 [Warning] Aborted connection 752551 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.22' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.149
country_id: 3469034
description:
Jan 26 13:55:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 13:55:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:19609: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.14
country_id: 3175395
description:
Jan 26 13:55:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.222
country_id: 1269750
description:
Jan 26 13:55:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.237
country_id: 933860
description:
Jan 26 13:56:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.23
country_id: 2300660
description:
Jan 26 13:56:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.23 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 13:57:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:26470: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 13:58:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 191.102.187.99
country_id: 6252001
description:
[2026-01-26 14:00:53 +0800] info [webmaild] 191.102.187.99 - hvoon@stonewld.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 186.179.47.107
country_id: 6252001
description:
[2026-01-26 14:00:54 +0800] info [webmaild] 186.179.47.107 - stonewld@stonewld.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:03:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-26 14:03:15 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:44052: 535 Incorrect authentication data (set_id=team@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-26 14:06:00 H=([77.83.39.167]) [77.83.39.167]:57878 F=<stevenwelboun@op.pl> rejected RCPT <fkr@fkr.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.54.15.6
country_id: 1149361
description:
Jan 26 14:06:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.54.15.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.54.15.6
country_id: 1149361
description:
2026-01-26 14:06:40 dovecot_login authenticator failed for H=([149.54.15.6]) [149.54.15.6]:36627: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.150.37.5
country_id: 1605651
description:
[2026-01-26 14:07:18 +0800] info [cpaneld] 203.150.37.5 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:12:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - accounts@evergrown.com.my [01/26/2026:06:15:04 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: accounts@evergrown.com.my


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.217
country_id: 1733045
description:
[2026-01-26 14:16:02 +0800] info [webmaild] 27.125.243.217 - cmchin@chs.com.my "GET /cpsess0066879756/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.246.48] != Current IP Address [27.125.243.217]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 27.125.243.137
country_id: 1733045
description:
[2026-01-26 14:16:09 +0800] info [webmaild] 27.125.243.137 - cmchin@chs.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:16:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 119.73.99.63
country_id: 1168579
domain: euratech.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:15734.euratech.com.my||ServerName:euratech.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1dd9a84b8f1812ae85ebcd607bf014f312b799ca||Title:0x55ace4c0||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 14:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52141: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.78
country_id: 690791
description:
2026-01-26 14:18:07 H=([77.83.39.78]) [77.83.39.78]:55014 F=<Purchase@bangpapers.in> rejected RCPT <cklee@ktlog.com.my>: SPF: 77.83.39.78 is not allowed to send mail from bangpapers.in


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.178.185.141
country_id: 1835841
description:
Jan 26 14:19:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.178.185.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.178.185.141
country_id: 1835841
description:
2026-01-26 14:19:41 dovecot_login authenticator failed for H=([121.178.185.141]) [121.178.185.141]:58006: 535 Incorrect authentication data (set_id=team@manforce.net)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - accounts@evergrown.com.my [01/26/2026:06:21:13 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: accounts@evergrown.com.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 14:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:19617: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.103.184
country_id: 3469034
description:
Jan 26 14:23:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.103.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 14:25:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27034: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:25:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 26 14:25:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.183.82.70
country_id: 2017370
description:
Jan 26 14:26:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.183.82.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 26 14:26:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:30:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.106.155.11
country_id: 798544
description:
Jan 26 14:31:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.106.155.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.189
country_id: 3469034
description:
Jan 26 14:31:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:38:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - accounts@evergrown.com.my [01/26/2026:06:40:54 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: accounts@evergrown.com.my


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 14:40:31 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.49
country_id: 3469034
description:
Jan 26 14:41:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.49 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 14:42:29 +0800] info [webmaild] 203.106.96.63 - info@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:43:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 98.97.61.151
country_id: 6252001
description:
[2026-01-26 14:43:37 +0800] info [webmaild] 98.97.61.151 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.52
country_id: 690791
description:
2026-01-26 14:44:58 H=([45.144.212.52]) [45.144.212.52]:64997 F=<ops@gearbulkshipping.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.52 is not allowed to send mail from gearbulkshipping.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 14:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52160: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 14:46:44 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.142.124
country_id: 1733045
description:
[2026-01-26 14:47:37 +0800] info [webmaild] 42.191.142.124 - cheahbanfoo@fkr.com.my "GET /cpsess2841490057/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [42.191.134.208] != Current IP Address [42.191.142.124]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.180.10.209
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.189.39.34
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.155.110
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 14:51:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:19625: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.48.84.80
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.18.165.7
country_id: 2464461
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.183.32.201
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 14:51:47 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.116.50
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.146.115.71
country_id: 587116
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.150.238
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.76.14.184
country_id: 2963597
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.237.153.142
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.96.0.120
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/article/22613/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 58.186.27.89
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-52.58.186.27.89||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:52:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 14:53:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27040: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 14:54:24 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.48
country_id: 3057568
description:
Jan 26 14:57:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.48 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 14:57:47 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.84
country_id: 2510769
description:
Jan 26 14:57:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 14:57:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.251.154
country_id: 3469034
description:
Jan 26 14:57:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.251.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.48
country_id: 3057568
description:
Jan 26 14:58:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.43
country_id: 298795
description:
Jan 26 15:00:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.203
country_id: 3865483
description:
Jan 26 15:00:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.203 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.142.124
country_id: 1733045
description:
[2026-01-26 15:00:58 +0800] info [webmaild] 42.191.142.124 - wongss28@fkr.com.my "GET /cpsess6997394333/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [42.191.134.208] != Current IP Address [42.191.142.124]


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - accounts@evergrown.com.my [01/26/2026:07:01:34 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: accounts@evergrown.com.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.190.167.203
country_id: 3865483
description:
Jan 26 15:01:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.190.167.203 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.92.9
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=629851 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 15:02:26 H=([45.144.212.242]) [45.144.212.242]:57953 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.66.56
country_id: 1733045
description:
[2026-01-26 15:03:52 +0800] info [webmaild] 183.171.66.56 - rabileh@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 15:06:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:06:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:07:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:09:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 15:11:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:11:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.200
country_id: 1269750
description:
Jan 26 15:13:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:13:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.47.136.126
country_id: 3175395
description:
Jan 26 15:13:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.47.136.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.144.255.208
country_id: 2542007
description:
Jan 26 15:14:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.144.255.208 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 15:14:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52194: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.182.73.131
country_id: 1835841
description:
Jan 26 15:14:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.182.73.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:15:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 13.58.10.7
country_id: 6252001
domain: www.sutsb.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/mailto:sutsbsales@gmail.commailto:sutsbsales@gmail.commailto:sutsbsales@gmail.commailto:sutsbsales@gmail.commailto:sutsbsales@gmail.commailto:sutsbsales@gmail.commailto:sutsbsales@gmail.commailto:sutsbsales@gmail.com||User:sutsbcom||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.45
country_id: 1733045
description:
[2026-01-26 15:16:18 +0800] info [webmaild] 113.211.37.45 - chuan@tschuan.com "GET /cpsess1903874427/3rdparty/roundcube/?_task=mail&_mbox=INBOX.spam HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:17:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:18:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 15:19:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:19637: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:20:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 51.75.142.157
country_id: 3017382
description:
Jan 26 15:20:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 51.75.142.157 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.230
country_id: 2510769
description:
Jan 26 15:20:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 51.75.142.157
country_id: 3017382
description:
2026-01-26 15:20:39 dovecot_login authenticator failed for H=157.ip-51-75-142.eu [51.75.142.157]:48196: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.183
country_id: 3865483
description:
Jan 26 15:20:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 15:20:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 15:21:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27045: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-26 15:21:39 H=([45.144.212.50]) [45.144.212.50]:54112 F=<advising.service@advising.hsbc.com> rejected RCPT <astmyy@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.0.97.171
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nesbot/carbon/src/Carbon/CarbonPeriod.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:22:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:24:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 15:25:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:26:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.78.162
country_id: 3469034
description:
Jan 26 15:27:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.98
country_id: 3469034
description:
Jan 26 15:28:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.78.162
country_id: 3469034
description:
Jan 26 15:28:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.125
country_id: 798544
description:
Jan 26 15:28:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:28:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.87
country_id: 2510769
description:
Jan 26 15:28:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 26 15:29:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 15:29:04 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.98
country_id: 3469034
description:
Jan 26 15:29:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.44
country_id: 3865483
description:
Jan 26 15:31:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.167
country_id: 3175395
description:
Jan 26 15:31:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.35
country_id: 1269750
description:
Jan 26 15:31:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.69.9.35
country_id: 1269750
description:
Jan 26 15:32:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.69.9.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.119.177.22
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/friend/9/112/939910 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 15:32:13 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 15:33:35 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 15:34:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.95.233.28
country_id: 3017382
description:
2026-01-26 15:34:26 757034 [Warning] Aborted connection 757034 to db: 'unconnected' user: 'unauthenticated' host: '45.95.233.28' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 15:34:50 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.39.13.220
country_id: 1168579
description:
Jan 26 15:36:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.39.13.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.39.13.220
country_id: 1168579
description:
2026-01-26 15:36:59 dovecot_plain authenticator failed for H=(58F1THHLM15) [110.39.13.220]:52700: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.39.13.220
country_id: 1168579
description:
Jan 26 15:37:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.39.13.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.39.13.220
country_id: 1168579
description:
2026-01-26 15:37:05 dovecot_login authenticator failed for H=(58F1THHLM15) [110.39.13.220]:52700: 535 Incorrect authentication data (set_id=hafizi@essemgroup.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 15:38:23 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 15:38:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 15:40:10 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.125
country_id: 798544
description:
Jan 26 15:41:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.92.222.125
country_id: 798544
description:
Jan 26 15:42:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.92.222.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 15:42:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52218: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 26 15:42:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.176.220
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/vcr.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 131.226.108.49
country_id: 1694008
description:
2026-01-26 15:43:34 dovecot_plain authenticator failed for H=(GXA8DC) [131.226.108.49]:35783: 535 Incorrect authentication data (set_id=hhling@af-sb.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.249.48.133
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-46.104.249.48.133||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 15:47:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:19653: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 15:47:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 15:49:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27053: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 15:49:55 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-26 15:50:39 H=([10.1.1.176]) [60.54.167.90]:51176 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.45
country_id: 6252001
description:
2026-01-26 15:50:36 757745 [Warning] Aborted connection 757745 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.45' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-26 15:51:34 H=([10.1.1.176]) [60.54.167.90]:51194 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.107.102
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-51.152.44.107.102||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 15:52:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 60.54.167.90
country_id: 1733045
description:
2026-01-26 15:56:40 H=([10.1.1.176]) [60.54.167.90]:51238 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<jasonkua@printspecsolution.com> A=dovecot_login:jasonkua@printspecsolution.com rejected RCPT <era@printspecsolution.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.179.176
country_id: 192950
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Tests/Output/OutputTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 16:01:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.81
country_id: 1269750
description:
Jan 26 16:02:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/about-us/images/resource/product.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.159.82
country_id: 690791
description:
Jan 26 16:02:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.159.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jan 26 16:03:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.39.53
country_id: 953987
description:
Jan 26 16:03:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.39.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.231.208.208
country_id: 1282988
description:
2026-01-26 16:03:51 dovecot_plain authenticator failed for H=(42.0.28.25) [43.231.208.208]:60706: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.119.157.252
country_id: 6252001
description:
2026-01-26 16:05:11 dovecot_plain authenticator failed for H=(mail.agpc.org.my) [68.119.157.252]:49864: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 16:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52243: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.187
country_id: 1269750
description:
Jan 26 16:12:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.187
country_id: 1269750
description:
Jan 26 16:13:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.6.11.184
country_id: 1814991
description:
Jan 26 16:13:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.6.11.184 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.6.11.184
country_id: 1814991
description:
2026-01-26 16:13:19 dovecot_login authenticator failed for H=([112.6.11.184]) [112.6.11.184]:47365: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.17.124.75
country_id: 1269750
description:
Jan 26 16:13:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.17.124.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.17.124.75
country_id: 1269750
description:
2026-01-26 16:13:43 dovecot_login authenticator failed for H=([14.96.29.14]) [125.17.124.75]:51042: 535 Incorrect authentication data (set_id=salesi)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-26 16:14:02 H=([77.83.39.167]) [77.83.39.167]:58010 F=<stevenwelboun@op.pl> rejected RCPT <inquiries@ktlog.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 16:15:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.244.7.69
country_id: 1282988
description:
2026-01-26 16:15:38 dovecot_plain authenticator failed for H=(42.0.28.70) [49.244.7.69]:56347: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 16:15:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:20218: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.66.146.67
country_id: 6252001
description:
2026-01-26 16:15:51 dovecot_plain authenticator failed for H=99-66-146-67.lightspeed.sntcca.sbcglobal.net (cofreth.com.my) [99.66.146.67]:55425: 535 Incorrect authentication data (set_id=zulkifli.abdul-mutalib@cofreth.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 16:17:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27061: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.71.89.208
country_id: 3469034
description:
Jan 26 16:18:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.71.89.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.23.47.229
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-19.113.23.47.229||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 16:19:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.9.5
country_id: 2300660
description:
Jan 26 16:19:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.9.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.17
country_id: 690791
description:
2026-01-26 16:20:01 H=([77.83.39.17]) [77.83.39.17]:53971 F=<sales@projate.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 16:21:09 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.167
country_id: 298795
description:
Jan 26 16:24:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 16:24:45 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.221
country_id: 1269750
description:
Jan 26 16:24:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.177.204.4
country_id: 1269750
description:
Jan 26 16:25:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.177.204.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.177.204.4
country_id: 1269750
description:
2026-01-26 16:25:19 dovecot_login authenticator failed for H=([103.177.204.4]) [103.177.204.4]:35760: 535 Incorrect authentication data (set_id=zahari@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.48
country_id: 3469034
description:
Jan 26 16:26:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.48
country_id: 3469034
description:
Jan 26 16:27:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 16:29:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.155.155
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Multi Purpose  M - External Carton Size-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.155.155
country_id: 1880251
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Multi Purpose  M - External Carton Size-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - urban [01/26/2026:08:33:12 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: urban


