# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 15:48:20 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.129.232.247
country_id: 6252001
description:
2026-01-29 15:49:01 dovecot_login authenticator failed for H=(ADMIN) [102.129.232.247]:46465: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 15:49:28 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-29 15:50:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:19025: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.235
country_id: 1269750
description:
Jan 29 15:50:41 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 15:51:33 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 15:53:54 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.213.161.26
country_id: 630336
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maennchen/zipstream-php/test/bootstrap.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.36
country_id: 1269750
description:
Jan 29 15:54:31 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-29 15:54:52 H=([64.89.160.15]) [64.89.160.15]:52561 F=<drdavid000908090098087890@outlook.com> rejected RCPT <sales@cordage.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 15:55:01 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 15:57:07 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.80.20.232
country_id: 6252001
description:
Jan 29 15:58:48 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.80.20.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.80.20.232
country_id: 6252001
description:
2026-01-29 15:58:50 dovecot_plain authenticator failed for H=ec2-98-80-20-232.compute-1.amazonaws.com (uvrjla0nqwjqlnckl6nto5k2jilemi) [98.80.20.232]:47312: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.36
country_id: 1269750
description:
Jan 29 15:58:22 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-29 15:58:24 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:59362: 535 Incorrect authentication data (set_id=alert@essemgroup.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 15:59:27 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:00:35 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:02:40 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 16:02:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52594: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.189.159
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/example/16/221/1667288 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 29 16:05:02 sv3 dovecot[1519948]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-29 16:05:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:52534: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:05:01 sv3 auth[199710]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:06:08 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-29 16:07:46 H=([45.144.212.242]) [45.144.212.242]:56469 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:08:13 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:10:34 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.38.100
country_id: 3865483
description:
2026-01-29 16:11:36 dovecot_login authenticator failed for H=(ADMIN) [146.70.38.100]:3547: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:11:42 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.89.161.115
country_id: 2635167
description:
Jan 29 16:11:16 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.89.161.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:13:47 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-29 16:16:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:12799: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:16:08 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:17:16 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-29 16:18:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:19029: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:19:21 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.7.165.67
country_id: 3469034
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/multi-purpose-box-m-sample?tag=multi purpose box - l size HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/rpl.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.7.165.67
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/multi-purpose-box-m-sample?tag=multi purpose box - l size HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.211.246.218
country_id: 1831722
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/new-carton-box?product_id=461 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.211.246.218
country_id: 1831722
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/new-carton-box?product_id=461 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 47.52.166.93
country_id: 1819730
description:
Jan 29 16:21:05 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 47.52.166.93 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:21:41 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 47.52.166.93
country_id: 1819730
description:
2026-01-29 16:21:07 dovecot_login authenticator failed for H=(ADMIN) [47.52.166.93]:47072: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 16:22:45 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59056: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:22:49 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 16:23:00 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59059: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 16:24:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59096: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:24:54 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 16:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59132: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.215.204.109
country_id: 3469034
description:
2026-01-29 16:26:26 dovecot_login authenticator failed for H=(igrejadorecreio.static.host.gvt.net.br) [186.215.204.109]:48445: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.215.204.109
country_id: 3469034
description:
Jan 29 16:26:24 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.215.204.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.172.230.184
country_id: 1814991
description:
2026-01-29 16:27:29 dovecot_login authenticator failed for H=([60.172.230.184]) [60.172.230.184]:51924: 535 Incorrect authentication data (set_id=tech@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:27:15 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/demos/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.172.230.184
country_id: 1814991
description:
Jan 29 16:27:27 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.172.230.184 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:28:22 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 16:30:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57833: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:30:28 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.68.160
country_id: 1733045
description:
[2026-01-29 16:31:28 +0800] info [webmaild] 183.171.68.160 - payment@tujusetia.my "POST /cpsess8926957106/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.101.164] != Current IP Address [183.171.68.160]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.28.255.71
country_id: 248816
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/RequestStackTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:32:48 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-29 16:33:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:52833: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 149.30.139.241
country_id: 1694008
description:
[2026-01-29 16:33:52 +0800] info [cpaneld] 149.30.139.241 - nexus2019 "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:33:56 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.241.80.60
country_id: 1814991
description:
2026-01-29 16:33:14 dovecot_login authenticator failed for H=(ADMIN) [188.241.80.60]:41333: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.118.150.170
country_id: 1269750
description:
2026-01-29 16:34:45 928162 [Warning] Aborted connection 928162 to db: 'unconnected' user: 'unauthenticated' host: '103.118.150.170' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.132.153.137
country_id: 6252001
description:
2026-01-29 16:35:46 928256 [Warning] Aborted connection 928256 to db: 'unconnected' user: 'unauthenticated' host: '66.132.153.137' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:36:01 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 16:38:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56145: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:38:22 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:39:30 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.62.151.179
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dance/11/490/1176401 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:41:35 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:43:56 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/clientele.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-29 16:45:02 H=([45.144.212.242]) [45.144.212.242]:59664 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:45:04 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-29 16:45:29 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:19035: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.137.105.33
country_id: 690791
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/listing-details.php?id=54324787 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.135.93
country_id: 1733045
description:
2026-01-29 16:46:02 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.36]) [113.211.135.93]:19594: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:47:09 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:49:30 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:50:37 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:52:43 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-29 16:54:55 H=([45.144.212.242]) [45.144.212.242]:59394 F=<info@starorganizasyon.com> rejected RCPT <hr_admin@smartcable.com.my>: SPF: 45.144.212.242 is not allowed to send mail from starorganizasyon.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 16:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56228: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:55:03 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.157.117.107
country_id: 2542007
description:
Jan 29 16:55:42 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.157.117.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.157.117.107
country_id: 2542007
description:
2026-01-29 16:55:44 dovecot_plain authenticator failed for H=([192.168.1.9]) [105.157.117.107]:58174: 535 Incorrect authentication data (set_id=55000)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:56:11 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.44
country_id: 690791
description:
2026-01-29 16:56:20 H=([45.144.212.44]) [45.144.212.44]:53757 F=<operasyon@canigrup.com> rejected RCPT <egtsales@empirelog.com.my>: SPF: 45.144.212.44 is not allowed to send mail from canigrup.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.92
country_id: 2077456
description:
2026-01-29 16:57:05 dovecot_login authenticator failed for H=(ADMIN) [179.61.228.92]:17284: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 16:58:16 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.190.190.192
country_id: 3017382
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/products.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:00:36 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-29 17:01:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:53943: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.157.117.107
country_id: 2542007
description:
Jan 29 17:01:36 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.157.117.107 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 105.157.117.107
country_id: 2542007
description:
2026-01-29 17:01:38 dovecot_plain authenticator failed for H=([192.168.1.9]) [105.157.117.107]:53631: 535 Incorrect authentication data (set_id=angeaawiedmlnn@outlook.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:01:44 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:03:49 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 52.80.218.64
country_id: 1814991
domain: www.ms-chemicals.net
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PFFM10 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36 aweme_250000 JsSdk/1.0 NetType/WIFI Channel/31725782a AppName/aweme app_version/25.0.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BULLET/1 BytedanceWebview/d8a21c6 TTWebView/0881130048402||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.223.103.137
country_id: 1814991
domain: www.ms-chemicals.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.55 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-29 17:06:03 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:06:09 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:07:17 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li>email out sale invoice</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">filing payment voucher and sales invoice</li>\r\n<li>help wrapping gift for annul dinner event</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">help to prepare red envelopes for lucky draw</li>\r\n<li>print out for mesra nusajaya sdn bhd document and arrange the all director to sign</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">login ambank check the payment has been approve or not. (awaiting liquidation and pending treasury action)</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:09:22 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:11:43 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.141
country_id: 2635167
description:
2026-01-29 17:11:25 929666 [Warning] Aborted connection 929666 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.141' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:12:51 sv3 auth[1520228]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 9703
name: Dovecot is Starting Up.
