# incident

plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.26.74.187
country_id: 3439705
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=18671514511844 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 05:50:15 H=([45.144.212.242]) [45.144.212.242]:62780 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 05:51:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.244.45
country_id: 3686110
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.102
country_id: 6252001
description:
Jan 17 05:53:31 sv3 pure-ftpd[1809316]: (?@205.210.31.102) [INFO] New connection from 205.210.31.102


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-17 05:54:19 H=(localhost.localdomain) [78.153.140.207]:42368 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.136.240
country_id: 3865483
domain: agsaintifik.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/agsaintifik.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/osl.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.37.193.78
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/Exception.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 06:05:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.142.33
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sorry/296/234935 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.238.247.238
country_id: 3469034
description:
2026-01-17 06:08:24 dovecot_login authenticator failed for H=([189.44.251.249]) [186.238.247.238]:58372: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.238.247.238
country_id: 3469034
description:
Jan 17 06:08:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.238.247.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 23.98.142.179
country_id: 6252001
domain: www.oxbold.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.6998.35 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.31.219.145
country_id: 290557
description:
2026-01-17 06:15:45 H=([5.31.219.145]) [5.31.219.145]:1065 F=<adilah@pspoly.com.my> rejected RCPT <adilah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.31.219.145
country_id: 290557
description:
2026-01-17 06:16:26 H=([5.31.219.145]) [5.31.219.145]:1029 F=<adilah@pspoly.com.my> rejected RCPT <adilah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 5.31.219.145
country_id: 290557
description:
2026-01-17 06:17:08 H=([5.31.219.145]) [5.31.219.145]:1065 F=<adilah@pspoly.com.my> rejected RCPT <adilah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.2.228.177
country_id: 1269750
description:
2026-01-17 06:25:30 dovecot_login authenticator failed for H=(static.ill.61.2.228.177.bsnl.co.in) [61.2.228.177]:54986: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/es/images/druma.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.204.125.124
country_id: 1835841
description:
Jan 17 06:25:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.204.125.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.204.125.124
country_id: 1835841
description:
2026-01-17 06:25:17 dovecot_login authenticator failed for H=([119.204.125.124]) [119.204.125.124]:56042: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.228.177
country_id: 1269750
description:
Jan 17 06:25:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.228.177 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.57.75.200
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-27.72.57.75.200||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:28:48 dovecot_login authenticator failed for H=(LH0n4MCKeo) [185.169.4.24]:58744: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.124.225.42
country_id: 2017370
description:
2026-01-17 06:28:48 dovecot_login authenticator failed for H=([188.124.225.42]) [188.124.225.42]:51936: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 06:28:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:28:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.225.42
country_id: 2017370
description:
Jan 17 06:28:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.225.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:29:28 dovecot_login authenticator failed for H=(DoOvIZZ) [185.169.4.24]:55091: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 81.29.142.100
country_id: 2017370
description:
2026-01-17  6:29:36 211299 [Warning] Aborted connection 211299 to db: 'unconnected' user: 'unauthenticated' host: '81.29.142.100' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 177.74.142.218
country_id: 3469034
description:
2026-01-17 06:29:44 H=([177.74.142.218]) [177.74.142.218]:59224 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.168.155
country_id: 2186224
description:
Jan 17 06:29:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.168.155 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.168.155
country_id: 2186224
description:
2026-01-17 06:29:17 dovecot_login authenticator failed for H=([121.73.168.155]) [121.73.168.155]:38308: 535 Incorrect authentication data (set_id=boss)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:29:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:30:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:30:16 dovecot_login authenticator failed for H=(6KiiwwvzG) [185.169.4.24]:64499: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 177.74.142.218
country_id: 3469034
description:
2026-01-17 06:30:40 H=([177.74.142.218]) [177.74.142.218]:59447 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:31:01 dovecot_login authenticator failed for H=(ksrNRav) [185.169.4.24]:58460: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 177.74.142.218
country_id: 3469034
description:
2026-01-17 06:31:23 H=([177.74.142.218]) [177.74.142.218]:58679 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:30:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 06:32:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 177.74.142.218
country_id: 3469034
description:
2026-01-17 06:32:05 H=([177.74.142.218]) [177.74.142.218]:58562 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:32:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:32:27 dovecot_login authenticator failed for H=(v2QmykeMT) [185.169.4.24]:64627: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.131.106
country_id: 6252001
description:
2026-01-17 06:33:47 dovecot_plain authenticator failed for H=(qytiaqtbf193tgqvu4mn7lfs73o) [181.214.131.106]:11355: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.105.159
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-33.50.117.105.159||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:33:06 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:33:08 dovecot_login authenticator failed for H=(T8U8iow) [185.169.4.24]:54780: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:34:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:34:34 dovecot_login authenticator failed for H=(A4CHOX4) [185.169.4.24]:64622: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:35:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:35:12 dovecot_login authenticator failed for H=(AIf7SiYaG) [185.169.4.24]:60141: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.0.69.178
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/fight/15/1598030 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:36:34 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:36:36 dovecot_login authenticator failed for H=(6Sb7JsoR) [185.169.4.24]:54633: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:37:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:37:16 dovecot_login authenticator failed for H=(HLS3G4) [185.169.4.24]:49425: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:38:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:38:05 dovecot_login authenticator failed for H=(jUFDXmOf) [185.169.4.24]:52304: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:39:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:39:25 dovecot_login authenticator failed for H=(SvF2jOqI) [185.169.4.24]:59913: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.196.143.250
country_id: 3469034
description:
Jan 17 06:39:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.196.143.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:40:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:40:09 dovecot_login authenticator failed for H=(STen6cwkSZ) [185.169.4.24]:63879: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.85.99
country_id: 2328926
description:
Jan 17 06:40:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.85.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.76.85.99
country_id: 2328926
description:
Jan 17 06:41:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.76.85.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 17 06:41:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-17 06:41:11 dovecot_login authenticator failed for H=(U94fDJ) [185.169.4.24]:56086: 535 Incorrect authentication data (set_id=fury@col.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-17 06:43:29 H=(localhost.localdomain) [78.153.140.207]:44320 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/img/photos/index.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.150.4.119
country_id: 6252001
description:
2026-01-17 06:50:45 dovecot_login authenticator failed for H=([127.0.0.1]) [67.150.4.119]:44740: 535 Incorrect authentication data (set_id=info@langkawitravels.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jan 17 06:50:06 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jan 17 06:52:23 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.156.124.119
country_id: 1168579
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=4111725259 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.87.194.80
country_id: 1168579
description:
Jan 17 06:58:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.87.194.80 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.194.80
country_id: 1168579
description:
2026-01-17 06:58:49 dovecot_login authenticator failed for H=([103.253.19.87]) [103.87.194.80]:54108: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.159.172.99
country_id: 3996063
domain: webmail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/webmail.fimco.com.my/cgi-bin HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.34.127
country_id: 3996063
domain: webmail.fimco.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/webmail.fimco.com.my/cgi-bin/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 122.8.91.165
country_id: 1819730
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-00.122.8.91.165||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.52
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-04.92.71.74.52||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 69.118.209.86
country_id: 6252001
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/products/masaaki-rice-bran/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.165
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/dynamic_style.css?ver=6.1.2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.144
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/style.css?ver=6.4.7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.205
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/shortcodes.css?ver=6.1.2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.138
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/js_composer.css?ver=6.1.2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.231
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/masaakisb.com/wp-content/uploads/porto_styles/bootstrap.css?ver=6.1.2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.169
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.9.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.235
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/css/theme.css?ver=6.4.7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.155
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/plugins/revslider/sr6/assets/css/rs6.css?ver=6.7.18 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.214
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/css/plugins_optimized.css?ver=6.4.7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.237
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto-child/style.css?ver=6.4.7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.159
country_id: 1880251
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/wp-content/themes/porto/fonts/fontawesome_optimized/fa-regular-400.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:07:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:07:04 dovecot_login authenticator failed for H=(ElvfNYXHQu) [158.94.208.175]:54000: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 07:07:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 191.199.200.31
country_id: 3469034
domain: advisorygroup.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:77516.advisorygroup.com.my||ServerName:advisorygroup.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb89baea7604457c1eb055aeae139dc37436f8df||Title:0xad290d4b||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/es/img/photos/team.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:08:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:08:34 dovecot_login authenticator failed for H=(Mu3Vbmunt1) [158.94.208.175]:58638: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 07:09:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:09:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:09:05 dovecot_login authenticator failed for H=(zaGPlFLcm5) [158.94.208.175]:63110: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:10:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:10:37 dovecot_login authenticator failed for H=(vw0L3z6JpN) [158.94.208.175]:54401: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.133.57
country_id: 690791
description:
Jan 17 07:11:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.133.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:11:06 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:11:08 dovecot_login authenticator failed for H=(0k7h4imiW) [158.94.208.175]:60556: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:12:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:12:10 dovecot_login authenticator failed for H=(Nbuugbp) [158.94.208.175]:49890: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-17 07:13:51 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:36026: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 167.250.103.184
country_id: 3469034
description:
Jan 17 07:13:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 167.250.103.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:13:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:13:11 dovecot_login authenticator failed for H=(oZf8Ag9) [158.94.208.175]:61275: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.245
country_id: 3469034
description:
Jan 17 07:13:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:14:13 dovecot_login authenticator failed for H=(XSr3HCPB) [158.94.208.175]:64897: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.18.98.8
country_id: 298795
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/excite/18/687/1895760 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:14:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:15:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:15:16 dovecot_login authenticator failed for H=(Bdo1ussf) [158.94.208.175]:63897: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.187.7.14
country_id: 1835841
description:
2026-01-17 07:15:39 dovecot_login authenticator failed for H=([211.187.7.14]) [211.187.7.14]:42475: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:16:18 dovecot_login authenticator failed for H=(RgXAodrzZ) [158.94.208.175]:59790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:16:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:17:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:17:29 dovecot_login authenticator failed for H=(X0xsre9Ys0) [158.94.208.175]:52398: 535 Incorrect authentication data (set_id=covers)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.109
country_id: 2510769
description:
Jan 17 07:17:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.109
country_id: 2510769
description:
Jan 17 07:17:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:17:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:18:01 dovecot_login authenticator failed for H=(1lgTQQ) [158.94.208.175]:60183: 535 Incorrect authentication data (set_id=covers)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.35.120.169
country_id: 1814991
description:
Jan 17 07:19:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.35.120.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.35.120.169
country_id: 1814991
description:
2026-01-17 07:19:31 dovecot_login authenticator failed for H=([58.35.120.169]) [58.35.120.169]:11766: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.41.16
country_id: 798549
description:
Jan 17 07:19:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.41.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.41.16
country_id: 798549
description:
2026-01-17 07:19:42 dovecot_login authenticator failed for H=(ADMIN) [89.32.41.16]:44958: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:19:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:19:03 dovecot_login authenticator failed for H=(oLCCQ3o) [158.94.208.175]:64536: 535 Incorrect authentication data (set_id=covers)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:20:37 dovecot_login authenticator failed for H=(lRrMN4dx) [158.94.208.175]:55495: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.183.18
country_id: 1269750
description:
Jan 17 07:20:41 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.183.18 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.183.18
country_id: 1269750
description:
2026-01-17 07:20:43 dovecot_login authenticator failed for H=([125.23.183.18]) [125.23.183.18]:35122: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:20:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:20:13 dovecot_login authenticator failed for H=(RJf90y5AN) [158.94.208.175]:62996: 535 Incorrect authentication data (set_id=covers)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.91
country_id: 690791
description:
Jan 17 07:20:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.91 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.94.208.175
country_id: 2921044
description:
Jan 17 07:21:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.94.208.175 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.94.208.175
country_id: 2921044
description:
2026-01-17 07:21:06 dovecot_login authenticator failed for H=(PdNgW1XuJZ) [158.94.208.175]:55640: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.36
country_id: 3175395
description:
Jan 17 07:22:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 167.250.99.78
country_id: 3469034
description:
2026-01-17 07:24:27 dovecot_login authenticator failed for H=(213.5.130.102) [167.250.99.78]:34686: 535 Incorrect authentication data (set_id=mdnaser@grandteknik.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.39.73.186
country_id: 6252001
description:
2026-01-17 07:26:24 dovecot_login authenticator failed for H=(static-50-39-73-186.bvtn.or.ptr.ziplyfiber.com) [50.39.73.186]:49241: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 07:27:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.151.42
country_id: 1733045
description:
Jan 17 07:27:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.151.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.218.49
country_id: 3469034
description:
Jan 17 07:27:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.218.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.83.181.181
country_id: 6252001
description:
Jan 17 07:29:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.83.181.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.83.181.181
country_id: 6252001
description:
2026-01-17 07:29:40 dovecot_plain authenticator failed for H=c-68-83-181-181.hsd1.pa.comcast.net (fopheraid) [68.83.181.181]:57594: 535 Incorrect authentication data (set_id=mhisham.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.243.14
country_id: 2510769
description:
Jan 17 07:33:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.243.14 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.61
country_id: 6252001
description:
2026-01-17  7:33:56 213518 [Warning] Aborted connection 213518 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.61' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.63
country_id: 2300660
description:
Jan 17 07:35:37 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.171.12.165
country_id: 1269750
description:
Jan 17 07:35:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.171.12.165 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.224
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/css/animation.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/kidscare.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.195
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/responsive.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/font/fontello09eb.woff?22036640 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.119.144
country_id: 3625428
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/printed.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.157
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/fontello/css/fontello.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.235
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/shortcodes.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.228
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/__packed.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.227
country_id: 1880251
domain: kdiballoon.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/kdiballoon.com/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.216.29.106
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=634412 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.199.95.75
country_id: 6252001
description:
2026-01-17 07:44:55 dovecot_login authenticator failed for H=([127.0.0.1]) [47.199.95.75]:57252: 535 Incorrect authentication data (set_id=info@langkawiconstructions.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.243.240.229
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-49.196.243.240.229||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/druma/awards.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.139
country_id: 732800
description:
Jan 17 07:52:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jan 17 07:53:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.93.68.109
country_id: 298795
description:
Jan 17 07:53:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.93.68.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.232.64.53
country_id: 3469034
description:
Jan 17 07:53:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.232.64.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.171
country_id: 953987
description:
Jan 17 07:53:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.171 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.27.93.244
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-58.185.27.93.244||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.100
country_id: 953987
description:
Jan 17 07:59:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.100 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 07:59:50 H=([45.144.212.242]) [45.144.212.242]:60509 F=<no_reply@admin.com> rejected RCPT <bengkok.lim@acburn.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.179.233.27
country_id: 2542007
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/145142.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.208.169.218
country_id: 3625428
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/934240.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.222.203.227
country_id: 3686110
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/166039.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.150.65.215
country_id: 2635167
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/408682.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.175
country_id: 798544
description:
Jan 17 08:01:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.98.243.136
country_id: 2589581
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/333525.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 130.250.229.186
country_id: 3686110
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/900186.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.161.129.172
country_id: 192950
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/img/photos/889600.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.192.179.175
country_id: 798544
description:
Jan 17 08:02:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.192.179.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.161.111
country_id: 953987
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/slide-page/construction-work HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 60.50.35.84
country_id: 1733045
description:
[2026-01-17 08:02:59 +0800] info [webmaild] 60.50.35.84 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.55.228.225
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1191009474.jpg&size=1000x1000 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.22
country_id: 798544
description:
Jan 17 08:06:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.185.65.146
country_id: 1269750
description:
Jan 17 08:06:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.185.65.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.185.65.146
country_id: 1269750
description:
2026-01-17 08:06:50 dovecot_login authenticator failed for H=(nsg-corporate-146.65.185.122.airtel.in) [122.185.65.146]:43098: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 08:09:24 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.94.94
country_id: 1269750
description:
2026-01-17 08:11:06 dovecot_plain authenticator failed for H=(vanagamens) [27.123.94.94]:44232: 535 Incorrect authentication data (set_id=sales@ajresorts.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.159.171.110
country_id: 3469034
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/gcb-product.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.230.158
country_id: 1269750
description:
Jan 17 08:13:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.230.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.158
country_id: 1269750
description:
2026-01-17 08:13:40 dovecot_login authenticator failed for H=([182.95.230.158]) [182.95.230.158]:34102: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 184.105.247.252
country_id: 6252001
description:
Jan 17 08:12:59 sv3 pure-ftpd[1883938]: (?@184.105.247.252) [INFO] New connection from 184.105.247.252