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 16:33:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.235.78.6
country_id: 1168579
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 193.177.241.167
country_id: 298795
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.55.95.250
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.177.220
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.138.59
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.252.92.103
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.72.137.38
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.250.206
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.117.19
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.171.13
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.254.5
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.229.132.90
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/search/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.37.48.100
country_id: 1269750
description:
2026-01-26 16:37:30 dovecot_plain authenticator failed for H=(8HRKD1AKEBBNP) [49.37.48.100]:63794: 535 Incorrect authentication data (set_id=kelveen@tst-ma.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 16:38:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52267: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-26 16:38:45 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:47791: 535 Incorrect authentication data (set_id=nicole.lim@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/monthlyletter/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.179.189.201
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.10.120
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.105.157.227
country_id: 2589581
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 116.204.229.246
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.242.55.97
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.205.69.117
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.184.62.139
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.130.12
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.105.0
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.219.24.110
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.26
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.154.38.56
country_id: 3686110
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/fullindex/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.239.20.93
country_id: 1562822
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/shop.php?id=1&sub=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 16:43:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:20229: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 16:43:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.38
country_id: 2658434
description:
2026-01-26 16:44:39 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [79.142.79.38]:6836: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 16:44:53 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27067: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 16:45:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27068: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.38
country_id: 2658434
description:
2026-01-26 16:45:19 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [79.142.79.38]:59941: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 16:46:18 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 16:47:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-26 16:48:57 H=([77.83.39.167]) [77.83.39.167]:59792 F=<stevenwelboun@op.pl> rejected RCPT <gopro@oxbold.com>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.22.245.6
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event-single.php?id=702312 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 16:56:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.208
country_id: 2510769
description:
Jan 26 16:57:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.208 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.218
country_id: 1269750
description:
Jan 26 16:57:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.218
country_id: 1269750
description:
Jan 26 16:58:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:01:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.238
country_id: 3469034
description:
Jan 26 17:02:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.238
country_id: 3469034
description:
Jan 26 17:03:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.180
country_id: 3469034
description:
Jan 26 17:03:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.205.208
country_id: 99237
description:
Jan 26 17:03:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.205.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.190.136.174
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.44.197.37
country_id: 6251999
description:
[2026-01-26 17:04:53 +0800] info [cpaneld] 45.44.197.37 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.40.130
country_id: 226074
description:
Jan 26 17:06:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.40.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 17:06:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52296: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - import-air@urban.my [01/26/2026:09:07:30 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: import-air@urban.my


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.228.168.12
country_id: 1327865
description:
2026-01-26 17:07:37 dovecot_login authenticator failed for H=([136.228.168.12]) [136.228.168.12]:59271: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jan 26 17:07:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-26 17:07:59 H=(localhost.localdomain) [78.153.140.207]:37716 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.40.130
country_id: 226074
description:
Jan 26 17:07:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.40.130 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.228.168.12
country_id: 1327865
description:
Jan 26 17:07:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.228.168.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.139.220
country_id: 1880251
domain: appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/http-kernel/Tests/DataCollector/Compiler.log||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.72.24.250
country_id: 51537
description:
Jan 26 17:08:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.72.24.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.194
country_id: 1269750
description:
Jan 26 17:08:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-01-26 17:08:04 dovecot_login authenticator failed for H=([122.187.229.194]) [122.187.229.194]:52066: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.227
country_id: 3469034
description:
Jan 26 17:08:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.227 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-26 17:10:24 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 17:11:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:20244: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:11:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 17:13:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27078: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.18.148.10
country_id: 1814991
description:
Jan 26 17:14:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.18.148.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.18.148.10
country_id: 1814991
description:
2026-01-26 17:14:07 dovecot_login authenticator failed for H=(hebei.18.121.in-addr.arpa) [121.18.148.10]:44006: 535 Incorrect authentication data (set_id=zahari@essemgroup.net)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices (wait ms kho to check)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">done keyin payment journals (wait ms kho to check)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">open sales inv to pob jan'26</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-26 17:14:48 +0800] info [cpaneld] 202.178.120.157 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:16:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 110.44.115.143
country_id: 1282988
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/680548.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 142.93.59.30
country_id: 6252001
description:
2026-01-26 17:20:59 761023 [Warning] Aborted connection 761023 to db: 'unconnected' user: 'unauthenticated' host: '142.93.59.30' (This connection closed normally without authentication)


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - hfkwok@mckd.com.my [01/26/2026:09:22:46 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: hfkwok@mckd.com.my


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.12.56.109
country_id: 3057568
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/about_us.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 2501
name: User authentication failure.
description:
127.0.0.1 - test@urban.my [01/26/2026:09:24:51 -0000] "PROPFIND" FAILED LOGIN cpdavd: Authentication failed for user: test@urban.my


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:25:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 17:25:44 H=([45.144.212.242]) [45.144.212.242]:64735 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.241.52.17
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-26.171.241.52.17||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.97.165
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=678166 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.128
country_id: 3175395
description:
Jan 26 17:29:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.128
country_id: 3175395
description:
Jan 26 17:30:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:30:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 202.184.71.73
country_id: 1733045
description:
Jan 26 17:32:44 sv3 pure-ftpd[1257838]: (myfurnit@202.184.71.73) [NOTICE] /home/myfurnit//public_html/7pcmore28.html uploaded  (9463 bytes, 1328.14KB/sec)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do released s/o jack and ryan &amp; sc chabb qutie for albert</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->posted assembly orders</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do posting sales invoices &amp; filing sales invoice</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->send soa nov&rsquo;25 - dec&rsquo;25 for berjaya hills</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do sales return</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do interco sales order mar a&rsquo;26 for 18d</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.212
country_id: 2921044
description:
2026-01-26 17:33:47 H=([91.92.240.212]) [91.92.240.212]:54321 F=<Susanne.Meister@buderus.de> rejected RCPT <shipping@cordage.com.my>: SPF: 91.92.240.212 is not allowed to send mail from buderus.de


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 17:34:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52316: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>monday 26-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival worksheet and checking validity of ip.</li>\r\n<li>preparing loi for import shipment</li>\r\n<li>preparing coo and arrangging runner for original cert collection.</li>\r\n<li>follow up with 18d agent on updated form e provided by kk.&nbsp;</li>\r\n<li>place fumigation booking for phosphine treatment.</li>\r\n<li>checking rates for alfalfa sample to tpl and get confirmation with jonathan is phyto cert required for samples.</li>\r\n<li>update invoice record, sorting and pass to finance for posting purpose.</li>\r\n<li>update tpy import schedule</li>\r\n<li>re-arrange caltech order to go by lcl</li>\r\n<li>preparing shipping document for cody james</li>\r\n<li>checking on tracking for courier shipment</li>\r\n<li>start to prepare shipping document for the incoming shipment.</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:39:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.235.38.158
country_id: 3895114
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/application/themes/bishop/images/drag-to-explore-icon.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.67.54
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-more.php?id=608309 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.217.238.241
country_id: 732800
description:
Jan 26 17:39:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.217.238.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.74.180
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.95.109.76
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/images/casual.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.122.94.95
country_id: 3437598
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/images/logoo-cabee.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.254.167.85
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/concrete/js/jquery.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 17:39:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:20261: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.13.173.18
country_id: 3865483
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/application/js/home.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.225.162.245
country_id: 3996063
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/images/cafe.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.237.196.205
country_id: 1527747
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/images/foodcourt.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 17:41:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27083: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-26 17:43:09 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:58449: 535 Incorrect authentication data (set_id=joanne@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:44:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.86.55.52
country_id: 1168579
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.95.63
country_id: 1562822
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/images/logo-white.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.141.151
country_id: 3658394
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/images/select-arrow.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.1.67.236
country_id: 3865483
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/coolcaptcha/captcha.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.93.98
country_id: 1269750
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/assets/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 17:47:41 H=([45.144.212.242]) [45.144.212.242]:61128 F=<lynnied@mhtc.net> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:54:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.66
country_id: 3175395
description:
Jan 26 17:54:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.78
country_id: 690791
description:
2026-01-26 17:54:39 H=([77.83.39.78]) [77.83.39.78]:61291 F=<Purchase@bangpapers.in> rejected RCPT <cklee@ktlog.com.my>: SPF: 77.83.39.78 is not allowed to send mail from bangpapers.in


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.219
country_id: 3469034
description:
Jan 26 17:55:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.218
country_id: 2300660
description:
Jan 26 17:55:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.218
country_id: 2300660
description:
Jan 26 17:56:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.253.17.130
country_id: 2510769
description:
Jan 26 17:57:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.253.17.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 17:57:10 H=([45.144.212.242]) [45.144.212.242]:57710 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 17:59:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-26 18:00:44 H=([46.151.182.48]) [46.151.182.48]:51175 F=<cpanel@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 18:01:29 H=([45.144.212.242]) [45.144.212.242]:56277 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 18:02:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54253: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.87.72.227
country_id: 1527747
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/finder/phpunit.xml.dist HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-26 18:06:09 H=(localhost.localdomain) [78.153.140.207]:46936 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:06:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/m.me/images/private-residence.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-26 18:07:25 H=([46.151.182.48]) [46.151.182.48]:59901 F=<cpanel@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:07:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 18:07:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:20274: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 18:09:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27090: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 18:09:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 156.47.167.106
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-10.156.47.167.106||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.11
country_id: 2300660
description:
Jan 26 18:10:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 18:10:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 18:13:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.161
country_id: 2993457
description:
Jan 26 18:14:11 sv3 pure-ftpd[1310347]: (?@194.165.16.161) [INFO] New connection from 194.165.16.161