description:
Jan 29 17:13:16 sv3 dovecot[1641911]: master: Dovecot v2.4.2 (0962ed2104) starting up for lmtp, imap, pop3, sieve


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.141
country_id: 2635167
description:
2026-01-29 17:13:27 929749 [Warning] Aborted connection 929749 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.141' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:14:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 108.61.89.59
country_id: 6252001
domain: www.pspoly.com.my
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:-d allow_url_include=on -d auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.121.230.125
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/tests/Hamcrest/Type HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.200.214.28
country_id: 1522867
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/tests/Hamcrest/Type/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.252.89
country_id: 3469034
description:
Jan 29 17:16:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.252.89 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 194.62.167.104
country_id: 6252001
description:
2026-01-29 17:16:06 H=([194.62.167.104]) [194.62.167.104]:52498 F=<quickbooks@notification.intuit.com> rejected RCPT <garylee@autogreastar.com.my>: SPF: 194.62.167.104 is not allowed to send mail from notification.intuit.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:17:16 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:18:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.249.214.108
country_id: 6251999
description:
2026-01-29 17:18:36 dovecot_login authenticator failed for H=(ADMIN) [178.249.214.108]:5710: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.141
country_id: 2635167
description:
2026-01-29 17:18:09 929931 [Warning] Aborted connection 929931 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.141' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.108.173
country_id: 1733045
description:
[2026-01-29 17:20:19 +0800] info [webmaild] 60.54.108.173 - cle@ajplantations.com.my "GET /cpsess4184891275/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:20:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:22:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 17:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56367: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:23:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.30.250.107
country_id: 2510769
description:
Jan 29 17:24:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.30.250.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.30.250.107
country_id: 2510769
description:
2026-01-29 17:24:32 dovecot_login authenticator failed for H=([80.30.250.107]) [80.30.250.107]:46512: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.195.19.75
country_id: 1269750
description:
Jan 29 17:24:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.195.19.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.195.19.75
country_id: 1269750
description:
2026-01-29 17:24:49 dovecot_login authenticator failed for H=(static-75.19.195.14-tataidc.co.in) [14.195.19.75]:49290: 535 Incorrect authentication data (set_id=marketing)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:26:01 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:28:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.108.173
country_id: 1733045
description:
[2026-01-29 17:28:47 +0800] info [webmaild] 60.54.108.173 - cle@ajplantations.com.my "GET /cpsess4184891275/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:29:29 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-29 17:29:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:53989: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.127.197.180
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/FileBagTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.216.17.198
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=13 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:31:34 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.27.177.11
country_id: 3489940
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/DependencyInjection/RegisterListenersPass.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/magnific-popup/magnific-popup.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.143.105.97
country_id: 1733045
description:
2026-01-29 17:33:38 dovecot_plain authenticator failed for H=([192.168.10.100]) [175.143.105.97]:61003: 535 Incorrect authentication data (set_id=it-ticket@manforce.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/maxcdn.bootstrapcdn.com/font-awesome/4.2.0/css/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.147
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/z-nav/jquery.mobile.menu.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/raty/jquery.raty.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/SmoothScroll/SmoothScroll.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/swiper/idangerous.swiper.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/galleriffic/jquery.galleriffic.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.134
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/magnific-popup/jquery.magnific-popup.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/scrollto/jquery.scrollTo.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-29 17:33:48 H=([45.144.212.242]) [45.144.212.242]:51140 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/raty/jquery.raty.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:33:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/external/waypoint/waypoints.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.184.47.161
country_id: 3469034
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/product/145/Harsen-Controller.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.139
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/modernizr/modernizr.custom.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/swiper/idangerous.swiper.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/js/custom.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/external/z-nav/z-nav.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 202.8.118.196
country_id: 1269750
domain: working.magsoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/working.magsoft.com.my/tppowernew/product/145/get-tweets1.1.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:35:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.34
country_id: 6252001
description:
2026-01-29 17:35:41 930744 [Warning] Aborted connection 930744 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.34' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.143.105.97
country_id: 1733045
description:
2026-01-29 17:36:32 dovecot_plain authenticator failed for H=([192.168.10.100]) [175.143.105.97]:55301: 535 Incorrect authentication data (set_id=it-ticket@manforce.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:37:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.143.105.97
country_id: 1733045
description:
2026-01-29 17:38:38 dovecot_plain authenticator failed for H=([192.168.10.100]) [175.143.105.97]:58861: 535 Incorrect authentication data (set_id=it-ticket@manforce.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:39:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.85.164
country_id: 1733045
description:
[2026-01-29 17:40:57 +0800] info [webmaild] 180.75.85.164 - purchase@pftfood.com "POST /cpsess5510042086/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.139.172.6] != Current IP Address [180.75.85.164]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:40:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.85.164
country_id: 1733045
description:
[2026-01-29 17:41:01 +0800] info [webmaild] 180.75.85.164 - hakim@pftfood.com "POST /cpsess0623136498/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.139.172.6] != Current IP Address [180.75.85.164]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.143.105.97
country_id: 1733045
description:
2026-01-29 17:41:01 dovecot_plain authenticator failed for H=([192.168.10.100]) [175.143.105.97]:52267: 535 Incorrect authentication data (set_id=it-ticket@manforce.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.126.89.88
country_id: 660013
description:
2026-01-29 17:41:24 dovecot_login authenticator failed for H=(ADMIN) [188.126.89.88]:54134: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:42:41 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.195
country_id: 1733045
description:
Jan 29 17:42:43 sv3 pure-ftpd[1684940]: (?@113.211.212.195) [INFO] New connection from 113.211.212.195


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.133.184
country_id: 1733045
description:
[2026-01-29 17:42:45 +0800] info [webmaild] 113.211.133.184 - justinchew@ms-chemicals.net "GET /cpsess7935655003/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.212.195
country_id: 1733045
description:
Jan 29 17:43:28 sv3 pure-ftpd[1685874]: (eminent@113.211.212.195) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.212.195
country_id: 1733045
description:
Jan 29 17:43:26 sv3 pure-ftpd[1685874]: (?@113.211.212.195) [INFO] New connection from 113.211.212.195


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.212.195
country_id: 1733045
description:
Jan 29 17:43:40 sv3 pure-ftpd[1685874]: (eminent@113.211.212.195) [NOTICE] Deleted /home/eminent//public_html/folder/RHB1045_Bankwide_Jan_eDM_2026/images/9Jan26.jpg


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.236
country_id: 3469034
description:
Jan 29 17:44:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.236
country_id: 3469034
description:
Jan 29 17:45:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:45:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.85.164
country_id: 1733045
description:
[2026-01-29 17:45:08 +0800] info [webmaild] 180.75.85.164 - peng@pftfood.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->posted assembly orders</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do posting sales invoices &amp; filing sales invoice</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->do interco sales order for tpl-po-013949</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; </span></span></span><!--[endif]-->send soa jan&rsquo;25 - june&rsquo;25 for cameron highlands meadows &amp; cw choi racing</li>\r\n</ul>||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 37.140.254.209