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 171.15.115.23
country_id: 1814991
description:
2026-01-17 08:14:02 dovecot_login authenticator failed for H=(15.171.broad.ha.dynamic.163data.com.cn) [171.15.115.23]:40400: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.105
country_id: 732800
description:
Jan 17 08:20:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 08:20:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.195.236.49
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=268452 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 08:20:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-17 08:20:50 H=(localhost.localdomain) [78.153.140.207]:45194 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.170
country_id: 3175395
description:
Jan 17 08:20:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.170 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.105
country_id: 732800
description:
Jan 17 08:20:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.105 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.98.45.238
country_id: 6252001
description:
2026-01-17 08:23:52 dovecot_plain authenticator failed for H=c-24-98-45-238.hsd1.ga.comcast.net (radon) [24.98.45.238]:42932: 535 Incorrect authentication data (set_id=justina.ling@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 08:23:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 08:25:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 113.211.56.81
country_id: 1733045
domain: www.box.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.64||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.50.200.86
country_id: 3658394
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/18extendedcalculation.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.211.219.91
country_id: 241170
description:
2026-01-17  8:32:52 215701 [Warning] Aborted connection 215701 to db: 'unconnected' user: 'unauthenticated' host: '103.211.219.91' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 103.211.219.91
country_id: 241170
description:
2026-01-17  8:32:54 215709 [Warning] Aborted connection 215709 to db: 'unconnected' user: 'unauthenticated' host: '103.211.219.91' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.197
country_id: 3175395
description:
Jan 17 08:38:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.197 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.211.219.91
country_id: 241170
description:
2026-01-17  8:37:55 215892 [Warning] Aborted connection 215892 to db: 'unconnected' user: 'unauthenticated' host: '103.211.219.91' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 103.211.219.91
country_id: 241170
description:
2026-01-17  8:37:58 215900 [Warning] Aborted connection 215900 to db: 'unconnected' user: 'unauthenticated' host: '103.211.219.91' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.65
country_id: 3469034
description:
Jan 17 08:38:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.71.239.18
country_id: 3469034
description:
Jan 17 08:38:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.71.239.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.197
country_id: 3175395
description:
Jan 17 08:39:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.242
country_id: 1269750
description:
Jan 17 08:39:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.242 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.2.83
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f002/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.194.8.218
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/deep-copy/fixtures/f002 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.40.68
country_id: 2395170
description:
Jan 17 08:45:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.40.68 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 185.208.159.112
country_id: 6252001
description:
185.208.159.112 - - [17/Jan/2026:08:46:24 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10382745&pdata=https%3A%2F%2Fmail.tujusetia.my%3A2096&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768610783 HTTP/1.1" 302 0 mail.tujusetia.my "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 Edg/137.0.0.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:185.208.159.112


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 185.208.159.112
country_id: 6252001
description:
[2026-01-17 08:46:31 +0800] info [webmaild] 185.208.159.112 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cert.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.209.183
country_id: 798544
description:
Jan 17 08:48:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.209.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.209.183
country_id: 798544
description:
Jan 17 08:49:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.209.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.218
country_id: 2510769
description:
Jan 17 08:49:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 2.216.205.29
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/run/17/32/1730986 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/img/private-residence.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.36
country_id: 6252001
description:
Jan 17 08:53:49 sv3 pure-ftpd[1908549]: (?@147.185.132.36) [INFO] New connection from 147.185.132.36


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.106.55.26
country_id: 99237
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-howtogetthere.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.66.7.179
country_id: 2542007
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=9 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.137.32
country_id: 2510769
description:
Jan 17 09:05:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.137.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.198
country_id: 2395170
description:
Jan 17 09:05:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.47
country_id: 798544
description:
Jan 17 09:05:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.47 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.155.87
country_id: 6252001
description:
2026-01-17  9:09:37 217109 [Warning] Aborted connection 217109 to db: 'unconnected' user: 'unauthenticated' host: '199.45.155.87' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.194
country_id: 1269750
description:
Jan 17 09:11:31 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.194
country_id: 1269750
description:
2026-01-17 09:11:33 dovecot_login authenticator failed for H=(nsg-corporate-194.229.187.122.airtel.in) [122.187.229.194]:36284: 535 Incorrect authentication data (set_id=lutfi@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.216.33.31
country_id: 1269750
description:
Jan 17 09:13:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.216.33.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.216.33.31
country_id: 1269750
description:
2026-01-17 09:13:57 dovecot_login authenticator failed for H=([117.216.33.31]) [117.216.33.31]:52328: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.139.178.45
country_id: 1733045
description:
2026-01-17 09:15:33 dovecot_login authenticator failed for H=(LAPTOP9F0UABRE) [175.139.178.45]:58206: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.36.80.189
country_id: 1814991
description:
2026-01-17 09:19:36 dovecot_login authenticator failed for H=(ADMIN) [59.36.80.189]:42554: 535 Incorrect authentication data


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-17 09:20:03 H=(localhost.localdomain) [78.153.140.207]:58582 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 177.239.37.63
country_id: 3996063
description:
2026-01-17 09:20:18 H=([177.239.37.63]) [177.239.37.63]:58434 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 177.239.37.63
country_id: 3996063
description:
2026-01-17 09:22:05 H=([177.239.37.63]) [177.239.37.63]:36323 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
country_id: 2017370
description:
Jan 17 09:22:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.216.33.31
country_id: 1269750
description:
Jan 17 09:23:39 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.216.33.31 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.216.33.31
country_id: 1269750
description:
2026-01-17 09:23:41 dovecot_login authenticator failed for H=([117.216.33.31]) [117.216.33.31]:33968: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 09:28:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.242.61.9
country_id: 1814991
description:
2026-01-17 09:29:10 dovecot_login authenticator failed for H=([114.242.61.9]) [114.242.61.9]:33436: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.242.61.9
country_id: 1814991
description:
Jan 17 09:29:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.242.61.9 has been locked due to Imunify RBL


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 10.1.14.100
description:
Jan 17 09:30:28 sv3 sshd[1934625]: Accepted publickey for root from 10.1.14.100 port 57632 ssh2: RSA SHA256:WdDh84n9i7OwfL83TC4Q9y94bNOmxYGU2yeZfrTsxL0


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.57
country_id: 3469034
description:
Jan 17 09:30:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 17 09:31:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.14.198
country_id: 3469034
description:
Jan 17 09:32:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.14.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.187.23.162
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=456483 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.185
country_id: 3469034
description:
Jan 17 09:33:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.178.194.133
country_id: 2017370
description:
Jan 17 09:41:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.178.194.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.178.194.133
country_id: 2017370
description:
2026-01-17 09:41:44 dovecot_login authenticator failed for H=([178.178.194.133]) [178.178.194.133]:32240: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.65.177.5
country_id: 2542007
description:
2026-01-17 09:48:33 dovecot_plain authenticator failed for H=([169.254.123.140]) [196.65.177.5]:48127: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.0.155.93
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603871 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan 17 09:53:29 sv3 pure-ftpd[1951978]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.79
country_id: 3175395
description:
Jan 17 09:54:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.135
country_id: 6290252
description:
Jan 17 09:55:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.77
country_id: 3469034
description:
Jan 17 09:55:48 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.77
country_id: 3469034
description:
Jan 17 09:55:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 09:56:25 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-17 09:57:37 H=(localhost.localdomain) [78.153.140.207]:47902 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-17 10:00:00 H=([127.0.0.1]) [103.197.57.71]:46372 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.6
country_id: 3175395
description:
Jan 17 10:01:44 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.6
country_id: 3175395
description:
Jan 17 10:01:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 2750405
description:
2026-01-17 10:02:31 219043 [Warning] Aborted connection 219043 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.190
country_id: 2750405
description:
Jan 17 10:02:29 sv3 pure-ftpd[1958339]: (?@130.12.182.190) [INFO] New connection from 130.12.182.190