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.188
country_id: 1814991
description:
Jan 26 18:14:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.188 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.188
country_id: 1814991
description:
2026-01-26 18:14:35 dovecot_login authenticator failed for H=([111.61.177.188]) [111.61.177.188]:48600: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:18:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.62.69.205
country_id: 1733045
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/tests/Hamcrest/Xml HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.40
country_id: 2750405
description:
2026-01-26 18:18:42 H=([185.214.10.40]) [185.214.10.40]:58536 F=<info@aircarbonic.my> rejected RCPT <info@aircarbonic.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/monthlyletter/images/product.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:19:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.156.2.229
country_id: 1835841
description:
Jan 26 18:20:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.156.2.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.156.2.229
country_id: 1835841
description:
2026-01-26 18:20:19 dovecot_login authenticator failed for H=([218.156.2.230]) [218.156.2.229]:59913: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.63.104
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Multi Purpose  M - External Carton Size-120x120.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.63.104
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Multi Purpose  M - External Carton Size-120x120.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.211.213.190
country_id: 2510769
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-tnc.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 18:21:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.210.220.10
country_id: 192950
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/mime_types.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 18:23:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 18:28:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.220.250.167
country_id: 1814991
description:
2026-01-26 18:29:29 dovecot_login authenticator failed for H=([120.220.250.167]) [120.220.250.167]:52987: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:29:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.220.250.167
country_id: 1814991
description:
Jan 26 18:29:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.220.250.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 18:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:54281: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:31:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.247.10.181
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/Formatter/MessageFormatterInterface.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 18:32:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.134
country_id: 798544
description:
Jan 26 18:33:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.213.126
country_id: 798544
description:
Jan 26 18:33:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.213.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-26 18:33:39 H=([46.151.182.48]) [46.151.182.48]:56899 F=<cpanel@astlog.com.my> rejected RCPT <info@astlog.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.223.91
country_id: 1562822
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/Untitled-6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.213.126
country_id: 798544
description:
Jan 26 18:34:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.213.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 18:35:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:20844: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.72
country_id: 3865483
description:
Jan 26 18:35:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.252.72
country_id: 3865483
description:
Jan 26 18:36:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.252.72 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 210.195.226.156
country_id: 1733045
description:
Jan 26 18:36:05 sv3 pure-ftpd[1332653]: (?@210.195.226.156) [INFO] New connection from 210.195.226.156


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 210.195.226.156
country_id: 1733045
description:
Jan 26 18:36:12 sv3 pure-ftpd[1332782]: (oxboldc@210.195.226.156) [NOTICE] /home/oxboldc//public_html/standuppaddlelesson-tasiksaujanaputra.htm uploaded  (113968 bytes, 4049.35KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 18:37:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27654: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 18:38:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 35.212.230.198
country_id: 6252001
domain: vc-b.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/mailto:info@yourdomain.com||User:vcbcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:41:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 18:41:28 H=([45.144.212.242]) [45.144.212.242]:60099 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up container truck in and out arrangement.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up tracking details of hardcopy docs from havens.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send pre alert to irc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">share do to ffc for endorsement.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up revised invoice from greenpen.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up final bl from greenpen.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up revised bl draft from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up vessel schedule from havens.</span></li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:42:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 18:43:39 H=([45.144.212.242]) [45.144.212.242]:52187 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 18:43:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 18:43:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.121.17.150
country_id: 1733045
description:
Jan 26 18:46:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.121.17.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.121.17.150
country_id: 1733045
description:
2026-01-26 18:46:15 dovecot_login authenticator failed for H=([175.143.6.101]) [121.121.17.150]:51399: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 18:47:03 H=([45.144.212.242]) [45.144.212.242]:59234 F=<no_reply@admin.com> rejected RCPT <info@pftfood.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 18:48:41 H=([45.144.212.242]) [45.144.212.242]:65012 F=<no_reply@admin.com> rejected RCPT <sale@langkawiconstructions.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 18:49:46 H=([38.240.43.48]) [38.240.43.48]:58979 F=<inquiry@polestarworldwide.ae> rejected RCPT <inquiries@ktlog.com.my>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/type-writter.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/bootstrap.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.39
country_id: 953987
description:
Jan 26 18:50:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.3.9 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/font-awesome.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/flaticon.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/all.min.css?ver=6.6.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.65.224
country_id: 3895114
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/portfolios/tesco-hypermarket-melaka/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/fonts/Flaticon.woff HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.39
country_id: 953987
description:
Jan 26 18:51:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 18:52:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:53:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 18:54:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 18:54:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 18:57:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 18:58:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49437: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.45.216
country_id: 953987
description:
Jan 26 19:00:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.45.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.194.8.107
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/tinker/src/ClassAliasAutoloader.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 19:03:33 H=([45.144.212.242]) [45.144.212.242]:65455 F=<no_reply@admin.com> rejected RCPT <info@sutsb.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-26 19:03:52 H=([45.144.212.7]) [45.144.212.7]:64413 F=<shripadh@rightmindset.ae> rejected RCPT <sales@acburn.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-26 19:03:02 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:35347: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 19:03:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:20861: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-26 19:04:02 H=([46.151.182.48]) [46.151.182.48]:62743 F=<cpanel@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 19:05:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.126.203
country_id: 1733045
description:
2026-01-26 19:05:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.126.203]:27658: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 19:05:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 19:06:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.40
country_id: 2750405
description:
2026-01-26 19:07:42 H=([185.214.10.40]) [185.214.10.40]:63353 F=<info@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.93
country_id: 3175395
description:
Jan 26 19:07:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 19:07:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.93
country_id: 3175395
description:
Jan 26 19:08:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.196.87
country_id: 798544
description:
Jan 26 19:08:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.196.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.154.36
country_id: 99237
description:
Jan 26 19:11:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.154.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.233
country_id: 3175395
description:
Jan 26 19:11:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 19:12:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.19.239
country_id: 2300660
description:
Jan 26 19:13:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.19.239 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 19:14:36 H=([45.144.212.242]) [45.144.212.242]:56839 F=<no_reply@admin.com> rejected RCPT <account@hmz.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 19:16:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/introduction-service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 19:16:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.233.182.39
country_id: 1835841
description:
Jan 26 19:17:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.233.182.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.233.182.39
country_id: 1835841
description:
2026-01-26 19:17:03 dovecot_login authenticator failed for H=([218.233.182.39]) [218.233.182.39]:6173: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.105
country_id: 2921044
description:
Jan 26 19:18:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 19:21:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-26 19:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49477: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.196.87
country_id: 3469034
description:
Jan 26 19:26:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.196.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.62.211.15
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-26.158.62.211.15||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 19:26:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.170.149
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.3.74
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.224.13.223
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.108.245
country_id: 1512440
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.147.180
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 145.255.179.114
country_id: 1522867
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 19:27:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.15.155.116
country_id: 1210997
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.150.66.80
country_id: 3585968
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.5.255
country_id: 1269750
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 66.128.34.150
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.135.31.212
country_id: 1733045
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.63.226.80
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.7
country_id: 690791
description:
2026-01-26 19:28:14 H=([45.144.212.7]) [45.144.212.7]:65466 F=<chaimaahafez@icon-logistic.com> rejected RCPT <marketing@wcc.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 19:36:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.62.227
country_id: 1562822
domain: www.ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ds-staffing.com/about.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.121
country_id: 130758
description:
Jan 26 19:38:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.121 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 85.121.5.30
country_id: 798549
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X15; Linux aarch64) AppleWebKit/537.31 (KHTML, like Gecko) HeadlessChrome/120.7.6099.224 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.8
country_id: 2300660
description:
Jan 26 19:41:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 19:41:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.159.26
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/empty.ini||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 50.114.201.66
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/images/ISO 15001-2011.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.116.199.61
country_id: 1269750
description:
Jan 26 19:50:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.116.199.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.4
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/tmpfiles.d/systemd.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.5
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/sysusers.d/pipewire.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.28.246.147
country_id: 1605651
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-52.104.28.246.147||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.25
country_id: 3469034
description:
Jan 26 19:52:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.25
country_id: 3469034
description:
Jan 26 19:53:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.184
country_id: 298795
description:
Jan 26 19:53:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.184 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-26 19:55:02 766165 [Warning] Aborted connection 766165 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.88.112.192
country_id: 2328926
domain: www.cofreth.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:102.88.112.192||TA:102.88.112.192||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 1.55.19.238
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-57.1.55.19.238||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 20:00:14 H=([45.144.212.242]) [45.144.212.242]:50718 F=<lynnied@mhtc.net> rejected RCPT <asttwu@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.191.135
country_id: 286963
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/dnoegel/php-xdg-base-dir/LICENSE HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.155.182
country_id: 2921044
description:
2026-01-26 20:06:01 dovecot_plain authenticator failed for H=(DESKTOP-22EVPBQ) [104.28.155.182]:13968: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.100
country_id: 953987
description:
Jan 26 20:06:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.196
country_id: 798544
description:
Jan 26 20:06:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 42.115.61.9
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-07.42.115.61.9||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.208.174
country_id: 2921044
description:
Jan 26 20:07:45 sv3 pure-ftpd[1402194]: (?@158.94.208.174) [INFO] New connection from 158.94.208.174


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.143.6.98
country_id: 1733045
description:
Jan 26 20:08:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.143.6.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.143.6.98
country_id: 1733045
description:
2026-01-26 20:08:50 dovecot_login authenticator failed for H=([175.143.6.101]) [175.143.6.98]:33383: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.226.73
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/hamcrest/hamcrest-php/hamcrest/Hamcrest/Arrays HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.130.159.15
country_id: 1522867
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/hamcrest/hamcrest-php/hamcrest/Hamcrest/Arrays/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.66.124.102
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Mock.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.194.92
country_id: 1733045
description:
2026-01-26 20:15:24 dovecot_plain authenticator failed for H=(smtpclient.apple) [104.28.194.92]:25909: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.195
country_id: 3077311
description:
2026-01-26 20:16:59 dovecot_plain authenticator failed for H=([10.7.18.68]) [212.102.39.195]:40110: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.195
country_id: 3077311
description:
2026-01-26 20:17:05 dovecot_login authenticator failed for H=([10.7.18.68]) [212.102.39.195]:40110: 535 Incorrect authentication data (set_id=2095central@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.63.121
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Multi Purpose  L - External Carton Size-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.63.121
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Multi Purpose  L - External Carton Size-250x250.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.128.246.134
country_id: 690791
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/dsc-expat.com/announcement-detail.php?id=746934 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.10.47.230
country_id: 1605651
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-31.200.10.47.230||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-26 20:32:18 H=([45.144.212.41]) [45.144.212.41]:53140 F=<powerbiz@emirates.net.ae> rejected RCPT <cklee@ktlog.com.my>: SPF: 45.144.212.41 is not allowed to send mail from emirates.net.ae


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.54.25.143
country_id: 458258
description:
86.54.25.143 - - [26/Jan/2026:20:36:02 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=12753511&pdata=https%253A%252F%252Ftujusetia.my%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769430961 HTTP/2.0" 302 0 tujusetia.my "https://tujusetia.my:2096/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.54.25.143