country_id: 2658434
domain: www.oxbold.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/assets/images/adriv4.php||SC:/home/oxboldc/public_html/assets/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:46:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:48:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 17:50:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56463: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:50:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:51:43 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:53:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77093094
abuser: 85.11.167.4
country_id: 732800
domain: mail.box.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"_response\":{\"_formData\":{\"get\":\"$1:constructor:constructor\"},\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('echo VULN_1769680539_4263',{'timeout':30000}).toString();throw Object.assign(new Error('NEXT_REDIRECT'),{digest:`${res}`});\"},\"reason\":-1,\"status\":\"resolved_model\",\"then\":\"$1:__proto__:then\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\"}||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.36
country_id: 1269750
description:
Jan 29 17:56:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:56:09 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.149.129.43
country_id: 1694008
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><strong>purchasing &amp; logistics tasks</strong></p>\r\n<ul>\r\n<li>continue updating and checking the inventory worksheet.</li>\r\n<li>compile invoices and purchase orders.</li>\r\n<li>forwarded the approved po to the accounting department to process payment.</li>\r\n</ul>\r\n<p><strong>export status</strong></p>\r\n<ul>\r\n<li style=\"list-style-type: none;\">\r\n<ul>\r\n<li>the loading schedule is on january 30</li>\r\n<li>etd: on feb. 2, 2026</li>\r\n</ul>\r\n</li>\r\n</ul>\r\n<p>import status</p>\r\n<ul>\r\n<li>feb a - eta: feb. 04, 2026</li>\r\n</ul>\r\n<p>&nbsp;</p>||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:57:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 17:59:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:01:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:02:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:04:55 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.16
country_id: 2635167
description:
2026-01-29 18:06:00 H=([64.89.160.16]) [64.89.160.16]:62879 F=<AbdullahZida0n003000@outlook.com> rejected RCPT <euratech@euratech.com.my>: SPF: 64.89.160.16 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.116.3
country_id: 1880251
domain: feliogroup.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:07:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.153.177
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/introduceisland/19/299/1933464 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:08:23 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.133.148.173
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603677 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.67
country_id: 3077311
description:
2026-01-29 18:09:34 dovecot_login authenticator failed for H=(ADMIN) [212.102.39.67]:10354: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.88.136
country_id: 1269750
description:
Jan 29 18:09:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.88.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.117.225.44
country_id: 2264397
domain: cabe.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/123.0.6312.86 Safari/537.36||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.29.122.239
country_id: 6251999
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-10.82.29.122.239||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.248.91
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=457703 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:10:29 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.16.88.136
country_id: 1269750
description:
Jan 29 18:10:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.16.88.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.207.98.71
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-11.185.207.98.71||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:12:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:13:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:16:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-29 18:16:56 H=([45.144.212.50]) [45.144.212.50]:49876 F=<zuleyha@savalanshipping.com> rejected RCPT <astbki@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.246
country_id: 3469034
description:
Jan 29 18:17:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 18:18:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56728: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.36.246
country_id: 3469034
description:
Jan 29 18:18:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.36.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:18:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:19:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.50.221
country_id: 1562822
description:
Jan 29 18:20:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.50.221 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.215.59
country_id: 1733045
description:
[2026-01-29 18:22:00 +0800] info [webmaild] 113.211.215.59 - bell@lvconsult.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:21:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.122.225
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=541552 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.96.45.176
country_id: 6252001
domain: www.mckd.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4298.0 Safari/537.36||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 102.253.0.7
country_id: 953987
description:
2026-01-29 18:23:18 H=([102.254.0.12]) [102.253.0.7]:21590 F=<noreply@oxbold.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:23:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.181.124.194
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=64781518079619 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.178.2.240
country_id: 3865483
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/news-detail-7.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:25:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-29 18:27:24 H=([45.144.212.50]) [45.144.212.50]:53893 F=<zuleyha@savalanshipping.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.215.59
country_id: 1733045
description:
[2026-01-29 18:27:52 +0800] info [webmaild] 113.211.215.59 - bell@lvconsult.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up arrival notice from bt forwarding for rbprc order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up documents courier status with demeter.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up invoice from greenpen.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up invoice from ffc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up vessel schedule with whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send import schedule to tpl team.</span></li>\r\n</ul>||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:27:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:29:29 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.214.166.156
country_id: 6252001
description:
2026-01-29 18:29:49 dovecot_login authenticator failed for H=(ADMIN) [181.214.166.156]:57024: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.214.166.156
country_id: 6252001
description:
Jan 29 18:29:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.214.166.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:30:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.0.129.10
country_id: 3469034
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=961277 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.169.184
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/event-single.php?id=875939 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:32:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 159.26.119.226
country_id: 1861060
domain: smartcable.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:71717.smartcable.com.my||ServerName:smartcable.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:bf2eeb5212019c4603096f64d02bc7e4b7ca70dd||Title:0x6040bc4d||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.37.203.28
country_id: 1831722
description:
Jan 29 18:34:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.37.203.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.219.104.210
country_id: 3175395
description:
Jan 29 18:34:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.219.104.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.36.42
country_id: 1819730
description:
Jan 29 18:35:20 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.36.42 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.38.218.44
country_id: 3865483
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/newsletter/smy-oct-dec-2013/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.247.55.219
country_id: 2589581
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?option=com_phocagallery&view=categories&Itemid=151 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.80.51.74
country_id: 3378535
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?option=com_chronocontact&chronoformname=MembershipForm HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:35:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:36:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.139.88
country_id: 2635167
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/img/demos/img/demos/clientele.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.177.243.145
country_id: 1269750
description:
Jan 29 18:38:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.177.243.145 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.177.243.145
country_id: 1269750
description:
2026-01-29 18:38:20 dovecot_plain authenticator failed for H=(398XN2FAL8) [122.177.243.145]:20349: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:38:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-29 18:39:46 H=([45.144.212.50]) [45.144.212.50]:51458 F=<zuleyha@savalanshipping.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from savalanshipping.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.112.150
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78291516783061 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:40:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.179.148.77
country_id: 3469034
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/projects-references.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.50.199.9
country_id: 1733045
description:
[2026-01-29 18:41:27 +0800] info [webmaild] 60.50.199.9 - horizon@tst-ma.com "POST /cpsess3570780216/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.50.0.217] != Current IP Address [60.50.199.9]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:41:44 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.108.59.158
country_id: 3469034
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/new.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 182.181.177.29
country_id: 1168579
domain: solidfence.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:53989.solidfence.com.my||ServerName:solidfence.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3ec28afa61796062a515fda0bf183f7fb1dfea46||Title:0xc2d640bd||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:43:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.155.135
country_id: 1562822
domain: www.aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aire-fresh.com/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 39.51.36.138
country_id: 1168579
description:
Jan 29 18:44:16 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 39.51.36.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 39.51.36.138
country_id: 1168579
description:
2026-01-29 18:44:18 dovecot_plain authenticator failed for H=(1J0G627F) [39.51.36.138]:60223: 535 Incorrect authentication data (set_id=joyo@dsc-expat.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.236.180.221
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-44.171.236.180.221||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.173.220.111
country_id: 3017382
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/special/technology/technology02.htm HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.164
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.155
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 18:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56974: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:46:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 23.132.164.130
country_id: 2635167
description:
2026-01-29 18:46:22 H=([23.132.164.130]) [23.132.164.130]:59597 F=<cybar3@cytanet.com.cy> rejected RCPT <info@inter-link.edu.my>: SPF: 23.132.164.130 is not allowed to send mail from cytanet.com.cy


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:47:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.160.114.50
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14891515376488 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:49:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.107.179.101
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&sub=38 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:51:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:52:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.173.152.54
country_id: 2658434
description:
2026-01-29 18:52:55 dovecot_login authenticator failed for H=(ADMIN) [158.173.152.54]:6086: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.110.97.54
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-53.116.110.97.54||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:54:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.66
country_id: 6252001
description:
2026-01-29 18:56:11 934145 [Warning] Aborted connection 934145 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.66' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.106.31.234
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=509827 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.199.59.48
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=84871515980605 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:57:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.25.171.69
country_id: 2464461
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=219327 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.0.72.124
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-58.117.0.72.124||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 18:58:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.245.98.30
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-59.171.245.98.30||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.241.122
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=946038 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:00:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.126.182.139
country_id: 690791
description:
Jan 29 19:00:29 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.126.182.139 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.153.168
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=982714 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.73.90.94
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-02.27.73.90.94||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:02:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:03:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.98.88.51
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-05.116.98.88.51||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:06:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.76.84.222
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-08.27.76.84.222||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:08:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:09:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.220.252
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=27 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:11:34 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 179.224.184.212
country_id: 3469034
domain: stonewld.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:33996.stonewld.com.my||ServerName:stonewld.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6287b51a3a650cc9a9403c242f2f3ad5f948d90e||Title:0xc578d3b5||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.56.80.163
country_id: 6251999
description:
2026-01-29 19:11:53 dovecot_login authenticator failed for H=(ADMIN) [66.56.80.163]:26585: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 130.254.106.30
country_id: 3175395
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-12.130.254.106.30||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.174.178
country_id: 1269750
description:
2026-01-29 19:12:49 dovecot_login authenticator failed for H=(nsg-corporate-57.181.187.122.airtel.in) [182.95.174.178]:38456: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.174.178
country_id: 1269750
description:
Jan 29 19:12:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.174.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.107.17.16
country_id: 290557
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/maennchen/zipstream-php/test/ZipStreamTest.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:13:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 27.73.91.133
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-14.27.73.91.133||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 19:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57182: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.66
country_id: 6252001
description:
2026-01-29 19:14:31 934810 [Warning] Aborted connection 934810 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.66' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:15:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.170.153
country_id: 3469034
description:
Jan 29 19:16:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.170.153 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 130.12.182.66
country_id: 6252001
description:
2026-01-29 19:16:36 934875 [Warning] Aborted connection 934875 to db: 'unconnected' user: 'unauthenticated' host: '130.12.182.66' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:17:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 29 19:17:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:19:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.127.85.216
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/sfCompact.yml HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.113.37
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=126580 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:20:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.78.149.63
country_id: 2963597
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95111514512466 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:22:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 15.204.155.25
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.69||T:APACHE||REQUEST_URI:/wp-content/plugins/hdinvoice3/readme.txt||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:24:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.47.23
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=789818 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.141.129
country_id: 1733045
description:
[2026-01-29 19:26:35 +0800] info [webmaild] 113.211.141.129 - s-osada@mckd.com.my "GET /cpsess1762562877/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:26:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-29 19:27:48 H=([64.89.160.15]) [64.89.160.15]:64109 F=<drdavid00@outlook.com> rejected RCPT <euratech@euratech.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:28:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-29 19:29:39 H=([64.89.160.15]) [64.89.160.15]:49203 F=<drdavid00@outlook.com> rejected RCPT <mkmadmin@mkmetal.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:30:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.0.184
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=124214 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:31:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.20.171.72