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.175.208.10
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-text-template/src HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.176.160.78
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpunit/php-text-template/src/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/druma.php||SC:/home/indfinitydesign/public_html/img/photos/druma.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.111
country_id: 6251999
description:
2026-01-17 10:08:35 dovecot_plain authenticator failed for H=([10.12.18.187]) [140.228.21.111]:21796: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.111
country_id: 6251999
description:
2026-01-17 10:09:02 dovecot_plain authenticator failed for H=([10.12.18.187]) [140.228.21.111]:9570: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.26.40
country_id: 1269750
description:
Jan 17 10:12:30 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.26.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.193
country_id: 3469034
description:
Jan 17 10:13:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 10:13:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.48.55.67
country_id: 597427
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-13.185.48.55.67||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 10:17:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.186.138.39
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/OOCalcReaderPCLZip.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.223.98.117
country_id: 1814991
description:
Jan 17 10:21:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.223.98.117 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.223.98.117
country_id: 1814991
description:
2026-01-17 10:21:16 dovecot_login authenticator failed for H=([27.223.98.117]) [27.223.98.117]:60450: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.208.122
country_id: 933860
description:
Jan 17 10:21:21 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.208.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.224.47
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=93521515121133 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.82
country_id: 3175395
description:
Jan 17 10:23:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.137.86
country_id: 2963597
description:
Jan 17 10:25:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.137.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.137.86
country_id: 2963597
description:
Jan 17 10:26:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.137.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.106.115
country_id: 1814991
description:
Jan 17 10:27:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.106.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.106.115
country_id: 1814991
description:
2026-01-17 10:27:03 dovecot_login authenticator failed for H=([111.26.106.114]) [111.26.106.115]:42102: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 10:29:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.245.32.161
country_id: 3865483
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/1475280832.jpg&size=1000x1000 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.230.133.38
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/birthday/16/81/1697365 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.156.249
country_id: 1831722
description:
Jan 17 10:32:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.156.249 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.156.249
country_id: 1831722
description:
2026-01-17 10:32:06 dovecot_plain authenticator failed for H=(3rligdzhf3hdv9rq5) [203.189.156.249]:47587: 535 Incorrect authentication data (set_id=bktan@printspecsolution.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.74.98.91
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74851515726086 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.160
country_id: 798544
description:
Jan 17 10:35:43 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.123
country_id: 3865483
description:
Jan 17 10:35:50 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.123 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/login.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.160
country_id: 798544
description:
Jan 17 10:35:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.123
country_id: 3865483
description:
Jan 17 10:35:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.55.80
country_id: 3469034
description:
Jan 17 10:36:13 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.55.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.240
country_id: 3175395
description:
Jan 17 10:36:38 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.240 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.242.248
country_id: 1733045
description:
[2026-01-17 10:40:38 +0800] info [webmaild] 27.125.242.248 - jlpom@ajplantations.com.my "GET /cpsess7818904382/3rdparty/roundcube/?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1768617637581 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.242.55] != Current IP Address [27.125.242.248]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.253.48.89
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-40.104.253.48.89||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.242.248
country_id: 1733045
description:
[2026-01-17 10:40:58 +0800] info [webmaild] 27.125.242.248 - jlpom@ajplantations.com.my "GET /cpsess7818904382/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Sent HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.242.213
country_id: 1733045
description:
[2026-01-17 10:42:09 +0800] info [webmaild] 27.125.242.213 - jlpom@ajplantations.com.my "GET /cpsess2084983979/3rdparty/roundcube/?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1768617727995 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.242.248] != Current IP Address [27.125.242.213]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 10:42:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.184.116.226
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/tall/12/459/1283003 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 10:48:43 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63343: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 10:49:01 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63351: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 10:50:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63377: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 10:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62106: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.183
country_id: 3469034
description:
Jan 17 10:54:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.183 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 10:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58583: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.158
country_id: 6252001
description:
2026-01-17 10:57:01 dovecot_plain authenticator failed for H=([10.29.18.165]) [79.127.132.158]:4860: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.132.158
country_id: 6252001
description:
2026-01-17 10:57:57 dovecot_plain authenticator failed for H=([10.29.18.165]) [79.127.132.158]:60334: 535 Incorrect authentication data (set_id=fkr@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/osl.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.198.61.146
country_id: 1814991
description:
Jan 17 11:02:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.198.61.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.198.61.146
country_id: 1814991
description:
2026-01-17 11:03:01 dovecot_login authenticator failed for H=([120.198.61.146]) [120.198.61.146]:40576: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.96.199.224
country_id: 3865483
description:
Jan 17 11:03:16 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.96.199.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.169
country_id: 690791
description:
Jan 17 11:03:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 11:04:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58674: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/eco.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/home/contact.php||SC:/home/indfinitydesign/public_html/images/home||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.105.104
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-06.166.0.105.104||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 46.246.92.216
country_id: 2661886
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X19; Linux x86_54) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/003.0.5058.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.248
country_id: 6252001
description:
2026-01-17 11:10:17 221805 [Warning] Aborted connection 221805 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.248' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jan 17 11:11:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.189
country_id: 3865483
description:
Jan 17 11:12:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.17.102
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/ramsey/uuid/src/UuidFactory.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.242.44
country_id: 1733045
description:
[2026-01-17 11:14:22 +0800] info [webmaild] 27.125.242.44 - jlpom@ajplantations.com.my "POST /cpsess1368313931/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.242.213] != Current IP Address [27.125.242.44]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.144.35.124
country_id: 6252001
description:
2026-01-17 11:16:09 dovecot_plain authenticator failed for H=([100.64.100.6]) [136.144.35.124]:30048: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.41.16
country_id: 798549
description:
2026-01-17 11:19:35 dovecot_login authenticator failed for H=(ADMIN) [89.32.41.16]:58240: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.41.16
country_id: 798549
description:
Jan 17 11:19:33 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.41.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 11:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:58896: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/fonts/fontawesome-webfont5b62.woff2?v=4.6.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/css/bootstrap.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.147
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/css/color.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/fonts/Aller_Rg.woff HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.63.24.32
country_id: 3686110
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/product-details-cl.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/css/font-awesome.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/css/animate.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/css/owl.carousel.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.188.150
country_id: 3469034
description:
Jan 17 11:22:46 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.188.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.188.150
country_id: 3469034
description:
Jan 17 11:23:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.188.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.15.158
country_id: 1880251
description:
Jan 17 11:28:40 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.15.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.65.15.158
country_id: 1880251
description:
2026-01-17 11:28:42 dovecot_login authenticator failed for H=(ttcnc-ubuntu-s-1vcpu-2gb-sgp1-01) [159.65.15.158]:42986: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 159.65.15.158
country_id: 1880251
description:
Jan 17 11:28:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 159.65.15.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 159.65.15.158
country_id: 1880251
description:
2026-01-17 11:29:00 dovecot_login authenticator failed for H=(ttcnc-ubuntu-s-1vcpu-2gb-sgp1-01) [159.65.15.158]:43530: 535 Incorrect authentication data (set_id=central@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.114.149.106
country_id: 1814991
description:
Jan 17 11:29:42 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.114.149.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.114.149.106
country_id: 1814991
description:
2026-01-17 11:29:44 dovecot_login authenticator failed for H=([124.114.149.106]) [124.114.149.106]:40737: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.163.151.173
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=824962 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.116.18
country_id: 1733045
description:
2026-01-17 11:36:20 dovecot_login authenticator failed for H=(DESKTOP8H475EO) [113.211.116.18]:15344: 535 Incorrect authentication data (set_id=dhill.project@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.82
country_id: 1814991
description:
Jan 17 11:37:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.66.106
country_id: 3469034
description:
Jan 17 11:37:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.66.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.154.171
country_id: 3703430
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.114.140.70
country_id: 3469034
description:
Jan 17 11:39:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.114.140.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.36.219
country_id: 3703430
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/product.php?id=63&page=5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.100.235.173
country_id: 1210997
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/www.google-analytics.com/analytics.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.178.58.170
country_id: 2542007
description:
2026-01-17 11:41:02 H=([160.178.58.170]) [160.178.58.170]:23674 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 175.214.229.129
country_id: 1835841
description:
2026-01-17 11:41:17 H=([175.214.229.129]) [175.214.229.129]:31727 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.199.96.248
country_id: 1269750
description:
Jan 17 11:41:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.199.96.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.199.96.248
country_id: 1269750
description:
2026-01-17 11:41:20 dovecot_plain authenticator failed for H=(ox8ptsij1dbb2dl6osci3hyqgdmx) [117.199.96.248]:44486: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 71.197.97.156
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ruler/15/304/1530521 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 175.214.229.129
country_id: 1835841
description:
2026-01-17 11:42:11 H=([175.214.229.129]) [175.214.229.129]:32275 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.178.58.170
country_id: 2542007
description:
2026-01-17 11:42:32 H=([160.178.58.170]) [160.178.58.170]:24276 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.120
country_id: 3175395
description:
Jan 17 11:42:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.160.81.50
country_id: 934292
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/Quadratic.xlsx HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 160.178.58.170
country_id: 2542007
description:
2026-01-17 11:43:13 H=([160.178.58.170]) [160.178.58.170]:24284 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.126.64.92
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/doctrine/dbal/UPGRADE.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 175.214.229.129
country_id: 1835841
description:
2026-01-17 11:43:35 H=([175.214.229.129]) [175.214.229.129]:32470 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.6
country_id: 3175395
description:
Jan 17 11:44:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.6 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.223.3
country_id: 1269750
description:
Jan 17 11:44:52 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.223.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.48
country_id: 3469034
description:
Jan 17 11:44:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.119
country_id: 3469034
description:
Jan 17 11:44:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.36
country_id: 3175395
description:
Jan 17 11:44:53 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.223.3
country_id: 1269750
description:
Jan 17 11:45:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.223.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.36
country_id: 3175395
description:
Jan 17 11:45:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.48
country_id: 3469034
description:
Jan 17 11:45:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.119
country_id: 3469034
description:
Jan 17 11:45:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.119 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.247
country_id: 798544
description:
Jan 17 11:45:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.247 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.34.109
country_id: 953987
description:
Jan 17 11:45:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.34.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 11:45:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.6
country_id: 3175395
description:
Jan 17 11:44:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 11:48:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59105: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.125
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-52.92.71.72.125||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.132.114.66
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sound/15/365/1504050 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 59.97.56.79
country_id: 1269750
description:
2026-01-17 11:54:06 H=([59.97.56.79]) [59.97.56.79]:18949 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.189.141.138
country_id: 1831722
description:
Jan 17 11:55:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.189.141.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.189.141.138
country_id: 1831722
description:
2026-01-17 11:55:22 dovecot_plain authenticator failed for H=(kimmark.com) [203.189.141.138]:34864: 535 Incorrect authentication data (set_id=general@kimmark.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 59.97.56.79
country_id: 1269750
description:
2026-01-17 11:56:11 H=([59.97.56.79]) [59.97.56.79]:19202 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.82
country_id: 1814991
description:
Jan 17 11:56:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.79.22.130
country_id: 1562822
description:
Jan 17 11:57:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.79.22.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.79.22.130
country_id: 1562822
description:
2026-01-17 11:57:02 dovecot_login authenticator failed for H=([27.79.22.130]) [27.79.22.130]:52630: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.146.108
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=82&page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 59.97.56.79
country_id: 1269750
description:
2026-01-17 11:57:28 H=([59.97.56.79]) [59.97.56.79]:19423 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 59.97.56.79
country_id: 1269750
description:
2026-01-17 11:58:09 H=([59.97.56.79]) [59.97.56.79]:19455 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.249.55.245
country_id: 1269750
description:
Jan 17 11:59:35 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.249.55.245 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.114.140.70
country_id: 3469034
description:
Jan 17 11:59:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.114.140.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.154.212.145
country_id: 1522867
domain: langkawiconstructions.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/langkawiconstructions.com/contact-us HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.42
country_id: 3175395
description:
Jan 17 12:02:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.42 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.220.68.114
country_id: 51537
description:
Jan 17 12:03:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.220.68.114 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 12:05:45 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.162
country_id: 1269750
description:
Jan 17 12:06:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.162
country_id: 1269750
description:
2026-01-17 12:06:13 dovecot_login authenticator failed for H=([122.187.230.162]) [122.187.230.162]:39452: 535 Incorrect authentication data (set_id=nurhidayati@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 100.37.16.11
country_id: 6252001
description:
Jan 17 12:08:19 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 100.37.16.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 100.37.16.11
country_id: 6252001
description:
2026-01-17 12:08:21 dovecot_login authenticator failed for H=pool-100-37-16-11.nycmny.fios.verizon.net [100.37.16.11]:53535: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.195.135.222
country_id: 1814991
description:
Jan 17 12:09:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.195.135.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.195.135.222
country_id: 1814991
description:
2026-01-17 12:09:05 dovecot_login authenticator failed for H=([183.195.135.222]) [183.195.135.222]:43061: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.76.151
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-09.92.71.76.151||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 12:10:20 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 12:12:36 H=([77.83.39.167]) [77.83.39.167]:55497 F=<stevenwelboun@op.pl> rejected RCPT <fkr@fkr.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 12:16:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59326: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.89.214.126
country_id: 3469034
description:
Jan 17 12:16:29 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.89.214.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.184
country_id: 3469034
description:
Jan 17 12:16:51 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.206
country_id: 3469034
description:
Jan 17 12:16:54 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.206 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.184
country_id: 3469034
description:
Jan 17 12:16:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.196.206
country_id: 3469034
description:
Jan 17 12:17:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.196.206 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.111.60.7
country_id: 3469034
description:
Jan 17 12:18:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.111.60.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Jan 17 12:19:55 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-17 12:19:57 dovecot_plain authenticator failed for H=(hymbits) [102.53.15.180]:44544: 535 Incorrect authentication data (set_id=feiteen.gan@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.2.6
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=98121515744957 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.62
country_id: 1269750
description:
2026-01-17 12:21:56 dovecot_plain authenticator failed for H=(erbessal) [182.95.223.62]:56028: 535 Incorrect authentication data (set_id=kimting.yap@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Jan 17 12:21:22 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-17 12:21:24 dovecot_plain authenticator failed for H=(barte) [102.53.15.180]:59859: 535 Incorrect authentication data (set_id=irene.wong@tujusetia.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 2750405
description:
2026-01-17 12:27:05 224665 [Warning] Aborted connection 224665 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.190
country_id: 2750405
description:
Jan 17 12:27:04 sv3 pure-ftpd[2063774]: (?@130.12.182.190) [INFO] New connection from 130.12.182.190


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.60.153
country_id: 953987
description:
Jan 17 12:31:17 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.60.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.51
country_id: 953987
description:
Jan 17 12:31:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.52.51
country_id: 953987
description:
Jan 17 12:31:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.52.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.40.115
country_id: 953987
description:
Jan 17 12:32:59 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.40.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.197.101
country_id: 3469034
description:
Jan 17 12:33:32 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.197.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.241.77.78
country_id: 1269750
description:
2026-01-17 12:36:49 dovecot_login authenticator failed for H=([117.241.77.78]) [117.241.77.78]:41464: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.185.204.30
country_id: 1269750
description:
Jan 17 12:36:28 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.185.204.30 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 128.185.204.30
country_id: 1269750
description:
2026-01-17 12:36:30 dovecot_plain authenticator failed for H=(arness) [128.185.204.30]:45648: 535 Incorrect authentication data (set_id=tekchow.kok@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.241.77.78
country_id: 1269750
description:
Jan 17 12:36:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.241.77.78 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.37.174
country_id: 1733045
description:
[2026-01-17 12:39:42 +0800] info [webmaild] 113.211.37.174 - teressa@smartcable.com.my "POST /cpsess7983019004/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [115.134.149.232] != Current IP Address [113.211.37.174]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.40.103.252
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/SafeStorage.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 12:44:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59534: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 76.151.225.162
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/mountain/312/662957 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.161.172
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-51.166.0.161.172||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.188.55.102
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/shoe/13/599/1349241 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/company.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.127.5.83
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=644279 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.12.133.18
country_id: 3865483
description:
Jan 17 12:58:49 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.12.133.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.12.133.18
country_id: 3865483
description:
Jan 17 12:58:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.12.133.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.69
country_id: 3469034
description:
Jan 17 12:59:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.69 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 117.196.255.247
country_id: 1269750
description:
Jan 17 13:02:25 sv3 pure-ftpd[2087185]: (?@117.196.255.247) [INFO] New connection from 117.196.255.247