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.54.25.143
country_id: 458258
description:
[2026-01-26 20:36:05 +0800] info [webmaild] 86.54.25.143 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.76.125
country_id: 3469034
description:
Jan 26 20:36:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.76.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.109.175.63
country_id: 3469034
description:
Jan 26 20:37:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.109.175.63 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.132.114.81
country_id: 3865483
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.228.175.226
country_id: 3865483
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.34.100
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/icon_subwin02.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.103.62.165
country_id: 2589581
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/tmain01_eng.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.198.117.231
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/slidernavright.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.191.103
country_id: 2245662
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/tautomatic02.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.203.253.61
country_id: 290557
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/subnav63.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.184.57.0
country_id: 6254930
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/arrow01.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.222.222.238
country_id: 3865483
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/subnav61.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.139.152.17
country_id: 1282988
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/tmain02.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.152.148
country_id: 99237
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/slidernavleft.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.242.196
country_id: 1269750
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/subnav32.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.186.29.132
country_id: 3996063
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/icon_subwin.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.234.213.230
country_id: 3469034
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/subnav31.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.79.8
country_id: 1269750
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/btn_totop.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.237.136.74
country_id: 732800
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/tcomponent02.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.229.122.165
country_id: 2029969
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/btn_search.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.239
country_id: 3175395
description:
Jan 26 20:37:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.176.2.198
country_id: 3865483
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/icon_region.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.49.61.104
country_id: 3865483
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/subnav62.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.80.51.170
country_id: 3378535
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/arrow07.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.163.172
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.239
country_id: 3175395
description:
Jan 26 20:38:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.138.16.219
country_id: 798544
description:
Jan 26 20:38:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.138.16.219 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.138.16.219
country_id: 798544
description:
2026-01-26 20:38:15 dovecot_plain authenticator failed for H=([45.138.16.219]) [45.138.16.219]:51561: 535 Incorrect authentication data (set_id=safuan@pspoly.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.36.122
country_id: 3175395
description:
Jan 26 20:39:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.36.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.152
country_id: 298795
description:
Jan 26 20:40:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.56
country_id: 690791
description:
Jan 26 20:40:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 26 20:40:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.218
country_id: 1269750
description:
Jan 26 20:40:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.25.132.93
country_id: 1269750
description:
Jan 26 20:41:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.25.132.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.125.56
country_id: 690791
description:
Jan 26 20:41:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.125.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.46
country_id: 3469034
description:
Jan 26 20:41:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.38
country_id: 226074
description:
Jan 26 20:41:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.76
country_id: 3469034
description:
Jan 26 20:41:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.37.213
country_id: 2300660
description:
Jan 26 20:41:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.37.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.152
country_id: 298795
description:
Jan 26 20:41:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.218
country_id: 1269750
description:
Jan 26 20:41:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.123.19
country_id: 3865483
description:
Jan 26 20:41:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.123.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.53
country_id: 2300660
description:
Jan 26 20:41:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.53 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.51.169.130
country_id: 290557
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-token-stream/ChangeLog.md HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.76
country_id: 3469034
description:
Jan 26 20:50:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.76
country_id: 3469034
description:
Jan 26 20:51:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.105
country_id: 3469034
description:
Jan 26 20:51:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.105 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-26 20:57:39 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess0955698627/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-26 20:58:40 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess0955698627/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.86.166.154
country_id: 3469034
description:
Jan 26 20:58:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.86.166.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.16
country_id: 3469034
description:
Jan 26 20:59:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-26 20:59:40 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess0955698627/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-26 21:03:41 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess0955698627/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 2921044
description:
Jan 26 21:08:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.39
country_id: 1668284
description:
Jan 26 21:09:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.3
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/wireplumber/policy.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.27
country_id: 130758
description:
Jan 26 21:11:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.61
country_id: 2921044
description:
Jan 26 21:13:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.100
country_id: 130758
description:
Jan 26 21:17:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.13
country_id: 1668284
description:
Jan 26 21:16:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.9
country_id: 2300660
description:
Jan 26 21:17:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.9 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-01-26 21:17:53 +0800] info [cpaneld] 103.210.132.14 - plomalit "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user plomalit (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.9
country_id: 2300660
description:
Jan 26 21:18:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/img/awards.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 2921044
description:
Jan 26 21:20:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.155.55
country_id: 1880251
domain: appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Loader/schema/dic/xliff-core/xml.xsd||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.39
country_id: 1668284
description:
Jan 26 21:21:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.106.40.5
country_id: 99237
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/divider4.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-26 21:22:06 H=([45.144.212.41]) [45.144.212.41]:61195 F=<powerbiz@emirates.net.ae> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from emirates.net.ae


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.41.191.36
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/modules/r_free_page/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.61
country_id: 2921044
description:
Jan 26 21:25:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.23.178
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35051528706619 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 47.104.72.162
country_id: 1814991
description:
2026-01-26 21:30:47 769990 [Warning] Aborted connection 769990 to db: 'unconnected' user: 'unauthenticated' host: '47.104.72.162' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 47.104.72.162
country_id: 1814991
description:
2026-01-26 21:30:52 770000 [Warning] Aborted connection 770000 to db: 'unconnected' user: 'unauthenticated' host: '47.104.72.162' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 2921044
description:
Jan 26 21:32:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.39
country_id: 1668284
description:
Jan 26 21:32:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.28.244.221
country_id: 2017370
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/bedroom/mattress/slumberland/slumfircascadium.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 21:34:47 H=([38.240.43.48]) [38.240.43.48]:60728 F=<inquiry@polestarworldwide.ae> rejected RCPT <fkr@fkr.com.my>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.178
country_id: 2635167
description:
2026-01-26 21:34:25 770140 [Warning] Aborted connection 770140 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.178' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 47.104.72.162
country_id: 1814991
description:
2026-01-26 21:35:54 770199 [Warning] Aborted connection 770199 to db: 'unconnected' user: 'unauthenticated' host: '47.104.72.162' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 47.104.72.162
country_id: 1814991
description:
2026-01-26 21:35:59 770207 [Warning] Aborted connection 770207 to db: 'unconnected' user: 'unauthenticated' host: '47.104.72.162' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 47.104.72.162
country_id: 1814991
description:
2026-01-26 21:36:00 770208 [Warning] Aborted connection 770208 to db: 'unconnected' user: 'unauthenticated' host: '47.104.72.162' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.61
country_id: 2921044
description:
Jan 26 21:37:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.61 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.178
country_id: 2635167
description:
2026-01-26 21:37:54 770255 [Warning] Aborted connection 770255 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.178' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.178
country_id: 2635167
description:
2026-01-26 21:38:27 770275 [Warning] Aborted connection 770275 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.178' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 21:39:56 H=([38.240.43.48]) [38.240.43.48]:56530 F=<inquiry@polestarworldwide.ae> rejected RCPT <chuan@tschuan.com>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 21:40:15 H=([38.240.43.48]) [38.240.43.48]:58187 F=<inquiry@polestarworldwide.ae> rejected RCPT <deane@pspoly.com.my>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 21:43:17 H=([38.240.43.48]) [38.240.43.48]:60913 F=<inquiry@polestarworldwide.ae> rejected RCPT <suffian@pspoly.com.my>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.167
country_id: 1269750
description:
Jan 26 21:43:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.167
country_id: 1269750
description:
Jan 26 21:44:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.39
country_id: 1668284
description:
Jan 26 21:44:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.39 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 2921044
description:
Jan 26 21:44:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.142.74
country_id: 1733045
description:
[2026-01-26 21:47:37 +0800] info [webmaild] 161.142.142.74 - kwangpeng@ktlog.com.my "GET /cpsess6190763886/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.208.7
country_id: 6252001
description:
2026-01-26 21:47:37 770537 [Warning] Aborted connection 770537 to db: 'unconnected' user: 'unauthenticated' host: '152.32.208.7' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.61
country_id: 2921044
description:
Jan 26 21:49:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.61 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.40
country_id: 1269750
description:
Jan 26 21:50:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 21:51:57 H=([38.240.43.48]) [38.240.43.48]:58300 F=<inquiry@polestarworldwide.ae> rejected RCPT <enquiry@nexuscollection.com>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.39
country_id: 1668284
description:
Jan 26 21:55:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.39 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 21:55:56 H=([38.240.43.48]) [38.240.43.48]:58356 F=<inquiry@polestarworldwide.ae> rejected RCPT <kacey@smartcable.com.my>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 2921044
description:
Jan 26 21:56:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.132.142.167
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-57.216.132.142.167||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.16
country_id: 3469034
description:
Jan 26 21:57:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.185.45.240
country_id: 2017370
description:
Jan 26 21:57:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.185.45.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.185.45.240
country_id: 2017370
description:
2026-01-26 21:57:05 dovecot_plain authenticator failed for H=91-185-45-240-irk.cust.dsi.ru (y751tzu4890kttvhiomt64) [91.185.45.240]:56662: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.16
country_id: 3469034
description:
Jan 26 21:58:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.198.131.136
country_id: 6252001
description:
2026-01-26 21:58:30 dovecot_login authenticator failed for H=(localhost.localdomain) [124.198.131.136]:61538: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.172.86.124
country_id: 1269750
description:
Jan 26 22:00:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.172.86.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.172.86.124
country_id: 1269750
description:
2026-01-26 22:00:38 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [122.172.86.124]:32935: 535 Incorrect authentication data (set_id=francis@aire-fresh.com)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.56.135.33
country_id: 1269750
domain: mkmetal.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:69375.mkmetal.com.my||ServerName:mkmetal.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6aefaa5bde9fabb291cd13ccd8aabc2875267102||Title:0x456530af||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.61
country_id: 2921044
description:
Jan 26 22:01:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.61 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.28.247.49
country_id: 290557
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/img/photos/9047809464.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.215.37.235
country_id: 630336
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/agpc.org.my/mezbah-doa-pagi-malam/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-26 22:04:12 +0800] info [cpaneld] 202.178.120.157 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.114.182.19
country_id: 587116
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/about.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.177.179.39
country_id: 1668284
description:
Jan 26 22:06:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.177.179.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.57.225.217
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-07.196.57.225.217||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.237.120.38
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=36 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 69.58.89.5
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-08.69.58.89.5||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.237
country_id: 2921044
description:
Jan 26 22:08:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.47.149.59
country_id: 6252001
description:
Jan 26 22:09:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.47.149.59 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.149.59
country_id: 6252001
description:
2026-01-26 22:09:21 dovecot_login authenticator failed for H=host59.sub-63-47-149.myvzw.com [63.47.149.59]:33193: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.93
country_id: 3865483
description:
Jan 26 22:09:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.16
country_id: 3469034
description:
Jan 26 22:10:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.18
country_id: 2510769
description:
Jan 26 22:10:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.18
country_id: 2510769
description:
Jan 26 22:11:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.16.183.175
country_id: 953987
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/341432.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.157
country_id: 3469034
description:
Jan 26 22:21:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-26 22:23:46 H=([46.151.182.48]) [46.151.182.48]:55446 F=<cpanel@ktlog.com.my> rejected RCPT <jaya@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-26 22:26:40 H=([77.83.39.56]) [77.83.39.56]:63454 F=<advising.service@advising.hsbc.com> rejected RCPT <astklia@astlog.com.my>: No Such User Here


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-26 22:27:03 771897 [Warning] Aborted connection 771897 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.175.117
country_id: 1814991
description:
Jan 26 22:28:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.175.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.30
country_id: 1269750
description:
Jan 26 22:28:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.139
country_id: 690791
description:
Jan 26 22:29:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.203.231
country_id: 3469034
description:
Jan 26 22:29:50 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.203.231 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.251.22.198
country_id: 1269750
description:
Jan 26 22:29:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.251.22.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.30
country_id: 1269750
description:
Jan 26 22:29:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.203.231
country_id: 3469034
description:
Jan 26 22:30:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.203.231 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.123
country_id: 2635167
description:
Jan 26 22:30:57 sv3 pure-ftpd[1502273]: (?@87.236.176.123) [INFO] New connection from 87.236.176.123


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 39.56.121.167
country_id: 1168579
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/proc/thread-self/cwd/etc/cpbackup-exclude.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.16.89
country_id: 1269750
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/downloads/Tecnomagnete Catalog.PDF HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.189.64.133
country_id: 1168579
domain: www.manforce.net
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.manforce.net/mgmtsolutionspage/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-26 22:35:01 H=(localhost.localdomain) [78.153.140.207]:59372 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 22:36:36 H=([38.240.43.48]) [38.240.43.48]:61084 F=<inquiry@polestarworldwide.ae> rejected RCPT <cky@ahfengineering.com>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 104.237.242.63
country_id: 6252001
domain: www.inter-link.edu.my
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 12; M2102J20SG Build/SKQ1.211006.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/118.0.0.0 Mobile Safari/537.36 musical_ly_2023002030 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/musical_ly app_version/30.2.3 ByteLocale/ru-RU ByteFullLocale/ru-RU Region/US Spark/1.3.5.7-bugfix AppVersion/30.2.3 BytedanceWebview/d8a21c6||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-26 22:48:46 H=(localhost.localdomain) [78.153.140.207]:57548 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.144
country_id: 1269750
description:
Jan 26 22:48:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.144 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.113.234.91
country_id: 1512440
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/Invocation HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.190.255.163
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/Invocation/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-26 22:57:46 H=([46.151.182.48]) [46.151.182.48]:63075 F=<cpanel@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.180.190.165
country_id: 286963
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/MockObject HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.73.144.139
country_id: 6252001
description:
Jan 26 23:03:20 sv3 pure-ftpd[1523342]: (?@184.73.144.139) [INFO] New connection from 184.73.144.139