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/pipe-repair.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-29 19:32:12 +0800] info [cpaneld] 202.178.120.157 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 113.211.130.49
country_id: 1733045
description:
[2026-01-29 19:32:20 +0800] info [webmaild] 113.211.130.49 - bell@lvconsult.com.my  "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:33:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.20
country_id: 732800
description:
2026-01-29 19:33:12 dovecot_login authenticator failed for H=(ADMIN) [94.156.14.20]:46979: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.37.41
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-33.168.91.37.41||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:36:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:37:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:39:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 152.32.250.36
country_id: 1562822
description:
Jan 29 19:40:39 sv3 pure-ftpd[1799338]: (?@152.32.250.36) [WARNING] Authentication failed for user [anonymous]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.49.147.243
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22661523525833 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:41:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 152.32.250.36
country_id: 1562822
description:
Jan 29 19:42:16 sv3 pure-ftpd[1800968]: (?@152.32.250.36) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:42:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.6.226.180
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82011532676752 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 108.179.253.10
country_id: 6252001
description:
Jan 29 19:42:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 108.179.253.10 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-29 19:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57261: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.179.253.10
country_id: 6252001
description:
2026-01-29 19:42:19 dovecot_login authenticator failed for H=br552.hostgator.com.br (grutamaquinas.com.br) [108.179.253.10]:32050: 535 Incorrect authentication data (set_id=hengchin.yeap@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:44:51 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.117.120
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603871 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.231
country_id: 1269750
description:
Jan 29 19:45:22 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.231 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/photos/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 152.32.250.36
country_id: 1562822
description:
Jan 29 19:46:47 sv3 pure-ftpd[1804280]: (?@152.32.250.36) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:47:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.64.158.187
country_id: 2363686
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/we/8/342/804764 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:48:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:50:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.198.23
country_id: 3658394
domain: box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/box.com.my/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.198.23
country_id: 3658394
domain: box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/box.com.myhttp/box.com.my/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:52:44 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/home/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:53:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.132.91
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=975825 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.204.64.103
country_id: 3489940
description:
Jan 29 19:54:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.204.64.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.204.64.103
country_id: 3489940
description:
2026-01-29 19:54:54 dovecot_plain authenticator failed for H=(8N8LN255TCKTWN) [207.204.64.103]:63308: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 207.204.64.103
country_id: 3489940
description:
2026-01-29 19:55:01 dovecot_login authenticator failed for H=(5HJ30XO6291) [207.204.64.103]:64825: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.4
country_id: 3042058
description:
2026-01-29 19:55:24 dovecot_login authenticator failed for H=(ADMIN) [91.90.122.4]:16454: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:55:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.178.14
country_id: 1562822
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-3.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.176.72.200
country_id: 617790
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-2.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.188.79.212
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-58.185.188.79.212||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:58:16 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 29 19:59:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.151.143
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.245.188
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.218.168
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=360128 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.255.30
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.91.123
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=1&sub=19 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.171.191.102
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=566815 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.36.51.247
country_id: 3865483
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.25.195
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/hotel.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.195.219
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&sub=37 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.247.100
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=663533 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.225.244.32
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/casual.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.247.12
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=464199 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.47.65
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=645854 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-29 20:01:41 H=([45.144.212.54]) [45.144.212.54]:64183 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.69.39
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=714389 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.166.222.215
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=715123 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.81.93.180
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=3&sub=24 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.93.131
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=1&page_id=2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.193.163
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=2&sub=27 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.104.162
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=679911 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 59.178.207.99
country_id: 1269750
description:
2026-01-29 20:02:04 dovecot_plain authenticator failed for H=(398XN2FAL8) [59.178.207.99]:62304: 535 Incorrect authentication data (set_id=export@urban.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.162.119
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=605450 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.185.75.4
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 171.250.163.33
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=340379 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.122.162
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/keyword/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.74.145
country_id: 953987
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/news-detail9.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.76.97
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=430640 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.236.20.9
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=465735 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.154.77
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=456483 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.65.14.59
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=147075 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.74.26
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=359598 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.177.102
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=799623 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.249.247
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=762538 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.202.235.251
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/award-she.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.14.181
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=719898 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-29 20:06:20 H=([45.144.212.41]) [45.144.212.41]:63621 F=<info@altayer.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 45.144.212.41 is not allowed to send mail from altayer.com


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.201.108
country_id: 1814991
domain: www.snymetalstamping.com
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.142.132.37
country_id: 2542007
description:
2026-01-29 20:08:07 dovecot_plain authenticator failed for H=(JKJEX) [41.142.132.37]:57630: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.232.70
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=334061 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.91.41
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=31841514876951 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.253.160.3
country_id: 174982
description:
2026-01-29 20:12:41 dovecot_login authenticator failed for H=(ADMIN) [185.253.160.3]:28666: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-29 20:17:14 H=([45.144.212.242]) [45.144.212.242]:53242 F=<lynnied@mhtc.net> rejected RCPT <asttwu@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.68
country_id: 690791
description:
Jan 29 20:17:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.68 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.68
country_id: 690791
description:
Jan 29 20:18:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.64.51.54
country_id: 2921044
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sand/239/296786 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.148
country_id: 1733045
description:
[2026-01-29 20:22:46 +0800] info [webmaild] 161.142.118.148 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.178.186.184
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/css-selector/CssSelectorConverter.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.157.181.217
country_id: 1227603
description:
2026-01-29 20:27:26 dovecot_plain authenticator failed for H=(398XN2FAL8) [175.157.181.217]:21535: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.84.206.208
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17111514876132 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.135.28.205
country_id: 1733045
description:
[2026-01-29 20:28:02 +0800] info [webmaild] 115.135.28.205 - janice@smartcable.com.my "GET /cpsess6785333162/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [118.101.58.238] != Current IP Address [115.135.28.205]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.124.110.97
country_id: 1210997
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-28.103.124.110.97||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.56.216.102
country_id: 3932488
description:
Jan 29 20:29:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.56.216.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 38.56.216.102
country_id: 3932488
description:
2026-01-29 20:29:30 dovecot_plain authenticator failed for H=(P756S1ACH72QLPV) [38.56.216.102]:58776: 535 Incorrect authentication data (set_id=rnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.85.139
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=635255 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.233.20
country_id: 2993457
description:
2026-01-29 20:32:33 dovecot_login authenticator failed for H=(ADMIN) [95.181.233.20]:50093: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.187.23.21
country_id: 272103
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/YtsAnchorAlias.yml HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 45.134.79.70
country_id: 3017382
domain: agpc.org.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.69||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.134.79.70
country_id: 3017382
domain: agpc.org.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wpadminerlzp||User:agpcorg||RSV:7.69||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 45.134.79.70
country_id: 3017382
domain: agpc.org.my
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 45.134.79.70
country_id: 3017382
domain: agpc.org.my
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw||User:agpcorg||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.148
country_id: 1733045
description:
[2026-01-29 20:34:09 +0800] info [webmaild] 161.142.118.148 - s-osada@mckd.com.my "GET /cpsess9880255394/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.90
country_id: 1269750
description:
Jan 29 20:35:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-29 20:35:45 H=([45.144.212.41]) [45.144.212.41]:54277 F=<info@altayer.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 45.144.212.41 is not allowed to send mail from altayer.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.90
country_id: 1269750
description:
Jan 29 20:36:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.90 has been locked due to Imunify RBL


plugin: modsec
rule: 77517934
name: IM360 WAF: Access to PHP file in WCDP uploads blocked (CVE-2025-6440)
abuser: 85.203.23.46
country_id: 1880251
domain: chokeeint.com.my
description:
IM360 WAF: Access to PHP file in WCDP uploads blocked (CVE-2025-6440)||MV:/wp-content/uploads/wcdp-uploads/temp/xxc/stuff/wp-class.php||SC:||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.81.178.241
country_id: 3057568
description:
Jan 29 20:38:56 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.81.178.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.81.178.241
country_id: 3057568
description:
Jan 29 20:39:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.81.178.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.108.178.202
country_id: 1605651
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-tnc.htm HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.153.153
country_id: 1733045
description:
161.142.153.153 - - [29/Jan/2026:20:42:41 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6840941&pdata=https%253A%252F%252Flnlfireprotection.com%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769690560 HTTP/2.0" 302 0 lnlfireprotection.com "https://lnlfireprotection.com:2096/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.153.153


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/img/photos/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 20:42:35 H=([46.151.182.48]) [46.151.182.48]:54070 F=<cpanel@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 20:43:50 H=([46.151.182.48]) [46.151.182.48]:56464 F=<cpanel@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.49.3
country_id: 1562822
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=385699 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.197.224.142
country_id: 798544
description:
Jan 29 20:48:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.197.224.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 20:48:08 H=(localhost.localdomain) [45.150.192.143]:58458 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.243.92.96
country_id: 2510769
description:
Jan 29 20:48:26 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.243.92.96 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 20:50:01 H=([46.151.182.48]) [46.151.182.48]:51141 F=<cpanel@astlog.com.my> rejected RCPT <info@astlog.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/home/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 113.211.214.115
country_id: 1733045
description:
113.211.214.115 - - [29/Jan/2026:20:51:26 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7038099&pdata=https%253A%252F%252Fwww.mckd.com.my%253A2096%252Fcpsess6510113334%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_mbox%253DINBOX&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769691085 HTTP/2.0" 302 0 www.mckd.com.my "https://www.mckd.com.my:2096/cpsess6510113334/3rdparty/roundcube/?_task=mail&_mbox=INBOX" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Mobile Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:113.211.214.115


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.233.164
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=934392 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.208.71.66
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=953052 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.191.230.31
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=89 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 20:57:55 H=([46.151.182.48]) [46.151.182.48]:60629 F=<cpanel@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 20:58:04 H=([46.151.182.48]) [46.151.182.48]:60931 F=<cpanel@ktlog.com.my> rejected RCPT <jaya@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 21:01:54 H=([46.151.182.48]) [46.151.182.48]:51846 F=<cpanel@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.179.185
country_id: 3469034
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/product-detail.php?id=981970 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.225.159
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=994821 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.22.219.221
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27031516696051 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.203.199.16
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12911528706670 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.150.129
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=66031514882640 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.64.207
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25261515046843 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.141.43
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38131516939270 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.64.9
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=96651515046321 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.132.42
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=76&page=2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.170.124.4
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14031515117438 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.37.76
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48061516937912 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.235.58.65
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=96 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.49.143
country_id: 6252001
description:
2026-01-29 21:14:42 dovecot_login authenticator failed for H=(ADMIN) [212.32.49.143]:55796: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.242.167.188
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=80521523525867 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.78.146
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44981514942908 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.208.61
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83971515464163 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.114.170.16
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27001516783287 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.170.145
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32961515570632 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.124.15.77
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=10091518079822 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.224.44.104