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 117.196.255.247
country_id: 1269750
description:
Jan 17 13:02:28 sv3 pure-ftpd[2087185]: (?@117.196.255.247) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:04:27 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:04:29 dovecot_login authenticator failed for H=(N21EECufr) [77.83.39.167]:58091: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:05:14 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:05:16 dovecot_login authenticator failed for H=(WSh6CtRW) [77.83.39.167]:52075: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:06:03 dovecot_login authenticator failed for H=(NIsEY8u) [77.83.39.167]:62406: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:06:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:07:11 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:07:13 dovecot_login authenticator failed for H=(2VwvIQb) [77.83.39.167]:60195: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.86
country_id: 690791
description:
Jan 17 13:07:36 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:07:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:08:00 dovecot_login authenticator failed for H=(50cYyHw7kL) [77.83.39.167]:50965: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.254.68
country_id: 3469034
description:
Jan 17 13:08:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.254.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.195
country_id: 953987
description:
Jan 17 13:08:47 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.195
country_id: 953987
description:
Jan 17 13:09:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.128.210
country_id: 99237
description:
Jan 17 13:09:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.128.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:09:08 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:09:10 dovecot_login authenticator failed for H=(8W52KA) [77.83.39.167]:64047: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:09:57 dovecot_login authenticator failed for H=(JZPxf1B) [77.83.39.167]:60590: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:10:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:11:07 dovecot_login authenticator failed for H=(gSoiEP) [77.83.39.167]:54284: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:11:05 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 13:12:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59650: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:12:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:12:17 dovecot_login authenticator failed for H=(Ra8RxrjI7) [77.83.39.167]:54600: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:13:04 dovecot_login authenticator failed for H=(iQWj11Wc) [77.83.39.167]:59324: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:13:02 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 167.71.163.255
country_id: 6252001
domain: kimmark.com
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo $((41*271))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:14:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:14:14 dovecot_login authenticator failed for H=(vWKLrsJvfo) [77.83.39.167]:56094: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:15:00 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:15:02 dovecot_login authenticator failed for H=(C7rP3mE7BQ) [77.83.39.167]:50821: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:16:10 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:16:12 dovecot_login authenticator failed for H=(5AccB0JIh) [77.83.39.167]:64643: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.8.76.18
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/services.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:16:57 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:16:59 dovecot_login authenticator failed for H=(x5alGt) [77.83.39.167]:59980: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.22.99.2
country_id: 1814991
description:
Jan 17 13:17:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.22.99.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.22.99.2
country_id: 1814991
description:
2026-01-17 13:17:05 dovecot_login authenticator failed for H=(hebei.22.121.in-addr.arpa) [121.22.99.2]:38085: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:18:09 dovecot_login authenticator failed for H=(2sI7gM) [77.83.39.167]:54658: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.151.228.170
country_id: 1522867
description:
Jan 17 13:18:03 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.151.228.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.151.228.170
country_id: 1522867
description:
2026-01-17 13:18:05 dovecot_login authenticator failed for H=37.151.228.170.dynamic.telecom.kz [37.151.228.170]:53010: 535 Incorrect authentication data (set_id=accounting@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:18:07 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:18:56 dovecot_login authenticator failed for H=(b3gpABC) [77.83.39.167]:60790: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:19:18 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:20:04 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:20:06 dovecot_login authenticator failed for H=(k8HuwF59) [77.83.39.167]:65420: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:21:15 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:21:17 dovecot_login authenticator failed for H=(nOC0QpScU) [77.83.39.167]:57328: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:22:01 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:22:03 dovecot_login authenticator failed for H=(YpJmYJ) [77.83.39.167]:63995: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 59.153.16.114
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=108861 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:23:12 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:23:14 dovecot_login authenticator failed for H=(rMhOZelyLN) [77.83.39.167]:60246: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.161.27.82
country_id: 6252001
description:
Jan 17 13:24:26 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.161.27.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.161.27.82
country_id: 6252001
description:
2026-01-17 13:24:28 dovecot_plain authenticator failed for H=c-174-161-27-82.hsd1.tn.comcast.net (uncleess) [174.161.27.82]:46214: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:23:58 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:24:00 dovecot_login authenticator failed for H=(q0C2J6O) [77.83.39.167]:52625: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.162.63.148
country_id: 1562822
domain: acburn.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/acburn.com.my/img/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.132.236.158
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dog/400/167467 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:25:09 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:25:11 dovecot_login authenticator failed for H=(4auLcQh) [77.83.39.167]:50141: 535 Incorrect authentication data (set_id=contact)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.167
country_id: 690791
description:
Jan 17 13:25:56 sv3 auth[104249]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.167 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-17 13:25:58 dovecot_login authenticator failed for H=(4z4UK2P) [77.83.39.167]:57264: 535 Incorrect authentication data (set_id=contact)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.42.34.208
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=382656 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 84.247.105.57
country_id: 6251999
description:
2026-01-17 13:28:45 227910 [Warning] Aborted connection 227910 to db: 'unconnected' user: 'unauthenticated' host: '84.247.105.57' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.62.221
country_id: 953987
description:
Jan 17 13:29:20 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.62.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.192
country_id: 3469034
description:
Jan 17 13:29:52 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.192
country_id: 3469034
description:
Jan 17 13:30:00 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.192 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 13:30:54 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.242.65
country_id: 1733045
description:
[2026-01-17 13:34:57 +0800] info [webmaild] 27.125.242.65 - jlpom@ajplantations.com.my "POST /cpsess6016363582/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.242.55] != Current IP Address [27.125.242.65]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.69
country_id: 798544
description:
Jan 17 13:36:45 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.69
country_id: 798544
description:
Jan 17 13:36:58 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.43
country_id: 3469034
description:
Jan 17 13:37:05 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.77.151
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-37.92.71.77.151||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.240.162
country_id: 3469034
description:
Jan 17 13:39:51 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.240.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.240.162
country_id: 3469034
description:
Jan 17 13:39:59 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.240.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 13:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59698: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.7.71
country_id: 690791
description:
Jan 17 13:40:14 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.7.71 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 67.205.148.13
country_id: 6252001
description:
2026-01-17 13:40:50 228475 [Warning] Aborted connection 228475 to db: 'unconnected' user: 'unauthenticated' host: '67.205.148.13' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.224.95.167
country_id: 3658394
description:
Jan 17 13:43:12 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.224.95.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.139
country_id: 3469034
description:
Jan 17 13:43:18 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.68.213
country_id: 732800
description:
Jan 17 13:51:50 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.124.68.213
country_id: 732800
description:
Jan 17 13:51:58 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.124.68.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.179.14
country_id: 3469034
description:
Jan 17 13:52:16 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.179.14 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.99.138.160
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/banana/728/350107 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.207.4.214
country_id: 1269750
description:
Jan 17 13:54:33 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.207.4.214 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.188
country_id: 3469034
description:
Jan 17 13:54:53 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.200.189.117
country_id: 248816
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30961516781324 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.188
country_id: 3469034
description:
Jan 17 13:55:01 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 13:58:19 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.198.132.91
country_id: 6252001
description:
2026-01-17 14:00:07 H=([124.198.132.91]) [124.198.132.91]:54240 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<summit@pinechem.net> rejected RCPT <jacklim@ktlog.com.my>: SPF: 124.198.132.91 is not allowed to send mail from pinechem.net


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 124.198.132.91
country_id: 6252001
description:
2026-01-17 14:01:24 H=([124.198.132.91]) [124.198.132.91]:50759 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<summit@pinechem.net> rejected RCPT <sales@cordage.com.my>: SPF: 124.198.132.91 is not allowed to send mail from pinechem.net


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 14:02:53 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.158.106.46
country_id: 290557
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-02.185.158.106.46||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.140.233.37
country_id: 2017370
description:
Jan 17 14:06:37 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.140.233.37 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.140.233.37
country_id: 2017370
description:
2026-01-17 14:06:39 dovecot_login authenticator failed for H=(37.233.140.62.fryazino.net) [62.140.233.37]:49600: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.93.146
country_id: 1861060
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/images/portfolio/scars.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.97
country_id: 3469034
description:
Jan 17 14:08:52 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 14:08:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59743: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.80.28.142
country_id: 3865483
description:
Jan 17 14:08:29 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.80.28.142 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.97
country_id: 3469034
description:
Jan 17 14:09:00 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.20.73.26
country_id: 1814991
description:
Jan 17 14:09:43 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.20.73.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.20.73.26
country_id: 1814991
description:
2026-01-17 14:09:45 dovecot_login authenticator failed for H=([14.20.73.26]) [14.20.73.26]:38880: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-17 14:12:49 H=(localhost.localdomain) [78.153.140.207]:48250 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.69
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:14-18.92.71.72.69||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.88.202.131
country_id: 1269750
description:
2026-01-17 14:21:59 dovecot_login authenticator failed for H=(static.ftth.mys.59.88.202.131.bsnl.in) [59.88.202.131]:40797: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 59.88.202.131
country_id: 1269750
description:
Jan 17 14:21:57 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 59.88.202.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.98.174
country_id: 1269750
description:
Jan 17 14:25:51 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.98.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.98.174
country_id: 1269750
description:
2026-01-17 14:25:53 dovecot_login authenticator failed for H=([27.123.98.174]) [27.123.98.174]:50620: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 95.56.199.28
country_id: 1522867
description:
2026-01-17 14:27:25 230204 [Warning] Aborted connection 230204 to db: 'unconnected' user: 'unauthenticated' host: '95.56.199.28' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.108.242.34
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/markbaker/complex/classes/Bootstrap.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.155
country_id: 6252001
description:
2026-01-17 14:33:11 230383 [Warning] Aborted connection 230383 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.155' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 14:36:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59902: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/services.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.219
country_id: 3469034
description:
Jan 17 14:41:54 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.226.185
country_id: 3865483
description:
Jan 17 14:41:30 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.226.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.205.219
country_id: 3469034
description:
Jan 17 14:42:02 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.205.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.146.15
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=72701514875217 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.246.200.60
country_id: 1210997
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/kindle-white-paperwhite-manual.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-17 14:43:42 H=([94.156.152.18]) [94.156.152.18]:59097 F=<mekdes@maatextiles.com> rejected RCPT <euratech@euratech.com.my>: SPF: 94.156.152.18 is not allowed to send mail from maatextiles.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.183
country_id: 3469034
description:
Jan 17 14:43:53 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.183
country_id: 3469034
description:
Jan 17 14:44:01 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.183 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.206
country_id: 3175395
description:
Jan 17 14:44:14 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.206 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.252
country_id: 3469034
description:
Jan 17 14:56:46 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.183.92.252
country_id: 3469034
description:
Jan 17 14:57:00 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.183.92.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.210.16.205
country_id: 2287781
description:
2026-01-17 15:01:37 H=([102.210.16.205]) [102.210.16.205]:3501 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.210.16.205
country_id: 2287781
description:
2026-01-17 15:02:31 H=([102.210.16.205]) [102.210.16.205]:3562 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.191.221.17
country_id: 337996
description:
2026-01-17 15:03:00 H=([196.191.221.17]) [196.191.221.17]:43033 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.210.16.205
country_id: 2287781
description:
2026-01-17 15:03:22 H=([102.210.16.205]) [102.210.16.205]:3476 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.191.221.17
country_id: 337996
description:
2026-01-17 15:04:09 H=([196.191.221.17]) [196.191.221.17]:38693 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.210.16.205
country_id: 2287781
description:
2026-01-17 15:04:14 H=([102.210.16.205]) [102.210.16.205]:3485 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 15:04:24 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59948: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/m.me/img/photos/csr.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 196.191.221.17
country_id: 337996
description:
2026-01-17 15:05:01 H=([196.191.221.17]) [196.191.221.17]:38585 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 101.36.114.209
country_id: 1835841
description:
2026-01-17 15:06:41 231651 [Warning] Aborted connection 231651 to db: 'unconnected' user: 'unauthenticated' host: '101.36.114.209' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.221
country_id: 3469034
description:
Jan 17 15:06:57 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 139.192.70.55
country_id: 1643084
description:
2026-01-17 15:07:34 H=([139.192.70.55]) [139.192.70.55]:15000 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.136.3.48
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.139.190
country_id: 1835841
description:
2026-01-17 15:08:15 231707 [Warning] Aborted connection 231707 to db: 'unconnected' user: 'unauthenticated' host: '152.32.139.190' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 139.192.70.55
country_id: 1643084
description:
2026-01-17 15:09:18 H=([139.192.70.55]) [139.192.70.55]:15354 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.232.238.108
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=825349 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 139.192.70.55
country_id: 1643084
description:
2026-01-17 15:10:41 H=([139.192.70.55]) [139.192.70.55]:15618 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.34.72.185
country_id: 1282988
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=414001 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.98.140.225
country_id: 783754
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=900301 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 139.192.70.55
country_id: 1643084
description:
2026-01-17 15:11:23 H=([139.192.70.55]) [139.192.70.55]:51531 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 61.85.134.123
country_id: 1835841
description:
2026-01-17 15:12:09 H=([61.85.134.123]) [61.85.134.123]:37726 F=<samsudeen.ganny@ajplantations.com.my> rejected RCPT <samsudeen.ganny@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.116.156.134
country_id: 1814991
description:
Jan 17 15:12:19 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.116.156.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.116.156.134
country_id: 1814991
description:
2026-01-17 15:12:21 dovecot_login authenticator failed for H=([14.116.156.134]) [14.116.156.134]:38374: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.143.153
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:15-14.191.102.143.153||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 182.189.7.10
country_id: 1168579
description:
2026-01-17 15:14:47 H=([182.189.7.10]) [182.189.7.10]:42186 F=<samsudeen.ganny@ajplantations.com.my> rejected RCPT <samsudeen.ganny@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.23.184.136
country_id: 3469034
description:
Jan 17 15:16:20 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.23.184.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.76.123
country_id: 3469034
description:
Jan 17 15:16:42 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.76.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.76.123
country_id: 3469034
description:
Jan 17 15:16:56 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.76.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.218.57.50
country_id: 3996063
description:
Jan 17 15:19:06 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.218.57.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.218.57.50
country_id: 3996063
description:
2026-01-17 15:19:08 dovecot_login authenticator failed for H=(customer-187-218-57-50.uninet-ide.com.mx) [187.218.57.50]:3098: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/iso.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.190.195
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=365231 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.34.129
country_id: 99237
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/db HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.108.1.230
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/exhibition.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.180
country_id: 6252001
description:
2026-01-17 15:23:34 232326 [Warning] Aborted connection 232326 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.180' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 2.58.56.27
country_id: 2750405
description:
2026-01-17 15:25:16 dovecot_plain authenticator failed for H=([2.58.56.27]) [2.58.56.27]:50738: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.58.56.27
country_id: 2750405
description:
Jan 17 15:25:14 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.58.56.27 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.56
country_id: 953987
description:
Jan 17 15:27:57 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.207.41.215
country_id: 6290252
description:
Jan 17 15:28:18 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.207.41.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.41.83
country_id: 2395170
description:
Jan 17 15:28:19 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.41.83 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.170.225.141
country_id: 3865483
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/lego-city.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.204.23.4
country_id: 6252001
description:
Jan 17 15:31:41 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.204.23.4 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 15:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59998: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.93.87.111
country_id: 6252001
domain: mail.sutsb.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.52.211.184
country_id: 1694008
description:
Jan 17 15:34:56 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.52.211.184 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.251.192.69
country_id: 1527747
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=227277 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.158.228.21
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=444310 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jan 17 15:38:11 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 122.180.177.36
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/auntautumn/11/365/1196912 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.33
country_id: 3469034
description:
Jan 17 15:48:31 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.169
country_id: 798544
description:
Jan 17 15:48:58 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.46
country_id: 798544
description:
Jan 17 15:49:00 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.46 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.237
country_id: 6252001
description:
Jan 17 15:49:02 sv3 pure-ftpd[2195875]: (?@135.237.125.237) [INFO] New connection from 135.237.125.237