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.155.60
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpunit/phpunit-mock-objects/tests/MockObject/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.64
country_id: 6252001
description:
2026-01-26 23:07:07 773072 [Warning] Aborted connection 773072 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.64' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-26 23:07:26 H=([46.151.182.48]) [46.151.182.48]:56955 F=<cpanel@fasterget.com.my> rejected RCPT <operation2@fasterget.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.29.36
country_id: 248816
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/dining/7pc/elk55714641.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.253.30.156
country_id: 248816
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/dining/7pc/elk556954865484.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 38.240.43.48
country_id: 2077456
description:
2026-01-26 23:10:40 H=([38.240.43.48]) [38.240.43.48]:51039 F=<inquiry@polestarworldwide.ae> rejected RCPT <hr@hmz.com.my>: SPF: 38.240.43.48 is not allowed to send mail from polestarworldwide.ae


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.68.22.140
country_id: 1269750
description:
Jan 26 23:11:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.68.22.140 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.135.241.178
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Multi Purpose  L - External Carton Size-120x120.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.189.218.83
country_id: 1210997
description:
2026-01-26 23:14:47 dovecot_plain authenticator failed for H=(mail.agpc.org.my) [103.189.218.83]:44278: 535 Incorrect authentication data (set_id=intercessors@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.189.218.83
country_id: 1210997
description:
Jan 26 23:14:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.189.218.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.202.108.157
country_id: 798544
description:
Jan 26 23:15:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.202.108.157 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 23:17:51 H=([45.144.212.242]) [45.144.212.242]:63226 F=<lynnied@mhtc.net> rejected RCPT <marina@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.144
country_id: 2300660
description:
Jan 26 23:20:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.144
country_id: 2300660
description:
Jan 26 23:21:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.67.45.29
country_id: 2661886
description:
Jan 26 23:22:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.67.45.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.67.45.29
country_id: 2661886
description:
2026-01-26 23:23:00 dovecot_plain authenticator failed for H=213-67-45-29-no600.tbcn.telia.com (scamworns) [213.67.45.29]:36464: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.50.66.66
country_id: 1282988
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Writer/Excel5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.106.41.40
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Writer/Excel5/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.250
country_id: 6252001
description:
2026-01-26 23:24:43 773537 [Warning] Aborted connection 773537 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.250' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.253.181
country_id: 3469034
description:
Jan 26 23:28:58 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.253.181 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.253.181
country_id: 3469034
description:
Jan 26 23:29:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.253.181 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 194.165.16.164
country_id: 2993457
description:
2026-01-26 23:30:23 773781 [Warning] Aborted connection 773781 to db: 'unconnected' user: 'unauthenticated' host: '194.165.16.164' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.106.115.44
country_id: 1733045
description:
Jan 26 23:34:00 sv3 pure-ftpd[1545042]: (?@203.106.115.44) [INFO] New connection from 203.106.115.44


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 203.106.115.44
country_id: 1733045
description:
Jan 26 23:34:12 sv3 pure-ftpd[1545156]: (?@203.106.115.44) [INFO] New connection from 203.106.115.44


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 203.106.115.44
country_id: 1733045
description:
Jan 26 23:34:15 sv3 pure-ftpd[1545158]: (myfurnit@203.106.115.44) [NOTICE] /home/myfurnit//public_html/clostand.html uploaded  (4078 bytes, 5485.55KB/sec)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.26
country_id: 798544
description:
Jan 26 23:39:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.26
country_id: 798544
description:
Jan 26 23:40:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.69
country_id: 3175395
description:
Jan 26 23:40:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.2.249.160
country_id: 3469034
description:
Jan 26 23:41:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.2.249.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.93
country_id: 3865483
description:
Jan 26 23:41:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-26 23:44:27 H=([46.151.182.48]) [46.151.182.48]:52265 F=<cpanel@ktlog.com.my> rejected RCPT <stacy@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.23.157.60
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/console/Tests/Output/StreamOutputTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-26 23:57:50 H=([45.144.212.242]) [45.144.212.242]:62319 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.68
country_id: 2395170
description:
Jan 26 23:58:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-27 00:00:49 H=([46.151.182.48]) [46.151.182.48]:49369 F=<cpanel@empirelog.com.my> rejected RCPT <waynegoh@empirelog.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/career.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 00:04:06 H=(localhost.localdomain) [78.153.140.207]:59654 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.244.153.128
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpdocumentor/reflection-common/src/Location.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-27 00:13:22 +0800] info [cpaneld] 202.178.120.157 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.125
country_id: 3469034
description:
Jan 27 00:13:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.125
country_id: 3469034
description:
Jan 27 00:14:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.235.170.237
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/RedisCaster.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/privateresidence-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.84
country_id: 2658434
description:
2026-01-27 00:27:41 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [79.142.79.84]:53567: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.142.79.84
country_id: 2658434
description:
2026-01-27 00:28:06 dovecot_plain authenticator failed for H=(5D5E03B.online-server.cloud) [79.142.79.84]:52694: 535 Incorrect authentication data (set_id=sales@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.92.190
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=10 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/images/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.165.222
country_id: 3469034
description:
Jan 27 00:38:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.165.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.184
country_id: 6252001
description:
Jan 27 00:40:07 sv3 pure-ftpd[1588536]: (?@205.210.31.184) [INFO] New connection from 205.210.31.184


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.64.160.250
country_id: 1282988
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/NamedMockTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-27 00:42:02 H=(localhost.localdomain) [78.153.140.207]:35958 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/component/tag/images/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.106.2
country_id: 3175395
description:
Jan 27 00:50:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.106.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.139.210
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=6 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.17.81.118
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/ManifestSerializerTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.60.9.65
country_id: 1269750
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/webmozart/assert/phpunit.xml.dist HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.255.0.52
country_id: 3469034
description:
Jan 27 01:07:46 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.255.0.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.255.0.52
country_id: 3469034
description:
Jan 27 01:08:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.255.0.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.104.125.53
country_id: 3595528
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press-details.php?id=107240 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.217
country_id: 3175395
description:
Jan 27 01:18:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.217 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.100
country_id: 3469034
description:
Jan 27 01:19:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.26
country_id: 953987
description:
Jan 27 01:20:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.99.149
country_id: 3077311
description:
Jan 27 01:20:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.99.149 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.103
country_id: 6252001
description:
2026-01-27  1:23:47 777434 [Warning] Aborted connection 777434 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.103' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.246.242
country_id: 3865483
description:
Jan 27 01:27:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.246.242 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.48.25.24
country_id: 6252001
description:
[2026-01-27 01:28:45 +0800] info [cpaneld] 86.48.25.24 - stealthv "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user stealthv (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.140.240.98
country_id: 3469034
description:
Jan 27 01:29:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.140.240.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.12
country_id: 3469034
description:
Jan 27 01:29:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.132.12
country_id: 3469034
description:
Jan 27 01:30:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.132.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.153.19.131
country_id: 2510769
description:
Jan 27 01:32:35 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.153.19.131 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.211
country_id: 6252001
description:
2026-01-27  1:36:58 777897 [Warning] Aborted connection 777897 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.211' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.12
country_id: 732800
description:
Jan 27 01:37:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.12 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.213
country_id: 6252001
description:
Jan 27 01:38:25 sv3 pure-ftpd[1622582]: (?@205.210.31.213) [INFO] New connection from 205.210.31.213


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.220
country_id: 953987
description:
Jan 27 01:40:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.220
country_id: 953987
description:
Jan 27 01:41:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.66
country_id: 3175395
description:
Jan 27 01:41:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.107.172
country_id: 3469034
description:
Jan 27 01:41:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.107.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.190.112.116
country_id: 337996
domain: www.eminent.st
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.eminent.st/v3/portfolio/furry-friends-farm-calendar-2017/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.250.44.123
country_id: 1643084
description:
[2026-01-27 01:45:01 +0800] info [cpaneld] 180.250.44.123 - adssadadsa "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user adssadadsa (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.220.68.114
country_id: 51537
description:
Jan 27 01:45:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.220.68.114 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.241.38.176
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-48.171.241.38.176||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.151
country_id: 1733045
description:
[2026-01-27 01:53:52 +0800] info [webmaild] 161.142.118.151 - s-osada@mckd.com.my "GET /cpsess6654363819/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.81.136.110
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-59.45.81.136.110||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 02:04:04 H=([45.144.212.242]) [45.144.212.242]:53812 F=<lynnied@mhtc.net> rejected RCPT <sales@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'lynnied@mhtc.net' To: 'sales@wcc.com.my'


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 144.124.246.198
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-05.144.124.246.198||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.53.241.20
country_id: 630336
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/768604.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.232.17.72
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/banner3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.126.231.62
country_id: 3437598
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.49.31.28
country_id: 458258
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/item/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.2.125.46
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.104.14.67
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/item/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.212.8.160
country_id: 163843
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/item/images/banner4.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.156.133
country_id: 3489940
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.145.39
country_id: 587116
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/item/images/banner3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 128.201.237.39
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/item/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.196.47.6
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.68.110
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/reference/modules/d3ndlcrdsearch/images/banner4.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.49.35
country_id: 3923057
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/item/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.189.239.206
country_id: 1814991
description:
Jan 27 02:10:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.189.239.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.189.239.206
country_id: 1814991
description:
2026-01-27 02:10:07 dovecot_login authenticator failed for H=([220.189.239.206]) [220.189.239.206]:50068: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.69.138
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/finder/Iterator/FilecontentFilterIterator.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 02:12:21 H=([45.144.212.242]) [45.144.212.242]:58370 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.53.14.40
country_id: 718075
description:
Jan 27 02:12:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.53.14.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 92.53.14.40
country_id: 718075
description:
2026-01-27 02:12:35 dovecot_plain authenticator failed for H=(10I184C09IJ1) [92.53.14.40]:16533: 535 Incorrect authentication data (set_id=rina@essemgroup.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.75.94
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/tag/city/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.149.215
country_id: 690791
description:
Jan 27 02:23:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.149.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.232.60.66
country_id: 3469034
description:
Jan 27 02:24:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.232.60.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.209.97
country_id: 3865483
description:
Jan 27 02:25:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.209.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.69.206
country_id: 3469034
description:
Jan 27 02:25:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.69.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 02:25:49 H=([45.144.212.242]) [45.144.212.242]:58641 F=<lynnied@mhtc.net> rejected RCPT <simon@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'lynnied@mhtc.net' To: 'simon@wcc.com.my'


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.214.238.35
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/images/8162P_IFOAM_Standard_Certificate_220817.pdf HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.220.136
country_id: 2542007
description:
[2026-01-27 02:31:57 +0800] info [cpaneld] 104.28.220.136 - mkmetalc "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.166
country_id: 2300660
description:
Jan 27 02:32:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.223
country_id: 3469034
description:
Jan 27 02:32:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.223 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.65.223.156
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/diff/src/Exception/Exception.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.219.255.161
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/jakub-onderka/php-console-color/tests HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.189.174.163
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/jakub-onderka/php-console-color/tests/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.148.214.212
country_id: 1210997
description:
2026-01-27 02:38:19 dovecot_plain authenticator failed for H=(5D07V5) [180.148.214.212]:12396: 535 Incorrect authentication data (set_id=steven@oxbold.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.121.77.66
country_id: 732800
description:
Jan 27 02:39:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.121.77.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.17
country_id: 3175395
description:
Jan 27 02:39:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.71.66.115
country_id: 3469034
description:
Jan 27 02:39:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.71.66.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/about.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-27 02:43:00 H=([220.154.134.114]) [220.154.134.114]:50748 F=<dse_NA2@docusign.net> rejected RCPT <ap@wohcheong.com.my>: Unrouteable address