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=47 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.241.108
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46351515983516 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.245.252.239
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82641515377202 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.78.177.2
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=77 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.162.199.219
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20771515745061 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.8.175.233
country_id: 3895114
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=75651516002433 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.115.79.116
country_id: 2782113
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=48 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.124.254
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=82021516691258 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.155.131
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45591531898096 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.219.138.73
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40821514530295 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.78.168.112
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95261514886253 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.212.241
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=51 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.231.204
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32501518079664 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.180.88
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30591532150592 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.146.150
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=58 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.225
country_id: 6252001
description:
Jan 29 21:19:37 sv3 pure-ftpd[1876994]: (?@195.184.76.225) [INFO] New connection from 195.184.76.225


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 195.184.76.228
country_id: 6252001
description:
Jan 29 21:19:38 sv3 pure-ftpd[1877001]: (?@195.184.76.228) [INFO] New connection from 195.184.76.228


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.20.123
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97931522745831 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.255.38
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=64&page=2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.37.181.14
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=74&page=3 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.98.213.149
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=41861515569513 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.226
country_id: 3469034
description:
Jan 29 21:21:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.209.243.111
country_id: 3469034
description:
Jan 29 21:22:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.209.243.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.43.109
country_id: 1819730
description:
Jan 29 21:22:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.43.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.43.109
country_id: 1819730
description:
2026-01-29 21:22:29 dovecot_login authenticator failed for H=109.43.246.220.static.netvigator.com [220.246.43.109]:57835: 535 Incorrect authentication data (set_id=sale@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.84.118.205
country_id: 783754
domain: www.nexuscollection.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.nexuscollection.com/products/officechair/pico/pico.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.194
country_id: 1269750
description:
2026-01-29 21:25:23 dovecot_login authenticator failed for H=(nsg-corporate-194.230.187.122.airtel.in) [122.187.230.194]:56265: 535 Incorrect authentication data (set_id=hr@eminent.st)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.213.164
country_id: 2589581
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/ferrous.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.194
country_id: 1269750
description:
Jan 29 21:25:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.241.50
country_id: 1814991
description:
2026-01-29 21:26:30 dovecot_login authenticator failed for H=([218.21.241.50]) [218.21.241.50]:40560: 535 Incorrect authentication data (set_id=sale@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.241.50
country_id: 1814991
description:
Jan 29 21:26:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.241.50 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.161.128
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=186475 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 21:28:48 H=(localhost.localdomain) [45.150.192.143]:36074 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 62.60.131.161
country_id: 130758
domain: www.mssa.org.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.69||T:APACHE||REQUEST_URI:/wp-content/plugins/all-in-one-wp-migration/readme.txt||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.59
country_id: 6252001
description:
2026-01-29 21:30:58 939550 [Warning] Aborted connection 939550 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.59' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.218.83
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=951091 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.73.48.193
country_id: 6252001
domain: www.indfinitydesign.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.30.234.42
country_id: 3469034
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/index-4.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.143
country_id: 1880251
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/style.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/layout.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.220.87.249
country_id: 3469034
domain: acburn.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/acburn.com.my/img/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/m.me/images/home/index.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.248.168.187
country_id: 1831722
description:
Jan 29 21:40:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.248.168.187 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.93.154.30
country_id: 298795
description:
2026-01-29 21:42:27 dovecot_login authenticator failed for H=(213.5.130.98) [91.93.154.30]:36756: 535 Incorrect authentication data (set_id=angie.hng@manforce.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 21:42:28 H=(localhost.localdomain) [45.150.192.143]:47264 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.230.2.69
country_id: 3469034
description:
2026-01-29 21:42:16 dovecot_login authenticator failed for H=(213.5.130.107) [45.230.2.69]:58592: 535 Incorrect authentication data (set_id=azmirah@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.207.56.7
country_id: 1643084
description:
2026-01-29 21:42:22 dovecot_login authenticator failed for H=(213.5.130.98) [203.207.56.7]:40944: 535 Incorrect authentication data (set_id=melissa.lee@manforce.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.248.2
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/house/13/372/1352699 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/img/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.90.74
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99591514856555 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/img/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.202.118.18
country_id: 6252001
description:
Jan 29 21:48:05 sv3 pure-ftpd[1900063]: (?@172.202.118.18) [INFO] New connection from 172.202.118.18


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 21:49:06 H=(localhost.localdomain) [45.150.192.143]:53264 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-29 21:51:47 H=(localhost.localdomain) [78.153.140.207]:43390 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-29 21:51:51 H=([62.60.130.227]) [62.60.130.227]:62939 F=<no-reply@docusign.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from docusign.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.222.211.83
country_id: 1269750
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/penstock-rollergate-stoplog.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.86
country_id: 3175395
description:
2026-01-29 21:57:43 dovecot_login authenticator failed for H=(ADMIN) [156.146.41.86]:55876: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 9.160.72.216
country_id: 2802361
description:
2026-01-29 22:00:36 dovecot_plain authenticator failed for H=(Demli1.ra53xn1pbohedkisi2eyyq2fje.brux.internal.cloudapp.net) [9.160.72.216]:54815: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 9.160.72.216
country_id: 2802361
description:
2026-01-29 22:01:18 dovecot_plain authenticator failed for H=(Demli1.ra53xn1pbohedkisi2eyyq2fje.brux.internal.cloudapp.net) [9.160.72.216]:55532: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.46
country_id: 3469034
description:
Jan 29 22:01:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 29 22:02:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.36
country_id: 1269750
description:
Jan 29 22:03:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 29 22:03:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.78.194
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/creative-service.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.179.151.151
country_id: 1210997
description:
2026-01-29 22:05:26 dovecot_plain authenticator failed for H=(58dm15n3635airqteqcl) [103.179.151.151]:39650: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.49.166
country_id: 1269750
description:
Jan 29 22:07:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.49.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 22:07:10 H=(localhost.localdomain) [45.150.192.143]:39794 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-29 22:07:13 dovecot_login authenticator failed for H=([182.95.21.30]) [182.95.49.166]:60072: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-29 22:08:09 +0800] info [cpaneld] 202.178.120.157 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 22:08:33 H=(localhost.localdomain) [45.150.192.143]:40834 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.193.1
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=524261 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/images/services.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.241.85.136
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-14.192.241.85.136||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77142167
name: IM360 WAF: Block URI containing malicious URLs
abuser: 213.169.194.244
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block URI containing malicious URLs||RSV:7.69||T:APACHE||MVN:ARGS:url||SC:/home2/agsaintifik/public_html/wp-comments-post.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 131.161.217.75
country_id: 3469034
domain: webhosting2u.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:92309.webhosting2u.com||ServerName:webhosting2u.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:92eb058b013b8cb7c08b0b6bf6a61dc171d9ffed||Title:0xaae609a8||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.209
country_id: 6252001
description:
Jan 29 22:21:14 sv3 pure-ftpd[1924103]: (?@162.142.125.209) [INFO] New connection from 162.142.125.209


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.107.165.83
country_id: 783754
description:
Jan 29 22:23:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.107.165.83 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.107.165.83
country_id: 783754
description:
2026-01-29 22:24:01 dovecot_login authenticator failed for H=(213.5.130.153) [95.107.165.83]:38769: 535 Incorrect authentication data (set_id=info@pspoly.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 22:24:21 H=(localhost.localdomain) [45.150.192.143]:53888 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/photos/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.124.35
country_id: 3042225
description:
2026-01-29 22:25:17 dovecot_login authenticator failed for H=(ADMIN) [91.90.124.35]:41121: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.105.216.218
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/video.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-29 22:29:00 H=([91.92.240.254]) [91.92.240.254]:53667 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<sale@generaltradinglite.com> rejected RCPT <enquiry@symphony-led.com>: SPF: 91.92.240.254 is not allowed to send mail from generaltradinglite.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.246.73.70
country_id: 3277605
description:
Jan 29 22:29:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.246.73.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.23.77.82
country_id: 1814991
description:
Jan 29 22:29:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.23.77.82 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.150.97
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=233781 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/photos/contact.php||SC:/home/indfinitydesign/public_html/img/photos/contact.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.183.82.70
country_id: 2017370
description:
Jan 29 22:35:23 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.183.82.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.161.194.100
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/park/16/461/1610779 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.252.89
country_id: 3469034
description:
Jan 29 22:38:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.252.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.39.142.9
country_id: 3469034
description:
Jan 29 22:38:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.39.142.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.194.56
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=20351523583914 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.41.86
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/social_english_course.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.179.15.143
country_id: 1210997
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/toefl_preparation.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.218.194
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/primary_school_english.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.20.84.79
country_id: 3865483
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/cambridge_english.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.68
country_id: 390903
description:
2026-01-29 22:45:54 dovecot_login authenticator failed for H=(ADMIN) [79.127.181.68]:3074: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.249.209
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=602659 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.248.202
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=794941 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-29 22:47:50 H=(localhost.localdomain) [78.153.140.207]:52528 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.180.167.4
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=34 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 134.209.33.159
country_id: 6252001
description:
2026-01-29 22:48:37 941756 [Warning] Aborted connection 941756 to db: 'unconnected' user: 'unauthenticated' host: '134.209.33.159' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.104.223.115
country_id: 3469034
description:
Jan 29 22:48:46 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.104.223.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.80.210
country_id: 1562822
domain: www.inter-link.edu.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.inter-link.edu.my/ielts_preparation.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/portfolio/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.104.223.115
country_id: 3469034
description:
Jan 29 22:49:01 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.104.223.115 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.84.223.253
country_id: 6252001
domain: www.wcc.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.43
country_id: 732800
description:
Jan 29 22:49:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.92.163
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/images/5.jpeg HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-29 22:50:48 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:58802: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.199.116
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=827464 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.149.129.43
country_id: 1694008
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">-accounting books (checking disbursements ,trial balance,&nbsp; adjusted trial balance,ledgers, balancesheet, p&amp; l-finalized for today's management deadline)</span></p>\r\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">-kami_payroll jan 11-25,2026</span></p>\r\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">-monitor angeline for the applicants</span></p>\r\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">-email qne for the exact time of training.&nbsp;</span></p>\r\n<p><span style=\"font-family: 'trebuchet ms', geneva, sans-serif;\">-remind team for the due payments</span></p>||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.103
country_id: 3175395
description:
Jan 29 22:55:25 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.103 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.181.58.24
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/productt.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.221.71
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=359598 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.96.47.89
country_id: 6252001
domain: www.mckd.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/101.0.4950.0 Safari/537.36||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.28.196.68
country_id: 3469034
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/teamwork.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.48.190
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.6.113
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteScatterChart1.xlsx HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.243
country_id: 6252001
description:
2026-01-29 23:07:13 dovecot_plain authenticator failed for H=(DESKTOP-22EVPBQ) [37.19.198.243]:43470: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.159.17
country_id: 2921044
description:
2026-01-29 23:07:17 dovecot_plain authenticator failed for H=(DESKTOP-22EVPBQ) [104.28.159.17]:35039: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.19.198.243
country_id: 6252001
description:
Jan 29 23:07:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.19.198.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.249.76.221
country_id: 1269750
description:
Jan 29 23:08:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.249.76.221 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.249.76.221
country_id: 1269750
description:
2026-01-29 23:09:01 dovecot_login authenticator failed for H=(static-221.76.249.49-tataidc.co.in) [49.249.76.221]:42190: 535 Incorrect authentication data (set_id=amir@essemgroup.net)


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 136.112.244.23
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:7.69||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 136.112.244.23
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.69||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-29 23:10:53 +0800] info [cpaneld] 202.178.120.157 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/photos/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/images/about.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.166.199
country_id: 3865483
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/services.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.189
country_id: 3175395
description:
Jan 29 23:12:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/img/photos/video.php||SC:/home/indfinitydesign/public_html/images/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.6.130.210
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Worksheet/AutoFilter HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.30.166.220
country_id: 1522867
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