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.202
country_id: 3175395
description:
Jan 17 15:49:21 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.202 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.233.112.109
country_id: 6252001
description:
Jan 17 15:49:49 sv3 pure-ftpd[2196317]: (?@135.233.112.109) [INFO] New connection from 135.233.112.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 15:50:54 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 15:55:29 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.91.250.17
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/dosimeter.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.126.225
country_id: 6252001
description:
Jan 17 15:57:06 sv3 pure-ftpd[2200518]: (?@135.237.126.225) [INFO] New connection from 135.237.126.225


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.24.139
country_id: 6252001
domain: 34.217.47.154
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/34.217.47.154/azenv.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 186.113.22.188
country_id: 3686110
description:
2026-01-17 15:59:07 H=([186.113.22.188]) [186.113.22.188]:3588 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 186.113.22.188
country_id: 3686110
description:
2026-01-17 16:00:31 H=([186.113.22.188]) [186.113.22.188]:64024 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 16:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60042: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 186.113.22.188
country_id: 3686110
description:
2026-01-17 16:01:13 H=([186.113.22.188]) [186.113.22.188]:36598 F=<jesslim@imax.com.my> rejected RCPT <jesslim@imax.com.my>: smtp auth required


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 49.36.211.134
country_id: 1269750
domain: dynamic-hr.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:30445.dynamic-hr.com.my||ServerName:dynamic-hr.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b63382acc59519018b2e0310d4d98b1f1ab9e185||Title:0xc9684f27||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.180
country_id: 6252001
description:
Jan 17 16:02:33 sv3 pure-ftpd[2203844]: (?@198.235.24.180) [INFO] New connection from 198.235.24.180


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.6
country_id: 798544
description:
Jan 17 16:02:07 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.254.209.32
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hi/710/518398 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.37
country_id: 3469034
description:
Jan 17 16:03:46 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.37
country_id: 3469034
description:
Jan 17 16:04:01 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.172
country_id: 690791
description:
Jan 17 16:04:08 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.115
country_id: 953987
description:
Jan 17 16:10:32 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.56.192.242
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=68841515570687 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.215
country_id: 3469034
description:
Jan 17 16:10:59 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.171.74.110
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hurry/15/103/1559063 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.51.92.232
country_id: 1282988
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/cambridge_english.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.141.252.55
country_id: 6252001
description:
Jan 17 16:14:27 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.141.252.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.141.252.55
country_id: 6252001
description:
2026-01-17 16:14:29 dovecot_login authenticator failed for H=([38.141.252.55]) [38.141.252.55]:58358: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.128.198.112
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/toefl_preparation.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.50.5.94
country_id: 1269750
description:
2026-01-17 16:15:07 dovecot_login authenticator failed for H=([103.50.5.94]) [103.50.5.94]:38963: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.51.89.164
country_id: 1282988
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ielts_preparation.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.50.5.94
country_id: 1269750
description:
Jan 17 16:15:05 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.50.5.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 136.117.223.18
country_id: 6252001
domain: mail.pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home/pftfood/access-logs/pftfood.com||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/druma_photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 16:28:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60089: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.213
country_id: 3175395
description:
Jan 17 16:28:05 sv3 auth[2106554]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.213 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.91.247.81
country_id: 3469034
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/social_english_course.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.181
country_id: 732800
description:
Jan 17 16:28:37 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.181 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 156.146.55.174
country_id: 732800
description:
Jan 17 16:29:34 sv3 pure-ftpd[2222098]: (?@156.146.55.174) [INFO] New connection from 156.146.55.174


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 136.117.223.18
country_id: 6252001
domain: mail.pftfood.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/uploads/wpr-addons/forms/wp.php||SC:/home/pftfood/public_html/wp-content/uploads/wpr-addons||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-17 16:35:29 H=([45.144.212.50]) [45.144.212.50]:53148 F=<arm@da-desk.com> rejected RCPT <khim@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 87.236.176.239
country_id: 2635167
description:
Jan 17 16:36:09 sv3 pure-ftpd[2225947]: (?@87.236.176.239) [INFO] New connection from 87.236.176.239


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.179.191.246
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Others/Plain RSC LxWxH-2-250x250.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.137.252
country_id: 163843
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/tactics-durango-issa/babyliss-fx-trimmer.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.25
country_id: 3175395
description:
Jan 17 16:38:26 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.66.41.91
country_id: 3469034
description:
Jan 17 16:39:04 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.66.41.91 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.175.54.146
country_id: 6252001
domain: af-sb.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:192.175.54.146||TA:192.175.54.146||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.225.83.85
country_id: 2464461
domain: ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.109.252
country_id: 3996063
description:
Jan 17 16:44:48 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.109.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.109.252
country_id: 3996063
description:
Jan 17 16:44:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.109.252 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.13.237
country_id: 99237
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=73 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.45
country_id: 798544
description:
Jan 17 16:50:57 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.45 has been locked due to Imunify RBL


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 46.203.226.154
country_id: 2077456
domain: agsaintifik.com.my
description:
IM360 WAF: Block URI containing malicious URLs||RSV:7.64||T:APACHE||MVN:ARGS:url||SC:/home2/agsaintifik/public_html/wp-comments-post.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.24
country_id: 3469034
description:
Jan 17 16:53:29 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.142.125
country_id: 99237
description:
Jan 17 16:54:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.142.125 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 136.107.113.77
country_id: 6252001
description:
[2026-01-17 16:54:27 +0800] info [cpaneld] 136.107.113.77 - - "GET /wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 11004
name: Possible breaking attempt on cpanel service
abuser: 136.107.113.77
country_id: 6252001
description:
[2026-01-17 16:54:35 +0800] info [cpaneld] 136.107.113.77 - - "GET /site/wp-includes/wlwmanifest.xml HTTP/1.1" FAILED LOGIN cpaneld: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 16:56:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60133: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.150
country_id: 6252001
description:
2026-01-17 16:58:01 dovecot_plain authenticator failed for H=([10.20.18.242]) [91.124.17.150]:41427: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.143.146.41
country_id: 1814991
description:
Jan 17 16:59:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.143.146.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 36.143.146.41
country_id: 1814991
description:
2026-01-17 16:59:11 dovecot_login authenticator failed for H=(yDXTL9Ng) [36.143.146.41]:16595: 535 Incorrect authentication data (set_id=hr_admin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.184.115.150
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=42 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.190
country_id: 2750405
description:
2026-01-17 17:02:33 236077 [Warning] Aborted connection 236077 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.190' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.154.122
country_id: 99237
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 130.12.182.190
country_id: 2750405
description:
Jan 17 17:02:31 sv3 pure-ftpd[2241466]: (?@130.12.182.190) [INFO] New connection from 130.12.182.190


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.242.208.12
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/lake/11/673/1196483 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.245.245.45
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/body/16/87/1655362 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.212.45.215
country_id: 163843
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hat/8/657/874357 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 37.27.28.251
country_id: 660013
domain: www.modern.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/128.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.73.68
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-06.92.71.73.68||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.250
country_id: 798544
description:
Jan 17 17:08:43 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.250
country_id: 798544
description:
Jan 17 17:08:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.4.175
country_id: 3996063
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=602547 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.60.147.65
country_id: 895949
description:
2026-01-17 17:11:10 dovecot_plain authenticator failed for H=(descing) [41.60.147.65]:56647: 535 Incorrect authentication data (set_id=info@modern.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.60.147.65
country_id: 895949
description:
Jan 17 17:11:08 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.60.147.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.238.255.137
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=302004 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.234
country_id: 3469034
description:
Jan 17 17:13:53 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.234
country_id: 3469034
description:
Jan 17 17:14:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.26.101.77
country_id: 1814991
description:
Jan 17 17:14:47 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.26.101.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.26.101.77
country_id: 1814991
description:
2026-01-17 17:14:49 dovecot_login authenticator failed for H=([111.26.101.76]) [111.26.101.77]:34302: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.96.200
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=36011515550988 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.93.118
country_id: 1733045
description:
[2026-01-17 17:15:15 +0800] info [webmaild] 115.164.93.118 - admin@autogreastar.com.my "POST /cpsess0708699625/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [115.164.93.66] != Current IP Address [115.164.93.118]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.1.109.143
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=942320 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.105.225
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-19.152.44.105.225||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.75.92.234
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/taste/8/270/841542 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.19
country_id: 3469034
description:
Jan 17 17:20:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.171.230.200
country_id: 6252001
description:
Jan 17 17:23:35 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.171.230.200 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.171.230.200
country_id: 6252001
description:
2026-01-17 17:23:37 dovecot_plain authenticator failed for H=c-73-171-230-200.hsd1.fl.comcast.net (inundaper) [73.171.230.200]:55742: 535 Incorrect authentication data (set_id=tiong@kendek.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 17:24:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60183: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.187
country_id: 3175395
description:
Jan 17 17:31:02 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.187 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.175
country_id: 3865483
description:
Jan 17 17:31:26 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.175 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.251.247.90
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/19namedrange.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.101
country_id: 2510769
description:
Jan 17 17:34:00 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 17:35:17 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.160.103.228
country_id: 1269750
description:
Jan 17 17:36:55 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.160.103.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.160.103.228
country_id: 1269750
description:
2026-01-17 17:36:57 dovecot_login authenticator failed for H=(abts-north-static-228.103.160.122.airtelbroadband.in) [122.160.103.228]:43900: 535 Incorrect authentication data (set_id=safuddin@ajplantations.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.204.194.50
country_id: 290557
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Flute/BA-Flute-2-150x150.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.222
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/frontend/order-attribution.min.js?ver=10.4.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.226
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/wp-emoji-release.min.js?ver=6.9 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.137.144.79
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/product/storage-box-medium-standard-duty-45x31x33cm/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/js/minified/flexibility.min.js?ver=4.12.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.240
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woo-discount-rules/v2/Assets/Js/site_main.js?ver=2.6.13 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.195
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-grid.min.css?ver=4.12.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.245
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/dist/hooks.min.js?ver=dd5603f07f9220ed27f1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce-menu-bar-cart/assets/js/wpmenucart-ajax-assist.min.js?ver=2.14.12 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.130
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js?ver=10.4.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.224
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.241
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.249
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/contact-form-7/includes/js/index.js?ver=6.1.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.189
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/sourcebuster/sourcebuster.min.js?ver=10.4.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.246
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/jetpack/jetpack_vendor/automattic/woocommerce-analytics/build/woocommerce-analytics-client.js?minify=false&ver=75adc3c1e2933e2c8c6a HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.206
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-layout-grid.min.css?ver=4.12.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.188
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/jquery-blockui/jquery.blockUI.min.js?ver=2.7.0-wc.10.4.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.141
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=10.4.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.247
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/contact-form-7/includes/swv/js/index.js?ver=6.1.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woo-discount-rules/v2/Assets/Js/awdr-dynamic-price.js?ver=2.6.13 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.232
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/js/minified/frontend.min.js?ver=4.12.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.192
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/jquery/jquery.min.js?ver=3.7.1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.225
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/css/dist/block-library/style.min.css?ver=6.9 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.187
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css?ver=4.12.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.193
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.211
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/woocommerce/woocommerce-smallscreen-grid.min.css?ver=4.12.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.230
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.207
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce/assets/client/blocks/wc-blocks.css?ver=wc-10.4.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.150
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-includes/js/dist/i18n.min.js?ver=c26c3dc7bed366793375 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 17:43:27 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.164
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/jetpack/jetpack_vendor/automattic/woocommerce-analytics/build/956.js?minify=false&ver=409e67b93e15d69e7918 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.191
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.box.com.my/wp-content/plugins/woocommerce-menu-bar-cart/assets/css/wpmenucart-main.min.css?ver=2.14.12 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.6.200.111
country_id: 3469034
description:
Jan 17 17:47:07 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.6.200.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 17:48:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 17:52:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60222: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 112.94.189.35
country_id: 1814991
description:
2026-01-17 17:52:24 237910 [Warning] Aborted connection 237910 to db: 'unconnected' user: 'unauthenticated' host: '112.94.189.35' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.161.140.91
country_id: 3175395
description:
2026-01-17 17:54:32 H=([94.161.140.91]) [94.161.140.91]:16797 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.161.140.91
country_id: 3175395
description:
2026-01-17 17:55:17 H=([94.161.140.91]) [94.161.140.91]:17339 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.161.140.91
country_id: 3175395
description:
2026-01-17 17:55:59 H=([94.161.140.91]) [94.161.140.91]:17518 F=<rafidah@pspoly.com.my> rejected RCPT <rafidah@pspoly.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 63.101.18.117
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sign/12/379/1200379 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.197.116
country_id: 3469034
description:
Jan 17 18:03:41 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.197.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.197.116
country_id: 3469034
description:
Jan 17 18:03:55 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.197.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.87.74
country_id: 3469034
description:
Jan 17 18:04:14 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.87.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.146.82
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/big/18/543/1821179 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.208.25.111
country_id: 6252001
description:
Jan 17 18:05:36 sv3 pure-ftpd[2277743]: (?@172.208.25.111) [INFO] New connection from 172.208.25.111