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.183.43.144
country_id: 3658394
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/agpc.org.my/morning-midnight-altar-tamil/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.45.85.146
country_id: 798544
description:
Jan 27 02:49:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.45.85.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.123
country_id: 3469034
description:
Jan 27 02:50:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.4
country_id: 3469034
description:
Jan 27 02:53:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.40
country_id: 798544
description:
Jan 27 02:53:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77350600
name: IM360 WAF: Suspicious .min.php file in wp-includes
abuser: 44.201.185.246
country_id: 6252001
domain: box.com.my
description:
IM360 WAF: Suspicious .min.php file in wp-includes||SC:/home2/woh/box.com.my/wp-includes/assets/script-loader-packages.min.php||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 44.201.185.246
country_id: 6252001
domain: box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/SimplePie/autoloader.php||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 200.234.137.184
country_id: 3469034
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-57.200.234.137.184||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 44.201.185.246
country_id: 6252001
domain: box.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/woh/box.com.my/wp-includes/sodium_compat/autoload-php7.php||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.249
country_id: 2300660
description:
Jan 27 03:03:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.249 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.19.216.146
country_id: 6252001
description:
37.19.216.146 - - [27/Jan/2026:03:05:05 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10077588&pdata=http%253A%252F%252Fmckd.com.my%253A2086%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769454301 HTTP/1.1" 302 0 mckd.com.my "http://mckd.com.my:2086/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.19.216.146


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 182.96.238.174
country_id: 1814991
domain: www.pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/data/mysql_error_trace.inc||User:pftfood||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.19
country_id: 298795
description:
Jan 27 03:08:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.239
country_id: 3175395
description:
Jan 27 03:08:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.19
country_id: 298795
description:
Jan 27 03:09:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.191.236.220
country_id: 3469034
description:
Jan 27 03:09:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.191.236.220 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.230
country_id: 3469034
description:
Jan 27 03:16:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.215.145
country_id: 933860
description:
Jan 27 03:17:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.215.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.108.86.206
country_id: 3469034
description:
Jan 27 03:17:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.108.86.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.215.145
country_id: 933860
description:
Jan 27 03:18:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.215.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 27 03:23:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-27 03:23:34 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:35436: 535 Incorrect authentication data (set_id=admin@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.8
country_id: 798544
description:
Jan 27 03:27:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.89
country_id: 953987
description:
Jan 27 03:27:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.89 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.14
country_id: 953987
description:
Jan 27 03:28:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.8
country_id: 798544
description:
Jan 27 03:28:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.89
country_id: 953987
description:
Jan 27 03:28:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.82.23.183
country_id: 798544
description:
Jan 27 03:28:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.82.23.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.236.85.111
country_id: 3469034
description:
Jan 27 03:28:30 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.236.85.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.14
country_id: 953987
description:
Jan 27 03:29:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.36.204.160
country_id: 1819730
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - 5 File Box-3-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.36.204.160
country_id: 1819730
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Easy Fold Document Box/Easy Fold - 5 File Box-3-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.119
country_id: 953987
description:
Jan 27 03:30:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.119 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.193
country_id: 6252001
description:
Jan 27 03:31:29 sv3 pure-ftpd[1689400]: (?@162.142.125.193) [INFO] New connection from 162.142.125.193


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.119
country_id: 953987
description:
Jan 27 03:30:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.194.154.162
country_id: 3469034
description:
Jan 27 03:31:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.194.154.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-27 03:33:01 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:56937: 535 Incorrect authentication data (set_id=it@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.4.81.106
country_id: 1562822
description:
Jan 27 03:32:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.4.81.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.50.179
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-38.166.0.50.179||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.223
country_id: 6252001
description:
2026-01-27  3:39:27 782924 [Warning] Aborted connection 782924 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.223' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.132
country_id: 3175395
description:
Jan 27 03:40:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.113
country_id: 690791
description:
Jan 27 03:40:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.113 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.234.9.74
country_id: 3469034
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/energy2.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/company.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.94
country_id: 690791
description:
2026-01-27 03:51:35 H=([77.83.39.94]) [77.83.39.94]:54787 F=<info@forkliftcenter.com> rejected RCPT <lowkeesen@nobledec.com>: SPF: 77.83.39.94 is not allowed to send mail from forkliftcenter.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.56
country_id: 798544
description:
Jan 27 03:52:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.79
country_id: 3175395
description:
Jan 27 03:52:54 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.59.91
country_id: 953987
description:
Jan 27 03:52:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.59.91 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.79
country_id: 3175395
description:
Jan 27 03:53:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 04:01:19 H=([45.144.212.242]) [45.144.212.242]:53704 F=<lynnied@mhtc.net> rejected RCPT <vincent@wcc.com.my>: Rejected relay attempt: '45.144.212.242' From: 'lynnied@mhtc.net' To: 'vincent@wcc.com.my'


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.76.88
country_id: 732800
description:
Jan 27 04:03:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.76.88 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.119
country_id: 6252001
description:
2026-01-27  4:07:45 783961 [Warning] Aborted connection 783961 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.119' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.206
country_id: 3469034
description:
Jan 27 04:08:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.178.27.180
country_id: 2510769
description:
Jan 27 04:08:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.178.27.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 151.59.108.10
country_id: 3175395
description:
Jan 27 04:09:21 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 151.59.108.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 151.59.108.10
country_id: 3175395
description:
2026-01-27 04:09:23 dovecot_plain authenticator failed for H=(supping) [151.59.108.10]:34604: 535 Incorrect authentication data (set_id=mrswong@fimco.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cert.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.194
country_id: 953987
description:
Jan 27 04:16:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.251.31.154
country_id: 1269750
description:
2026-01-27 04:20:41 dovecot_login authenticator failed for H=([125.20.249.154]) [103.251.31.154]:58992: 535 Incorrect authentication data (set_id=msc.einvoice)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.213
country_id: 6290252
description:
Jan 27 04:20:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.55.189.211
country_id: 6252001
description:
Jan 27 04:20:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.55.189.211 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.55.189.211
country_id: 6252001
description:
2026-01-27 04:20:06 dovecot_login authenticator failed for H=(wllk99-129-211.dsl.netins.net) [67.55.189.211]:38458: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.251.31.154
country_id: 1269750
description:
Jan 27 04:20:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.251.31.154 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.213
country_id: 6290252
description:
Jan 27 04:21:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.171.94.30
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-25.192.171.94.30||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.250.208.77
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.235.185.25
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.249.27.24
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.32.13.63
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.239.82.164
country_id: 357994
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.26.69.127
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/Music_CD/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.149.83.62
country_id: 690791
description:
Jan 27 04:29:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.149.83.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.149.83.62
country_id: 690791
description:
2026-01-27 04:29:15 dovecot_login authenticator failed for H=(techday.com.ua) [46.149.83.62]:35017: 535 Incorrect authentication data (set_id=sales@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.152.209.204
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/RequestMatcherTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 183.81.105.97
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-31.183.81.105.97||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 04:32:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.144.242
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=6672338432 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 139.162.70.53
country_id: 1861060
description:
2026-01-27  4:37:01 785399 [Warning] Aborted connection 785399 to db: 'unconnected' user: 'unauthenticated' host: '139.162.70.53' (This connection closed normally without authentication)


plugin: cl_dos
name: DOS detection
abuser: 93.123.109.120
country_id: 732800
description:
2026-01-27 04:37:11.234095756 +0800 +08 m=+881721.221272907 Denial of Service attack was discovered from 93.123.109.120, on port 443. Open connections: 271


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.133.71.36
country_id: 3469034
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/sideboard16.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 27 04:38:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.200.72
country_id: 1562822
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk30483049.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.118.182.68
country_id: 3625428
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk5481.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.95.132.92
country_id: 99237
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/jmsb6040a.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.85.223.202
country_id: 99237
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk24792480.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.224.78.163
country_id: 3865483
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/jmsb6040.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.11.240
country_id: 1562822
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/serrmsbsr701wht.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.230.211.129
country_id: 1210997
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/sbfhsmct.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.86.74.38
country_id: 3585968
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/bg1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.162.232.54
country_id: 3469034
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk3913.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.104.75
country_id: 99237
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/serrmsbsr701blk.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.253.4.13
country_id: 953987
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/hyshy404.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.244.230.212
country_id: 3489940
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/rlbl31.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.220.185.93
country_id: 6290252
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/images/homedecor/sideboard/elk20612062.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.198.25
country_id: 3469034
description:
Jan 27 04:40:41 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.198.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 40.80.84.23
country_id: 1269750
domain: tst-ma.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/index.php||SC:/home/tstmacom/public_html/images/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.187.62.135
country_id: 3017382
description:
Jan 27 04:41:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.187.62.135 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.187.62.135
country_id: 3017382
description:
2026-01-27 04:41:40 dovecot_plain authenticator failed for H=135.ip-37-187-62.eu (phsanty) [37.187.62.135]:47130: 535 Incorrect authentication data (set_id=marina@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.178.27.180
country_id: 2510769
description:
Jan 27 04:44:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.178.27.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.27
country_id: 732800
description:
2026-01-27 04:46:17 H=([94.156.152.27]) [94.156.152.27]:64919 F=<sales2@thecityscrystal.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.163.9
country_id: 3508796
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/sebastian/recursion-context/src/Exception.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.90.0
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/psy/psysh/src/Psy/ParserFactory.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.13.68.97
country_id: 3175395
description:
Jan 27 04:53:38 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.13.68.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 188.253.220.187
country_id: 587116
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/mockery/configuration.rst HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-27 04:54:58 +0800] info [cpaneld] 202.178.120.157 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 158.94.211.103
country_id: 6252001
description:
Jan 27 04:56:13 sv3 pure-ftpd[1750669]: (?@158.94.211.103) [INFO] New connection from 158.94.211.103


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.114.101.184
country_id: 3895114
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/debug/FatalErrorHandler/ClassNotFoundFatalErrorHandler.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.179
country_id: 3175395
description:
Jan 27 04:57:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.179
country_id: 3175395
description:
Jan 27 04:58:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.19
country_id: 2750405
description:
Jan 27 04:59:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.208.82
country_id: 2921044
description:
2026-01-27 04:59:59 H=([158.94.208.82]) [158.94.208.82]:56372 F=<compras@durothane.com> rejected RCPT <info@pftfood.com>: SPF: 158.94.208.82 is not allowed to send mail from durothane.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/survey-meter/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 20.118.209.103
country_id: 6252001
description:
Jan 27 05:04:14 sv3 pure-ftpd[1754872]: (?@20.118.209.103) [INFO] New connection from 20.118.209.103


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 27 05:07:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 05:11:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.55.123.161
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Event/FilterControllerArgumentsEvent.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 198.44.137.54
country_id: 6252001
description:
198.44.137.54 - - [27/Jan/2026:05:12:19 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7116909&pdata=http%253A%252F%252Fa-connect.global%253A2095%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769461933 HTTP/1.1" 302 0 a-connect.global "http://a-connect.global:2095/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:198.44.137.54


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.122.250
country_id: 1269750
description:
Jan 27 05:15:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.122.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.122.250
country_id: 1269750
description:
2026-01-27 05:15:46 dovecot_plain authenticator failed for H=(8wvcn0fbg4sst4dlwr2qj7i9) [117.206.122.250]:47897: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.53.237.159
country_id: 1168579
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.16.62.204
country_id: 1814991
description:
2026-01-27 05:18:02 H=([218.16.62.204]) [218.16.62.204]:49765 F=<GlacierFamilyofBanks@gllacierbancorp.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.248.188.227
country_id: 192950
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward5.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.178.27.180
country_id: 2510769
description:
Jan 27 05:20:36 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.178.27.180 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.10.213.233
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/homeabout.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.158.97.67
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/sirim.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.97.134.228
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward4.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.243.66
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/cat2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.155.63.30
country_id: 1168579
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/fkr_photo_product.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.246.155
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/resource/product2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.57.130
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/cat3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.61.10
country_id: 953987
description:
Jan 27 05:20:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.61.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.21.162
country_id: 3585968
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward6.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.168.157.235
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/cat1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.7.209.31
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.76.168.236
country_id: 2542007
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/dicts_cat/05_books/books/books_005/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 4.151.132.175
country_id: 6252001
domain: nexuscollection.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/144.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.165
country_id: 298795
description:
Jan 27 05:21:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.165
country_id: 298795
description:
Jan 27 05:22:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.14
country_id: 2750405
description:
Jan 27 05:25:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 218.16.62.204
country_id: 1814991
description:
2026-01-27 05:26:21 H=([218.16.62.204]) [218.16.62.204]:59666 F=<GlacierFamilyofBanks@gllacierbancorp.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.79.237
country_id: 3469034
description:
Jan 27 05:26:53 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.79.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.79.237
country_id: 3469034
description:
Jan 27 05:27:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.79.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.211.100.92
country_id: 3469034
description:
Jan 27 05:27:28 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.211.100.92 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.165.125.212
country_id: 690791
description:
2026-01-27 05:28:57 dovecot_plain authenticator failed for H=(nonisubsle) [178.165.125.212]:55499: 535 Incorrect authentication data (set_id=info@mymetal.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.236.172.158
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteStockChart1.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.237.122
country_id: 1269750
description:
Jan 27 05:41:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.237.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.132
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/fontawesome/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.182
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-regular-webfont.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/fonts/biotif-bold-webfont.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.162.193.4
country_id: 3996063
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/the-face-suite-hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.248
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.140
country_id: 1880251
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 148.72.64.32
country_id: 6252001
description:
Jan 27 05:44:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 148.72.64.32 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-27 05:47:05 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.19
country_id: 2750405
description:
Jan 27 05:48:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 05:50:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.18
country_id: 2750405
description:
Jan 27 05:56:32 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.30
country_id: 732800
description:
Jan 27 05:59:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.78
country_id: 798544
description:
Jan 27 06:03:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.78
country_id: 798544
description:
Jan 27 06:04:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:06:56 H=([45.144.212.242]) [45.144.212.242]:54501 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 27 06:06:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-27 06:06:51 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:45310: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/font-awesome/webfonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/css/skins/default.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/owl.carousel/assets/owl.carousel.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/linear-icons/css/linear-icons.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/font-awesome/css/fontawesome-all.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/magnific-popup/magnific-popup.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/font-awesome/webfonts/fa-solid-900.woff2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.99.72.224
country_id: 3658394
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/product-detail.php?id=894440 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/css/custom.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/animate/animate.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/vendor/owl.carousel/assets/owl.theme.default.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:11:09 H=([45.144.212.242]) [45.144.212.242]:51769 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.39.207.3
country_id: 390903
description:
2026-01-27  6:13:42 787835 [Warning] Aborted connection 787835 to db: 'unconnected' user: 'unauthenticated' host: '185.39.207.3' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.213
country_id: 690791
description:
Jan 27 06:14:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 27 06:14:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-27 06:14:20 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:52443: 535 Incorrect authentication data (set_id=hr@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.97
country_id: 3175395
description:
Jan 27 06:14:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.138.213
country_id: 690791
description:
Jan 27 06:15:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.138.213 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:20:33 H=([45.144.212.242]) [45.144.212.242]:64117 F=<lynnied@mhtc.net> rejected RCPT <zainuddin@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/es/img/photos/about.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.38
country_id: 3175395
description:
Jan 27 06:26:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.108
country_id: 1269750
description:
Jan 27 06:28:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.108
country_id: 1269750
description:
Jan 27 06:29:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.108 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 06:30:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.94.111
country_id: 1861060
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/img/photos/7402250532.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.126.96.243
country_id: 3437598
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.139
country_id: 953987
description:
Jan 27 06:41:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.240
country_id: 2921044
description:
Jan 27 06:44:49 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.220.100.240
country_id: 2921044
description:
Jan 27 06:45:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.220.100.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:50:29 H=([45.144.212.242]) [45.144.212.242]:52844 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:52:43 H=([45.144.212.242]) [45.144.212.242]:62949 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:56:14 H=([45.144.212.242]) [45.144.212.242]:60568 F=<no_reply@admin.com> rejected RCPT <info@pftfood.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 27 06:57:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 06:57:51 H=([45.144.212.242]) [45.144.212.242]:54853 F=<no_reply@admin.com> rejected RCPT <support@langkawiconstructions.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.195.135.10
country_id: 357994
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/842986.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.249.148.115
country_id: 3469034
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/518128.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.194.151.245
country_id: 3469034
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/594567.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.175.75
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/DependencyInjection/ControllerArgumentValueResolverPass.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.254.213
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/463631.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.203.15
country_id: 3865483
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/926526.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 07:11:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 07:12:41 H=([45.144.212.242]) [45.144.212.242]:64502 F=<no_reply@admin.com> rejected RCPT <info@sutsb.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.19.123.94
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/File/UploadedFile.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.240
country_id: 2300660
description:
Jan 27 07:16:59 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.240
country_id: 2300660
description:
Jan 27 07:17:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.11.41.156
country_id: 3469034
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/carsdrifthowtogetthere.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.69.155
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/bin/build-vendor HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 07:23:36 H=([45.144.212.242]) [45.144.212.242]:60424 F=<no_reply@admin.com> rejected RCPT <account@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.90
country_id: 6252001
description:
2026-01-27  7:28:30 790143 [Warning] Aborted connection 790143 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.90' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/about-us/faq/images/product.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.44
country_id: 690791
description:
2026-01-27 07:37:46 H=([77.83.39.44]) [77.83.39.44]:51436 F=<ucwl.investors@jkmail.com> rejected RCPT <laupk@chs.com.my>: SPF: 77.83.39.44 is not allowed to send mail from jkmail.com


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.242.184
country_id: 6252001
domain: chokeeint.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.67||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.134
country_id: 3865483
description:
Jan 27 07:43:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.14
country_id: 1269750
description:
Jan 27 07:47:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.132
country_id: 2963597
description:
Jan 27 07:48:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.101.164
country_id: 1733045
description:
[2026-01-27 07:49:52 +0800] info [webmaild] 183.171.101.164 - payment@tujusetia.my "GET /cpsess9631429942/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.66.56] != Current IP Address [183.171.101.164]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.101.164
country_id: 1733045
description:
[2026-01-27 07:51:56 +0800] info [webmaild] 183.171.101.164 - rabileh@tujusetia.my "POST /cpsess7066048582/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.66.56] != Current IP Address [183.171.101.164]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.153
country_id: 2300660
description:
Jan 27 07:52:33 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.196.44
country_id: 3469034
description:
Jan 27 07:52:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.196.44 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.194
country_id: 3469034
description:
Jan 27 07:52:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.194 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.5.166
country_id: 2300660
description:
Jan 27 07:52:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.5.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.228
country_id: 3469034
description:
Jan 27 07:52:56 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.228
country_id: 3469034
description:
Jan 27 07:53:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.228 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.68.213
country_id: 732800
description:
Jan 27 07:53:06 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 07:54:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.249.241
country_id: 1733045
description:
[2026-01-27 07:56:00 +0800] info [webmaild] 27.125.249.241 - celynnloh@mckd.com.my "GET /cpsess6243499935/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.40
country_id: 2750405
description:
2026-01-27 07:57:09 H=([185.214.10.40]) [185.214.10.40]:57511 F=<no-reply@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.19.27.120
country_id: 3469034
domain: agpc.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agpc.org.my/category/chinese/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.19.27.120
country_id: 3469034
domain: agpc.org.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agpc.org.myhttp/agpc.org.my/category/chinese/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.40
country_id: 2750405
description:
2026-01-27 07:59:01 H=([185.214.10.40]) [185.214.10.40]:51053 F=<no-reply@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.55.80
country_id: 3469034
description:
Jan 27 08:02:39 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.55.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.239
country_id: 3469034
description:
Jan 27 08:03:52 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.239 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.0.140
country_id: 2300660
description:
Jan 27 08:03:29 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.0.140 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.239
country_id: 3469034
description:
Jan 27 08:04:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 08:09:54 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.182.31
country_id: 3625428
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/logo_reward2.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.84.17.30
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/banner3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.199.210
country_id: 3658394
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.13.115.198
country_id: 3865483
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.180.58.23
country_id: 3469034
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.178.180
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/banner4.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.247.149
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/logo_reward1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.222.63.220
country_id: 3923057
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/book/P1/2/P2/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/m.me/img/druma_photos/team.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.231.185
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=524261 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.100
country_id: 6252001
description:
2026-01-27  8:20:08 791692 [Warning] Aborted connection 791692 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.100' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.204
country_id: 2395170
description:
Jan 27 08:22:57 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.5.204
country_id: 2395170
description:
Jan 27 08:23:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.5.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.106.73
country_id: 3469034
description:
Jan 27 08:23:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.106.73 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.147.84.194
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-23.82.147.84.194||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.113.254.26
country_id: 1814991
description:
Jan 27 08:25:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.113.254.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.113.254.26
country_id: 1814991
description:
2026-01-27 08:25:19 dovecot_login authenticator failed for H=([116.113.254.26]) [116.113.254.26]:55260: 535 Incorrect authentication data (set_id=contact@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.34.13
country_id: 1269750
description:
Jan 27 08:28:18 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.34.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.195
country_id: 3469034
description:
Jan 27 08:28:44 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.7
country_id: 3175395
description:
Jan 27 08:31:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.7 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.227.121.16
country_id: 3865483
domain: www.aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aire-fresh.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-27 08:36:30 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:37:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61476: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 08:37:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61527: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.165.91
country_id: 1562822
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/3-1.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61556: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/component/tag/images/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.36.83.34
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/employees/index.blade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-27 08:42:38 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.35
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/File/File.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61274: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.213.41.155
country_id: 3469034
description:
Jan 27 08:45:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.213.41.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.213.41.155
country_id: 3469034
description:
2026-01-27 08:45:06 dovecot_login authenticator failed for H=(ADMIN) [89.213.41.155]:50593: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 08:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61365: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.142.113.50
country_id: 1733045
description:
[2026-01-27 08:53:36 +0800] info [webmaild] 175.142.113.50 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.241.36.216
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-53.171.241.36.216||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.95
country_id: 3469034
description:
Jan 27 08:55:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.95 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.139.180.140
country_id: 3175395
description:
Jan 27 08:55:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.139.180.140 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.126.202.61
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-57.192.126.202.61||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:01:24 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.25.109.146
country_id: 1643084
description:
2026-01-27 09:08:42 dovecot_plain authenticator failed for H=(dhottaxdg45zqd3hvyirbog81mi) [223.25.109.146]:55900: 535 Incorrect authentication data (set_id=fadilah@pspoly.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 09:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56590: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:08:05 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:08:07 dovecot_login authenticator failed for H=(1Rut6Z) [178.16.54.22]:54329: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 42.191.142.124
country_id: 1733045
description:
[2026-01-27 09:08:24 +0800] info [webmaild] 42.191.142.124 - cheahbanfoo@fkr.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.25.109.146
country_id: 1643084
description:
Jan 27 09:08:40 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.25.109.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:09:12 dovecot_login authenticator failed for H=(cIzzRKC) [178.16.54.22]:57001: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:09:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.12.138
country_id: 1814991
description:
Jan 27 09:10:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.72.12.138 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:10:49 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:10:14 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:10:16 dovecot_login authenticator failed for H=(UGj2hRsN) [178.16.54.22]:63668: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:12:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:12:13 dovecot_login authenticator failed for H=(yculUaq) [178.16.54.22]:60232: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 223.205.232.228
country_id: 1605651
description:
2026-01-27  9:12:28 793623 [Warning] Aborted connection 793623 to db: 'unconnected' user: 'unauthenticated' host: '223.205.232.228' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:13:19 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-27 09:13:29 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.242
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/DocumentSecurity.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.146.60
country_id: 6252001
description:
2026-01-27  9:13:16 793638 [Warning] Aborted connection 793638 to db: 'unconnected' user: 'unauthenticated' host: '167.94.146.60' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:13:21 dovecot_login authenticator failed for H=(YKBRCr6P) [178.16.54.22]:57096: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:14:47 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:14:49 dovecot_login authenticator failed for H=(GEjbbg) [178.16.54.22]:51104: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:15:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:15:22 dovecot_login authenticator failed for H=(uwEqS81M) [178.16.54.22]:65301: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:16:27 dovecot_login authenticator failed for H=(zdjxTne) [178.16.54.22]:51260: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:16:06 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:16:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.40
country_id: 2750405
description:
2026-01-27 09:17:14 H=([185.214.10.40]) [185.214.10.40]:59893 F=<no-reply@chs.com.my> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:17:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:17:28 dovecot_login authenticator failed for H=(tjpsEtm) [178.16.54.22]:60257: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.171.150.189
country_id: 3469034
description:
Jan 27 09:18:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.171.150.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.173
country_id: 3175395
description:
Jan 27 09:18:25 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:18:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:18:29 dovecot_login authenticator failed for H=(nZP0GSNubU) [178.16.54.22]:58949: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:19:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:19:18 dovecot_login authenticator failed for H=(DvUjbfq5F) [178.16.54.22]:64186: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:20:15 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:20:17 dovecot_login authenticator failed for H=(gYG83QJb72) [178.16.54.22]:53333: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 09:22:45 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.83.94.16
country_id: 1643084
description:
Jan 27 09:22:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.83.94.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/vide/img/photos/news.php||SC:/home2/pspolycom/public_html/vendor/vide/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:23:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:23:26 dovecot_login authenticator failed for H=(k6fhS22c) [178.16.54.22]:55628: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:24:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:24:29 dovecot_login authenticator failed for H=(Wc0dJLcx) [178.16.54.22]:52721: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/master/style-switcher/img/photos/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/vide/img/demos/news.php||SC:/home2/pspolycom/public_html/vendor/vide/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:25:31 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:25:33 dovecot_login authenticator failed for H=(bms4S7) [178.16.54.22]:49184: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/jquery.validation/img/photos/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:26:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:26:13 dovecot_login authenticator failed for H=(X0NE1FA) [178.16.54.22]:50683: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/img/news.php||SC:/home2/pspolycom/public_html/js/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:27:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:27:29 dovecot_login authenticator failed for H=(DZCjsAJ) [178.16.54.22]:56592: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:28:26 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:28:28 dovecot_login authenticator failed for H=(TzG5toyVz) [178.16.54.22]:58530: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/rs-plugin/js/img/photos/news.php||SC:/home2/pspolycom/public_html/vendor/rs-plugin/js/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/magnific-popup/img/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:29:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:29:02 dovecot_login authenticator failed for H=(btpCN5) [178.16.54.22]:58059: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 09:30:51 H=([45.144.212.242]) [45.144.212.242]:57047 F=<no_reply@admin.com> rejected RCPT <emma@agsaintifik.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:30:12 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/jquery.validation/img/about.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:30:14 dovecot_login authenticator failed for H=(VlzLQf) [178.16.54.22]:63197: 535 Incorrect authentication data (set_id=alanlai)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:30:33 dovecot_login authenticator failed for H=(0qqEq0) [178.16.54.22]:56932: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.194
country_id: 6252001
description:
Jan 27 09:30:46 sv3 pure-ftpd[1984883]: (?@162.142.125.194) [INFO] New connection from 162.142.125.194