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.10
country_id: 241170
description:
Jan 17 18:07:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 39.43.220.169
country_id: 1168579
domain: garudabay.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70553.garudabay.com||ServerName:garudabay.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c5fdf5b3045e20fb629bceb64594049fbd650a1c||Title:0xb72bc321||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.140.17.52
country_id: 2017370
description:
2026-01-17 18:07:45 238424 [Warning] Aborted connection 238424 to db: 'unconnected' user: 'unauthenticated' host: '45.140.17.52' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.200.6.38
country_id: 3469034
description:
Jan 17 18:08:29 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.200.6.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 17 18:10:16 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.23.242.223
country_id: 953987
description:
2026-01-17 18:10:23 dovecot_login authenticator failed for H=([102.23.242.223]) [102.23.242.223]:48635: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.53.58
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-11.142.111.53.58||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.235.225.181
country_id: 6252001
description:
Jan 17 18:15:28 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.235.225.181 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.235.225.181
country_id: 6252001
description:
2026-01-17 18:15:30 dovecot_plain authenticator failed for H=c-71-235-225-181.hsd1.ct.comcast.net (superia) [71.235.225.181]:53774: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 18:20:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60265: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.74.240.229
country_id: 2510769
description:
Jan 17 18:20:08 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.74.240.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.18
country_id: 2300660
description:
Jan 17 18:20:17 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.51
country_id: 3175395
description:
Jan 17 18:20:31 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.51 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.29
country_id: 3469034
description:
Jan 17 18:20:42 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.29 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 126.209.2.202
country_id: 1694008
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/late/19/323/1957809 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.159.87.29
country_id: 3469034
description:
Jan 17 18:20:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.159.87.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.64.71.37
country_id: 3865483
description:
Jan 17 18:21:00 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.64.71.37 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.0.148.245
country_id: 1269750
description:
Jan 17 18:21:11 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.0.148.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-17 18:23:06 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60266: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.121.43.101
country_id: 2589581
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Iterator/RecursiveDirectoryIterator.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 36.255.223.187
country_id: 1880251
description:
2026-01-17 18:24:17 238953 [Warning] Aborted connection 238953 to db: 'unconnected' user: 'unauthenticated' host: '36.255.223.187' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 68.40.189.43
country_id: 6252001
description:
Jan 17 18:24:25 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 68.40.189.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.40.189.43
country_id: 6252001
description:
2026-01-17 18:24:27 dovecot_plain authenticator failed for H=c-68-40-189-43.hsd1.mi.comcast.net (pergeatias) [68.40.189.43]:35618: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.59
country_id: 6252001
domain: cordage.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/92.0.4515.107 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.137.209.162
country_id: 3469034
description:
Jan 17 18:29:48 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.137.209.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.61.202.22
country_id: 2510769
description:
Jan 17 18:30:34 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.61.202.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.137.209.162
country_id: 3469034
description:
Jan 17 18:29:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.137.209.162 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.193
country_id: 6252001
description:
Jan 17 18:31:39 sv3 pure-ftpd[2293192]: (?@167.94.138.193) [INFO] New connection from 167.94.138.193


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.30.253.160
country_id: 6252001
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/img/photos/2351401067.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.118.150.170
country_id: 1269750
description:
2026-01-17 18:38:55 239559 [Warning] Aborted connection 239559 to db: 'unconnected' user: 'unauthenticated' host: '103.118.150.170' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.118.150.170
country_id: 1269750
description:
2026-01-17 18:38:59 239566 [Warning] Aborted connection 239566 to db: 'unconnected' user: 'unauthenticated' host: '103.118.150.170' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.192.101.122
country_id: 3469034
description:
Jan 17 18:40:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.192.101.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.214.16
country_id: 798544
description:
Jan 17 18:40:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.214.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.124.241
country_id: 798544
description:
Jan 17 18:40:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.124.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.179.221
country_id: 3194884
description:
Jan 17 18:40:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.179.221 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.136
country_id: 3469034
description:
Jan 17 18:40:38 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.183.187.95
country_id: 2510769
description:
Jan 17 18:40:57 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.183.187.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 140.179.148.12
country_id: 1814991
domain: indfinitydesign.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.68.105
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/certificate.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 106.38.226.27
country_id: 1814991
domain: indfinitydesign.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; OnePlus 7 Build/QQ3A.200805.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_170500 JsSdk/1.0 NetType/4G Channel/local_test AppName/aweme app_version/17.5.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 TTWebView/0751130036105||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.211.139
country_id: 1819730
description:
2026-01-17 18:54:16 240079 [Warning] Aborted connection 240079 to db: 'unconnected' user: 'unauthenticated' host: '152.32.211.139' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.245.105.171
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-55.185.245.105.171||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.245.105.171
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-57.185.245.105.171||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 69.160.160.57
country_id: 6252001
domain: zrrtc.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/81.0.4044.92 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.77.61
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-00.92.71.77.61||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.62.25.63
country_id: 690791
description:
Jan 17 19:01:13 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.62.25.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.134.98.210
country_id: 3057568
description:
Jan 17 19:03:14 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.134.98.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.0.46.212
country_id: 3895114
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/gallery.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.118
country_id: 798544
description:
Jan 17 19:02:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.144.178.252
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-06.198.144.178.252||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.186.197.116
country_id: 3469034
description:
Jan 17 19:07:02 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.186.197.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.236.130.182
country_id: 1814991
description:
Jan 17 19:07:03 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.236.130.182 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.236.130.182
country_id: 1814991
description:
2026-01-17 19:07:05 dovecot_login authenticator failed for H=([183.236.130.182]) [183.236.130.182]:43006: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.249.6
country_id: 2395170
description:
Jan 17 19:07:26 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.249.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.108.243.239
country_id: 1269750
domain: www.kendek.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/134.0.6998.88 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.196.225.99
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62511515979613 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.158.224.133
country_id: 2400553
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27031516696051 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-17 19:15:05 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:45934: 535 Incorrect authentication data (set_id=nurhidayati@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-17 19:15:41 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:56458: 535 Incorrect authentication data (set_id=nurhidayati)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.15.203
country_id: 3469034
description:
Jan 17 19:16:29 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.15.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.34.68
country_id: 3865483
description:
Jan 17 19:17:04 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.34.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-17 19:17:35 H=([94.156.152.18]) [94.156.152.18]:58433 F=<mekdes@maatextiles.com> rejected RCPT <wilson@oxbold.com>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.84.251.234
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/basket/8/418/843164 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 80.44.169.165
country_id: 2635167
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=155596 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.246.214.146
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.70.246
country_id: 1861060
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/images/d-slide/cover-test-3.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.1.190.148
country_id: 1733045
description:
2026-01-17 19:29:53 H=([14.1.190.148]) [14.1.190.148]:20033 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.1.190.148
country_id: 1733045
description:
2026-01-17 19:30:33 H=([14.1.190.148]) [14.1.190.148]:21395 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.126.220.217
country_id: 3469034
description:
Jan 17 19:31:37 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.126.220.217 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 216.26.236.172
country_id: 6252001
description:
[2026-01-17 19:31:46 +0800] info [webmaild] 216.26.236.172 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 14.1.190.148
country_id: 1733045
description:
2026-01-17 19:31:14 H=([14.1.190.148]) [14.1.190.148]:23017 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.87
country_id: 798544
description:
Jan 17 19:33:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.87 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.206
country_id: 6252001
description:
2026-01-17 19:34:16 241478 [Warning] Aborted connection 241478 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.206' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 19:35:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.74.145.98
country_id: 149590
description:
Jan 17 19:36:35 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.74.145.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 19:40:33 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 74.102.232.220
country_id: 6252001
description:
[2026-01-17 19:47:15 +0800] info [whostmgrd] 74.102.232.220 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-17 19:56:28 H=([77.83.39.106]) [77.83.39.106]:56453 F=<harshit.m@lizindia.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.194.80
country_id: 1168579
description:
2026-01-17 19:56:41 dovecot_login authenticator failed for H=([103.253.19.87]) [103.87.194.80]:59184: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.243
country_id: 2510769
description:
Jan 17 20:00:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 177.86.37.50
country_id: 3469034
description:
[2026-01-17 20:05:39 +0800] info [whostmgrd] 177.86.37.50 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.198.32
country_id: 2510769
description:
Jan 17 20:09:39 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.198.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.33.204.130
country_id: 2017370
description:
Jan 17 20:11:37 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.33.204.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.33.204.130
country_id: 2017370
description:
2026-01-17 20:11:39 dovecot_login authenticator failed for H=(213.33.204.130.moscow.gldn.net) [213.33.204.130]:38470: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jan 17 20:11:53 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-17 20:11:55 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:56290: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.128
country_id: 3175395
description:
Jan 17 20:12:48 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.128 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.128
country_id: 3175395
description:
Jan 17 20:13:02 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.128 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/druma_photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.190.166.167
country_id: 6254930
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541954 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.130.207.227
country_id: 1282988
description:
Jan 17 20:21:25 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.130.207.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.130.207.227
country_id: 1282988
description:
2026-01-17 20:21:27 dovecot_login authenticator failed for H=([103.130.207.227]) [103.130.207.227]:55336: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 54.183.141.111
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/re.php||SC:/home2/fkrcom/public_html/img/re.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/img/photos/video.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 20:25:06 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/druma/contact.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.23
country_id: 3175395
description:
Jan 17 20:31:13 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.170
country_id: 6252001
description:
Jan 17 20:31:40 sv3 pure-ftpd[2361953]: (?@167.94.138.170) [INFO] New connection from 167.94.138.170


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/photos/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 20:36:45 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 20:38:08 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.194
country_id: 2395170
description:
Jan 17 20:44:34 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.252.179.197
country_id: 1831722
description:
2026-01-17 20:44:50 dovecot_login authenticator failed for H=(213.5.130.181) [122.252.179.197]:45098: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.153.15
country_id: 3469034
description:
Jan 17 20:44:55 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.153.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.182.153.15
country_id: 3469034
description:
Jan 17 20:45:03 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.182.153.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 20:45:17 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.120
country_id: 6252001
description:
2026-01-17 20:47:28 244338 [Warning] Aborted connection 244338 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.120' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.137.209.54
country_id: 3469034
description:
Jan 17 20:48:02 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.137.209.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 141.98.141.154
country_id: 783754
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/about.asp HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 221.162.151.35
country_id: 1835841
description:
2026-01-17 20:55:06 H=([221.162.151.35]) [221.162.151.35]:13822 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.36.96.215
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/make/598/128604 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 221.162.151.35
country_id: 1835841
description:
2026-01-17 20:56:01 H=([221.162.151.35]) [221.162.151.35]:14387 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.120.185.20
country_id: 630336
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=264985 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.56.130
country_id: 1269750
description:
Jan 17 20:57:17 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.56.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 221.162.151.35
country_id: 1835841
description:
2026-01-17 20:57:25 H=([221.162.151.35]) [221.162.151.35]:14787 F=<chewkc@ajplantations.com.my> rejected RCPT <chewkc@ajplantations.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.69
country_id: 798544
description:
Jan 17 20:57:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.69 has been locked due to Imunify RBL


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 199.101.196.29
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Track file upload for Infectors||RSV:7.64||T:APACHE||SC:/home2/mschemic/public_html/wp-admin/async-upload.php||User:mschemic||WPU:||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 199.101.196.29
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/uploads/legion_8kmsen64.php||SC:/home2/mschemic/public_html/uploads||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 20:57:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 20:59:10 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-17 20:59:17 H=([94.156.152.18]) [94.156.152.18]:50453 F=<mekdes@maatextiles.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 94.156.152.18 is not allowed to send mail from maatextiles.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.207.231.78
country_id: 2245662
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=181970 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 199.101.196.29
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/legion_8kmsen64.php||SC:/home2/mschemic/public_html/images||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 199.101.196.29
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Track file upload for Infectors||RSV:7.64||T:APACHE||SC:/home2/mschemic/public_html/wp-admin/media-new.php||User:mschemic||WPU:||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 199.101.196.78
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Track file upload for Infectors||RSV:7.64||T:APACHE||SC:/home2/mschemic/public_html/wp-content/plugins/contact-form-7/includes/file.php||User:mschemic||WPU:||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 199.101.196.78
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/contact-form-7/includes/file.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 199.101.196.78
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/uploads/legion_8kmsen64.php||SC:/home2/mschemic/public_html/wp-content/uploads/legion_8kmsen64.php||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 199.101.196.15
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Track file upload for Infectors||RSV:7.64||T:APACHE||SC:/home2/mschemic/public_html/wp-admin/update.php||User:mschemic||WPU:||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 199.101.196.15
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Track file upload for Infectors||RSV:7.64||T:APACHE||SC:/home2/mschemic/public_html/wp-admin/theme-install.php||User:mschemic||WPU:||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.73.59.60
country_id: 1562822
description:
Jan 17 21:03:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.73.59.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.59.60
country_id: 1562822
description:
2026-01-17 21:03:11 dovecot_login authenticator failed for H=([27.73.59.60]) [27.73.59.60]:37812: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 199.101.196.15
country_id: 6252001
domain: ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/uploads/2024/legion_8kmsen64.php||SC:/home2/mschemic/public_html/wp-content/uploads/2024||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.96.186
country_id: 2589581
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/sebastian/resource-operations/LICENSE HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 21:05:39 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.127
country_id: 798544
description:
Jan 17 21:07:28 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.127 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.96.169.244
country_id: 6252001
description:
Jan 17 21:08:11 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.96.169.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.96.169.244
country_id: 6252001
description:
2026-01-17 21:08:13 dovecot_login authenticator failed for H=([192.96.169.244]) [192.96.169.244]:42302: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.136
country_id: 3469034
description:
Jan 17 21:08:21 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.140.234.172
country_id: 719819
description:
Jan 17 21:10:57 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.140.234.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.155.230
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=3&sub=24 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.139.245.137
country_id: 1814991
description:
Jan 17 21:15:21 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.139.245.137 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.139.245.137
country_id: 1814991
description:
2026-01-17 21:15:23 dovecot_login authenticator failed for H=(hn.kd.ny.adsl) [222.139.245.137]:58884: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.100.250.41
country_id: 2017370
description:
Jan 17 21:18:32 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.100.250.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 93.100.250.41
country_id: 2017370
description:
2026-01-17 21:18:34 dovecot_login authenticator failed for H=(93.100.250.41.pool.sknt.ru) [93.100.250.41]:49822: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 129.122.56.130
country_id: 2300660
description:
2026-01-17 21:18:39 H=([129.122.56.130]) [129.122.56.130]:38135 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 21:17:59 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 21:19:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 129.122.56.130
country_id: 2300660
description:
2026-01-17 21:19:36 H=([129.122.56.130]) [129.122.56.130]:22905 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.189.124.218
country_id: 337996
description:
Jan 17 21:19:41 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.189.124.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 129.122.56.130
country_id: 2300660
description:
2026-01-17 21:20:18 H=([129.122.56.130]) [129.122.56.130]:65114 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.197.178.198
country_id: 1835841
description:
Jan 17 21:20:38 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.197.178.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.190.238.234
country_id: 2017370
description:
2026-01-17 21:21:15 dovecot_login authenticator failed for H=(91-190-238-234.in-addr.netone.ru) [91.190.238.234]:34512: 535 Incorrect authentication data (set_id=sales@acburn.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 129.122.56.130
country_id: 2300660
description:
2026-01-17 21:20:59 H=([129.122.56.130]) [129.122.56.130]:32636 F=<francis@aire-fresh.com> rejected RCPT <francis@aire-fresh.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.60.150.194
country_id: 6252001
description:
Jan 17 21:21:06 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.60.150.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.60.150.194
country_id: 6252001
description:
2026-01-17 21:21:08 dovecot_login authenticator failed for H=(136-60-150-194.googlefiber.net) [136.60.150.194]:42240: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.190.238.234
country_id: 2017370
description:
Jan 17 21:21:13 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.190.238.234 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 21:25:52 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 119.200.229.33
country_id: 1835841
description:
2026-01-17 21:27:53 dovecot_login authenticator failed for H=([119.200.229.33]) [119.200.229.33]:40029: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.141.45.120
country_id: 2260494
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/property-management-maryville HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 119.200.229.33
country_id: 1835841
description:
Jan 17 21:27:51 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 119.200.229.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 21:28:36 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.215.189
country_id: 298795
description:
Jan 17 21:28:40 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.215.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.5.7.124
country_id: 1643084
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/chopstick/343/119505 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 186.179.14.234
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-29.186.179.14.234||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.168.126.20
country_id: 2802361
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack   File Box/DocQ Rack-4-80x80.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 81.168.126.20
country_id: 2802361
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack   File Box/DocQ Rack-4-80x80.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 21:33:10 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.84.118.10
country_id: 3686110
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/mom/10/496/1078618 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 21:38:47 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 21:40:02 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.41.83
country_id: 2395170
description:
Jan 17 21:40:21 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.41.83 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.237
country_id: 690791
description:
Jan 17 21:41:06 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.237 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.141
country_id: 3865483
description:
Jan 17 21:42:44 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.141
country_id: 3865483
description:
Jan 17 21:43:00 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.141 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-17 21:46:37 H=([45.144.212.50]) [45.144.212.50]:57344 F=<arm@da-desk.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 21:47:50 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-17 21:48:14 H=([45.144.212.50]) [45.144.212.50]:60125 F=<arm@da-desk.com> rejected RCPT <info@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from da-desk.com


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.200.209.250
country_id: 1880251
domain: krisfood.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:54646.krisfood.com||ServerName:krisfood.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:f2fc1530ff893254fb36923add340c2e236d5d0b||Title:0x04de2746||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: thinkcloud.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.35 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.102
country_id: 3469034
description:
Jan 17 21:56:00 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:00:27 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:01:35 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/achievement-new.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.104.250.254
country_id: 2464461
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/dependency_maps HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.211.214.136
country_id: 1733045
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/swiftmailer/swiftmailer/lib/dependency_maps/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:08:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.171.26
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=568838 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.111.8
country_id: 798544
description:
Jan 17 22:09:04 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.111.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.27
country_id: 798544
description:
Jan 17 22:09:22 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.142
country_id: 1269750
description:
Jan 17 22:10:23 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.35.109.214
country_id: 1814991
description:
Jan 17 22:11:26 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.35.109.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.35.109.214
country_id: 1814991
description:
2026-01-17 22:11:28 dovecot_login authenticator failed for H=([125.35.109.214]) [125.35.109.214]:36813: 535 Incorrect authentication data (set_id=wgoeqsscr@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 23.98.142.185
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/pipewire/pipewire.conf.avail/10-rates.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.93.202.20
country_id: 3469034
description:
Jan 17 22:16:31 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.93.202.20 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 185.39.207.3
country_id: 390903
description:
2026-01-17 22:17:48 248218 [Warning] Aborted connection 248218 to db: 'unconnected' user: 'unauthenticated' host: '185.39.207.3' (This connection closed normally without authentication)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 176.123.1.159
country_id: 617790
domain: evergrown.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/107.0.5104.110 Safari/507.46||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 174.169.224.27
country_id: 6252001
description:
Jan 17 22:19:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 174.169.224.27 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 174.169.224.27
country_id: 6252001
description:
2026-01-17 22:19:58 dovecot_plain authenticator failed for H=c-174-169-224-27.hsd1.vt.comcast.net (sanths) [174.169.224.27]:43954: 535 Incorrect authentication data (set_id=dexter.sow@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:20:28 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.213.82.18
country_id: 6251999
description:
2026-01-17 22:21:31 dovecot_login authenticator failed for H=vps1891.baseservers.com (USER) [67.213.82.18]:39394: 535 Incorrect authentication data (set_id=info@heeplastic.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:21:43 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.213.82.18
country_id: 6251999
description:
Jan 17 22:21:29 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.213.82.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.8.14.208
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-22.46.8.14.208||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/img/photos/contact.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/images/testimonial.php||SC:/home/indfinitydesign/public_html/images/images||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 85.121.5.30
country_id: 798549
domain: evergrown.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.33 (KHTML, like Gecko) HeadlessChrome/125.0.6422.141 Safari/537.56||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: thinkcloud.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.0.1 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 17 22:25:44 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:28:10 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 81.180.93.250
country_id: 798549
domain: evergrown.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/557.36 (KHTML, like Gecko) HeadlessChrome/103.0.5058.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 46.246.92.216
country_id: 2661886
domain: thinkcloud.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x88_64) AppleWebKit/337.36 (KHTML, like Gecko) HeadlessChrome/80.0.3987.163 Safari/597.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.231.121.38
country_id: 798544
description:
Jan 17 22:30:27 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.231.121.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.197
country_id: 3469034
description:
Jan 17 22:30:57 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/images/home/press.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.219.50.34
country_id: 2245662
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/dinamalar-monthly-calendar-2021-pdf.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/about.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: thinkcloud.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x26_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 91.106.42.127
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/bin/doctrine-dbal.bat||User:visoftcom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.106.42.127
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/bin/doctrine-dbal.bat HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.183.93.32
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-35.93.183.93.32||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jan 17 22:36:51 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.45
country_id: 798544
description:
Jan 17 22:37:10 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.100
country_id: 953987
description:
Jan 17 22:37:54 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.32
country_id: 3175395
description:
Jan 17 22:36:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.32 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.202.100
country_id: 953987
description:
Jan 17 22:38:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.202.100 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:41:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:42:20 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.61.189.217
country_id: 1168579
description:
2026-01-17 22:43:23 H=([39.61.189.217]) [39.61.189.217]:12128 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.237
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-43.108.165.238.237||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.61.189.217
country_id: 1168579
description:
2026-01-17 22:44:18 H=([39.61.189.217]) [39.61.189.217]:12553 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 39.61.189.217
country_id: 1168579
description:
2026-01-17 22:44:59 H=([39.61.189.217]) [39.61.189.217]:12629 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.115
country_id: 3175395
description:
Jan 17 22:46:17 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.203.206.44
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-46.46.203.206.44||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.47.158.7
country_id: 2510769
description:
Jan 17 22:47:23 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.47.158.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.18
country_id: 3865483
description:
Jan 17 22:47:43 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 22:48:54 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.18
country_id: 3865483
description:
Jan 17 22:47:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.88
country_id: 3175395
description:
Jan 17 22:48:23 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.88 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-17 22:49:20 H=([45.144.212.242]) [45.144.212.242]:65218 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.121.253.107
country_id: 3469034
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=385699 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.11.144
country_id: 2300660
description:
Jan 17 22:56:00 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.11.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.16.7.82
country_id: 6252001
description:
Jan 17 22:59:30 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.16.7.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.16.7.82
country_id: 6252001
description:
2026-01-17 22:59:32 dovecot_plain authenticator failed for H=c-76-16-7-82.hsd1.il.comcast.net (faral) [76.16.7.82]:54436: 535 Incorrect authentication data (set_id=peinee.seh@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:01:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.147.187.8
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-01.45.147.187.8||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 129.222.129.86
country_id: 6252001
description:
2026-01-17 23:01:59 dovecot_login authenticator failed for H=([127.0.0.1]) [129.222.129.86]:49583: 535 Incorrect authentication data (set_id=info@wellsoon.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:02:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.51.88.74
country_id: 1282988
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/corporate.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.93.120.176
country_id: 3625428
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/product-category.php?id=5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:08:34 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.149
country_id: 6252001
description:
2026-01-17 23:09:09 250163 [Warning] Aborted connection 250163 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.149' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.107.0.216
country_id: 1835841
description:
Jan 17 23:09:36 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.107.0.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.107.0.216
country_id: 1835841
description:
2026-01-17 23:09:38 dovecot_login authenticator failed for H=([118.60.136.49]) [183.107.0.216]:52424: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.15
country_id: 241170
description:
Jan 17 23:09:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.241.36.174
country_id: 248816
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/cart.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.124.15.92
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=426830 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.243
country_id: 3175395
description:
Jan 17 23:17:33 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.152.57.60
country_id: 2510769
description:
Jan 17 23:18:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.152.57.60 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.152.57.60
country_id: 2510769
description:
2026-01-17 23:19:00 dovecot_login authenticator failed for H=(cm-staticip-85-152-57-60.telecable.es) [85.152.57.60]:35986: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.197
country_id: 3469034
description:
Jan 17 23:19:43 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.197
country_id: 3469034
description:
Jan 17 23:19:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.149
country_id: 3469034
description:
Jan 17 23:20:37 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.149 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:20:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 23:21:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:22:11 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 17 23:25:43 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.17
country_id: 3469034
description:
Jan 17 23:26:53 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.168
country_id: 6252001
description:
2026-01-17 23:27:15 250848 [Warning] Aborted connection 250848 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.168' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.28
country_id: 3469034
description:
Jan 17 23:27:17 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.17
country_id: 3469034
description:
Jan 17 23:27:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.189.107.66
country_id: 3895114
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/blender-mix-shader-shortcut.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:28:22 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.179.93.147
country_id: 1835841
description:
Jan 17 23:28:42 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.179.93.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.179.93.147
country_id: 1835841
description:
2026-01-17 23:28:44 dovecot_login authenticator failed for H=([121.179.93.147]) [121.179.93.147]:34750: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.184
country_id: 6252001
description:
Jan 17 23:33:23 sv3 pure-ftpd[2466894]: (?@205.210.31.184) [INFO] New connection from 205.210.31.184