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:31:04 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:31:06 dovecot_login authenticator failed for H=(FXOrVP) [178.16.54.22]:49907: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-27 09:31:38 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/master/style-switcher/img/demos/vendor/modernizr/news.php||SC:/home2/pspolycom/public_html/js/master||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:32:24 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:32:26 dovecot_login authenticator failed for H=(orCdUBBX) [178.16.54.22]:52202: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:32:54 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/jquery-cookie/img/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:33:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:33:03 dovecot_login authenticator failed for H=(fRGwLBVeU) [178.16.54.22]:53778: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/owl.carousel/js/demos/img/master/style-switcher/contact-us.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:34:53 dovecot_login authenticator failed for H=(GQi7X8jNb) [178.16.54.22]:49461: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/owl.carousel/js/master/style-switcher/img/demos/news.php||SC:/home2/pspolycom/public_html/vendor/owl.carousel/js||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.168
country_id: 1269750
description:
Jan 27 09:34:08 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/vendor/bootstrap/js/img/photos/master/style-switcher/news.php||SC:/home2/pspolycom/public_html/vendor/bootstrap/js/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:35:17 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
country_id: 1835841
description:
Jan 27 09:35:48 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-27 09:35:50 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:48090: 535 Incorrect authentication data (set_id=webmaster@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:35:19 dovecot_login authenticator failed for H=(aok7tsgma) [178.16.54.22]:57665: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.66.214.34
country_id: 1269750
description:
2026-01-27 09:36:02 dovecot_login authenticator failed for H=(nsg-corporate-78.223.187.122.airtel.in) [182.66.214.34]:43702: 535 Incorrect authentication data (set_id=webmaster)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 09:36:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56844: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/examples/vendor/jquery/master/style-switcher/img/demos/news.php||SC:/home2/pspolycom/public_html/js/examples/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.66.214.34
country_id: 1269750
description:
Jan 27 09:36:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.66.214.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:36:03 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.194.142.167
country_id: 1814991
description:
2026-01-27 09:36:45 dovecot_login authenticator failed for H=([112.194.142.167]) [112.194.142.167]:55442: 535 Incorrect authentication data (set_id=pftfood@pftfood.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:36:05 dovecot_login authenticator failed for H=(hnObJyM1) [178.16.54.22]:63303: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:36:31 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Jan 27 09:36:43 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.113.27
country_id: 1835841
description:
Jan 27 09:37:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.113.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:37:23 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:37:25 dovecot_login authenticator failed for H=(1HO1fph7zi) [178.16.54.22]:54552: 535 Incorrect authentication data (set_id=alanlai@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/examples/master/style-switcher/img/demos/news.php||SC:/home2/pspolycom/public_html/js/examples/master||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:38:39 dovecot_login authenticator failed for H=(9EFqYlFeuo) [178.16.54.22]:63618: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/jquery.validation/img/photos/about.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:38:37 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/isotope/master/style-switcher/img/photos/news.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:39:10 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:39:12 dovecot_login authenticator failed for H=(jq4qzi2Kr) [178.16.54.22]:64377: 535 Incorrect authentication data (set_id=bentey)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/isotope/master/style-switcher/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:40:11 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:40:13 dovecot_login authenticator failed for H=(wbu0aoaBFQ) [178.16.54.22]:63044: 535 Incorrect authentication data (set_id=alanlai)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 74.7.243.234
country_id: 6252001
domain: mail.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/js/vendor/magnific-popup/img/photos/new-development.php||SC:/home2/pspolycom/public_html/js/vendor||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 27 09:41:13 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-27 09:41:15 dovecot_login authenticator failed for H=(aGDMMm) [178.16.54.22]:61979: 535 Incorrect authentication data (set_id=bentey)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:42:21 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-27 09:45:40 H=([45.144.212.242]) [45.144.212.242]:56053 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.217.72.1
country_id: 1269750
domain: visoft.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94540.visoft.com.my||ServerName:visoft.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:756968e2b88e247a952e4d793648553dc58899ce||Title:0x8b120f25||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.238
country_id: 3175395
description:
Jan 27 09:46:42 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.238 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.136.123.47
country_id: 1733045
description:
[2026-01-27 09:46:41 +0800] info [webmaild] 175.136.123.47 - roz@af-sb.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.35
country_id: 798544
description:
Jan 27 09:47:00 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.35 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.35
country_id: 798544
description:
Jan 27 09:47:07 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.35 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.244.35
country_id: 1733045
description:
[2026-01-27 09:50:31 +0800] info [webmaild] 60.52.244.35 - sge@ajplantations.com.my "GET /cpsess9862942419/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.161.221
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=655126 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.158.59
country_id: 1733045
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/General/Green Layer 2 Wcc-467x319.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.158.59
country_id: 1733045
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/General/Green Layer 2 Wcc-467x319.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 09:55:25 +0800] info [webmaild] 180.75.72.60 - - "GET /apple-touch-icon.png HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 09:57:00 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.192.106.240
country_id: 3469034
description:
Jan 27 09:57:34 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.192.106.240 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.132
country_id: 298795
description:
Jan 27 09:57:55 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 09:58:02 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.34.211.132
country_id: 298795
description:
Jan 27 09:58:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.34.211.132 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 09:58:47 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-27 10:00:06 H=([127.0.0.1]) [103.197.57.71]:36784 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.83.94.16
country_id: 1643084
description:
Jan 27 10:01:20 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.83.94.16 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 10:01:59 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 10:02:15 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess1084013194/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 10:03:03 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess7496811467/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 10:04:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57052: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-27 10:04:15 H=([91.92.240.254]) [91.92.240.254]:54503 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <6-03-55495suffian@pspoly.com.my>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-27 10:04:25 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.39.207.3
country_id: 390903
description:
2026-01-27 10:05:08 805835 [Warning] Aborted connection 805835 to db: 'unconnected' user: 'unauthenticated' host: '185.39.207.3' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 27 10:07:27 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.71.16.87
country_id: 1562822
description:
Jan 27 10:08:01 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.71.16.87 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/designproposal-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.94.154.169
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news-detail-7.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-27 10:11:36 H=([91.92.240.254]) [91.92.240.254]:52836 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <suffian@pspoly.com.my>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 27 10:13:16 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.101.164
country_id: 1733045
description:
[2026-01-27 10:13:51 +0800] info [webmaild] 183.171.101.164 - payment@tujusetia.my "GET /cpsess5934797549/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.39.207.3
country_id: 390903
description:
2026-01-27 10:14:47 806288 [Warning] Aborted connection 806288 to db: 'unconnected' user: 'unauthenticated' host: '185.39.207.3' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.156.214.134
country_id: 272103
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/banner3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.208.184.65
country_id: 3996063
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/logo.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.53.119.206
country_id: 3439705
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/banner1.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.252.39.41
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/logo-(3).png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.67.227
country_id: 953987
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/banner2.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.201.254.207
country_id: 99237
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/report/images/banner4.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.95.239.68
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-17.23.95.239.68||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-27 10:19:52 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess3739774369/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.52.137.110
country_id: 1733045
description:
[2026-01-27 10:19:20 +0800] info [webmaild] 60.52.137.110 - hakim@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.14.38
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-19.168.91.14.38||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 104.37.174.67
country_id: 6252001
description:
2026-01-27 10:24:32 H=([104.37.174.67]) [104.37.174.67]:49432 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<noreply@wetransfer.com> rejected RCPT <enquiry@nexuscollection.com>: SPF: 104.37.174.67 is not allowed to send mail from wetransfer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.72.35.203
country_id: 1814991
description:
Jan 27 10:26:51 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.72.35.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.149
country_id: 3469034
description:
Jan 27 10:30:22 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.138
country_id: 1269750
description:
Jan 27 10:30:02 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.237.46.87
country_id: 1269750
domain: astlog.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-31.172.237.46.87||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-27 10:31:52 +0800] info [cpaneld] 202.178.120.157 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 52.180.144.125
country_id: 6252001
description:
Jan 27 10:32:28 sv3 pure-ftpd[2093369]: (?@52.180.144.125) [INFO] New connection from 52.180.144.125


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-27 10:32:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57244: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.224
country_id: 953987
description:
Jan 27 10:35:09 sv3 auth[4189930]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/new-development.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 172.237.46.87
country_id: 1269750
domain: www.box.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-35.172.237.46.87||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-27 10:35:12 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