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 217.148.140.150
country_id: 6252001
description:
[2026-01-17 23:34:11 +0800] info [webmaild] 217.148.140.150 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.57.34
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.carousel.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.193.51
country_id: 1210997
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery-1.11.1.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.187.85.34
country_id: 3469034
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/bootstrap/js/bootstrap.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.164.85
country_id: 248816
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/js/app.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.99.188.173
country_id: 3686110
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.78.172.101
country_id: 3895114
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/cube/jquery.cubeportfolio.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.76.128.75
country_id: 192950
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.mmenu.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.180.71
country_id: 3865483
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/contact.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.73.149
country_id: 1168579
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.theme.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.125.94.18
country_id: 3469034
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.mmenu.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.219.188.135
country_id: 3469034
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.sticky.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.224.163.116
country_id: 3469034
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/font-awesome/css/font-awesome.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.177.198.250
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/css/extralayers.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.41.113.31
country_id: 102358
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/cube/cubeportfolio.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.236.162.81
country_id: 99237
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.184.169
country_id: 337996
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/moderniz.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.77.136.76
country_id: 3617476
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.227.182.101
country_id: 3469034
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/js/jquery.themepunch.tools.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.29.62.151
country_id: 3865483
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/js/jquery.themepunch.revolution.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.190.238.24
country_id: 2921044
domain: cordage.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/64.0.3282.119 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.82.255.63
country_id: 1168579
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/css/settings.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.57.29.56
country_id: 3865483
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.carousel.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.187.162.83
country_id: 3469034
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/font-awesome/fonts/fontawesome-webfont862f.woff?v=4.1.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.188
country_id: 933860
description:
Jan 17 23:36:27 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.169
country_id: 798544
description:
Jan 17 23:37:28 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/monthly-report.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.21
country_id: 241170
description:
Jan 17 23:37:25 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:40:50 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.24.62.87
country_id: 99237
description:
2026-01-17 23:41:48 dovecot_login authenticator failed for H=(213.5.130.181) [185.24.62.87]:33941: 535 Incorrect authentication data (set_id=mdnaser@grandteknik.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:42:06 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.131.176.57
country_id: 6252001
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/products/officechair/zytko/zytko.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.161.232.82
country_id: 1269750
description:
Jan 17 23:47:03 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.161.232.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 17 23:48:26 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/asia/images/about.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:00:40 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:01:50 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.140.17.52
country_id: 2017370
description:
2026-01-18  0:04:08 252135 [Warning] Aborted connection 252135 to db: 'unconnected' user: 'unauthenticated' host: '45.140.17.52' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:08:06 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.58.242
country_id: 1835841
description:
Jan 18 00:10:35 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.58.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-18 00:10:37 dovecot_login authenticator failed for H=([61.72.101.1]) [61.72.58.242]:51546: 535 Incorrect authentication data (set_id=general@acburn.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.220
country_id: 6252001
description:
Jan 18 00:11:59 sv3 pure-ftpd[2490998]: (?@205.210.31.220) [INFO] New connection from 205.210.31.220


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 18 00:13:31 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-18 00:13:33 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (tairessms) [87.103.126.54]:53268: 535 Incorrect authentication data (set_id=jeffrey.hong@tujusetia.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.220
country_id: 6252001
description:
Jan 18 00:16:30 sv3 pure-ftpd[2492912]: (?@198.235.24.220) [INFO] New connection from 198.235.24.220


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 18 00:16:34 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 220.197.78.139
country_id: 1814991
description:
2026-01-18  0:16:34 252623 [Warning] Aborted connection 252623 to db: 'unconnected' user: 'unauthenticated' host: '220.197.78.139' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-18 00:16:36 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (kined) [87.103.126.54]:24755: 535 Incorrect authentication data (set_id=cornelius.yap@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.159.226.44
country_id: 3508796
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/0x6ba-rpc-exception.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.112.126
country_id: 1269750
description:
Jan 18 00:17:27 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.112.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.112.126
country_id: 1269750
description:
2026-01-18 00:17:29 dovecot_login authenticator failed for H=([128.185.176.81]) [27.123.112.126]:36852: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.70.86
country_id: 1512440
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/cgi-sys/suspendedpage.cgi HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:20:31 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.146.239.158
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-20.66.146.239.158||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:21:45 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:28:21 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 166.139.87.211
country_id: 6252001
description:
2026-01-18 00:35:39 dovecot_login authenticator failed for H=([166.139.87.211]) [166.139.87.211]:39098: 535 Incorrect authentication data (set_id=rosliza@stonewld.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.139.87.211
country_id: 6252001
description:
Jan 18 00:35:37 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.139.87.211 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.53.210.143
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=569531 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:41:21 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:42:37 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.165.25.131
country_id: 3996063
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/video.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.153.35
country_id: 1880251
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/F011-0003 /F011-0003-250x250.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.153.35
country_id: 1880251
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/F011-0003 /F011-0003-250x250.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/plug/sms/img/img/clientele.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 00:49:11 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.45.0.115
country_id: 3573591
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.223.57.59
country_id: 3932488
domain: mail.uumism.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mail.uumism.edu.my/cgi-bin/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.237.11.111
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841251 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:01:43 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.238.197.107
country_id: 99237
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/7018710133.jpg&size=1000x1000 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:02:55 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.111.200.101
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/myclabs/php-enum/SECURITY.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.228.220
country_id: 6252001
description:
Jan 18 01:05:43 sv3 pure-ftpd[2519946]: (?@172.236.228.220) [INFO] New connection from 172.236.228.220


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.78.66.19
country_id: 2542007
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/finder/Comparator/DateComparator.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.131.214.102
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/guzzlehttp/psr7/src/UriResolver.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.90.27.83
country_id: 1643084
description:
2026-01-18 01:07:57 dovecot_login authenticator failed for H=(ip-arana.net.id.as132673) [103.90.27.83]:53180: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:09:46 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-18 01:10:33 +0800] info [cpaneld] 181.189.36.4 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.11.195.72
country_id: 3865483
description:
Jan 18 01:10:31 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.11.195.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.76.164
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/creative-service.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.20
country_id: 2750405
description:
Jan 18 01:12:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.232.73.130
country_id: 1269750
description:
Jan 18 01:13:16 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.232.73.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.232.73.130
country_id: 1269750
description:
2026-01-18 01:13:18 dovecot_login authenticator failed for H=([136.232.73.130]) [136.232.73.130]:48872: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 18 01:13:20 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.45.137.114
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/polyfill-util/BinaryOnFuncOverload.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.209.159.15
country_id: 1668284
description:
Jan 18 01:17:55 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.209.159.15 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.238.76.167
country_id: 2464461
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/amc-commander.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 147.50.94.29
country_id: 1605651
description:
Jan 18 01:19:34 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 147.50.94.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.50.94.29
country_id: 1605651
description:
2026-01-18 01:19:36 dovecot_login authenticator failed for H=([147.50.94.29]) [147.50.94.29]:54218: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.112
country_id: 1814991
description:
2026-01-18 01:20:34 dovecot_login authenticator failed for H=([27.24.141.112]) [27.24.141.112]:56740: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.132.42.170
country_id: 1814991
description:
Jan 18 01:19:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.132.42.170 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.132.42.170
country_id: 1814991
description:
2026-01-18 01:20:00 dovecot_login authenticator failed for H=([116.132.42.170]) [116.132.42.170]:59969: 535 Incorrect authentication data (set_id=ahmad.asif@acburn.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.112
country_id: 1814991
description:
Jan 18 01:20:32 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.131
country_id: 953987
description:
Jan 18 01:21:48 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.131 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.182.190.233
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=844999 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.35.3
country_id: 1269750
description:
Jan 18 01:21:46 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.35.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.188
country_id: 3175395
description:
Jan 18 01:21:47 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.36.131
country_id: 953987
description:
Jan 18 01:21:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.36.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.118.35.3
country_id: 1269750
description:
Jan 18 01:22:00 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.118.35.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.188
country_id: 3175395
description:
Jan 18 01:22:00 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.188 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:22:10 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.1.43
country_id: 690791
description:
Jan 18 01:22:30 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.1.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.127.166.128
country_id: 3625428
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=672005 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.137.99.176
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-23.64.137.99.176||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:23:18 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 60.51.91.34
country_id: 1733045
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=641998 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.74.124.18
country_id: 614540
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=1&sub=12 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.250.0.139
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=594602 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.98.73.23
country_id: 290557
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/services.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.206.124.16
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=3&sub=7 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.95.119.191
country_id: 953987
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=2&sub=21 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.183.250.92
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=232442 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.105.173
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-25.166.0.105.173||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.137.203
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=182498 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.50.67.161
country_id: 3439705
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=558493 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.19.85.65
country_id: 294640
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=1&page_id=1&sub=34 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 24.186.218.164
country_id: 6252001
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/shop-single.php?id=6166 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.204.210.44
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=16 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.16.26.20
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=951091 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.56.0.19
country_id: 3469034
description:
2026-01-18 01:27:49 dovecot_login authenticator failed for H=(189-56-0-19.customer.tdatabrasil.net.br) [189.56.0.19]:45108: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.28.149
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-29.50.117.28.149||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/monthly-report.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2026-01-18 01:30:47 dovecot_login authenticator failed for H=(static-221.76.249.49-tataidc.co.in) [49.249.76.221]:53730: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:29:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
country_id: 1269750
description:
Jan 18 01:30:45 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.192
country_id: 6252001
description:
Jan 18 01:30:45 sv3 pure-ftpd[2533453]: (?@162.142.125.192) [INFO] New connection from 162.142.125.192


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.3.131
country_id: 690791
description:
Jan 18 01:31:34 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.3.131 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.219
country_id: 6252001
description:
2026-01-18  1:31:53 255303 [Warning] Aborted connection 255303 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.219' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.20
country_id: 2750405
description:
Jan 18 01:30:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.141.215.160
country_id: 798544
description:
Jan 18 01:32:47 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.141.215.160 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.141.215.160
country_id: 798544
description:
2026-01-18 01:32:49 dovecot_plain authenticator failed for H=([45.141.215.160]) [45.141.215.160]:50700: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.232.217
country_id: 3437598
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/3-Reasons-to-Maintain-Commercial-Kitchen-Appliances.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.123.17.75
country_id: 953987
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=3142352688 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.113.151.102
country_id: 3658394
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/22heavilyformatted.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.78.168.114
country_id: 6252001
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=2013465308 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.63.131
country_id: 953987
description:
Jan 18 01:42:26 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.63.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.101.9.55
country_id: 2635167
description:
Jan 18 01:42:41 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.101.9.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:42:48 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.131.221
country_id: 690791
description:
Jan 18 01:43:20 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.131.221 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:43:56 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 146.251.236.212
country_id: 102358
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/just/8/700/847131 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.249.208.54
country_id: 1643084
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/bag/13/97/1316311 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 01:50:34 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/eco.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 18 01:50:22 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.12.81.97
country_id: 690791
description:
Jan 18 01:56:44 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.12.81.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.12.81.97
country_id: 690791
description:
Jan 18 01:56:59 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.12.81.97 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.42.14
country_id: 953987
description:
Jan 18 01:57:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.42.14 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.204
country_id: 3469034
description:
Jan 18 01:59:09 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 02:03:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 02:04:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.96.199
country_id: 3996063
description:
Jan 18 02:09:15 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.96.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 18 02:11:01 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
country_id: 1814991
description:
Jan 18 02:13:18 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.64.94
country_id: 3469034
description:
Jan 18 02:13:39 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.64.94 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.64.94
country_id: 3469034
description:
2026-01-18 02:13:41 dovecot_login authenticator failed for H=(189-108-129-173.customer.tdatabrasil.net.br) [187.8.64.94]:41688: 535 Incorrect authentication data (set_id=bizdevelopment@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.76.248.54
country_id: 1814991
description:
Jan 18 02:14:23 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.76.248.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.131.233
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/motor-tyre01.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 18 02:17:24 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-18 02:17:26 dovecot_login authenticator failed for H=(gTQzRD6) [178.16.54.22]:55986: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-18 02:17:57 dovecot_login authenticator failed for H=(QsbiyM12hw) [178.16.54.22]:65380: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 18 02:18:31 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 18 02:19:03 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-18 02:19:05 dovecot_login authenticator failed for H=(9qyyLS2yX) [178.16.54.22]:52251: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.149.165.107
country_id: 6252001
description:
Jan 18 02:19:25 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.149.165.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.149.165.107
country_id: 6252001
description:
2026-01-18 02:19:27 dovecot_login authenticator failed for H=c-76-149-165-107.hsd1.ut.comcast.net [76.149.165.107]:59911: 535 Incorrect authentication data (set_id=serene.chin@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 18 02:20:04 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-18 02:20:06 dovecot_login authenticator failed for H=(lOo8V5) [178.16.54.22]:55977: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 18 02:20:58 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-18 02:21:00 dovecot_login authenticator failed for H=(kpaxygO) [178.16.54.22]:57955: 535 Incorrect authentication data (set_id=enquiry)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.219.112
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/service/17/44/1730998 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 18 02:22:50 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-18 02:22:52 dovecot_login authenticator failed for H=(dVIBcuWH) [178.16.54.22]:52123: 535 Incorrect authentication data (set_id=enquiry)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.16.54.22
country_id: 2750405
description:
Jan 18 02:23:48 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.16.54.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.173.31.66
country_id: 2017370
description:
Jan 18 02:23:48 sv3 auth[2219394]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.173.31.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.16.54.22
country_id: 2750405
description:
2026-01-18 02:23:50 dovecot_login authenticator failed for H=(CZLGOiBU) [178.16.54.22]:61155: 535 Incorrect authentication data (set_id=enquiry)


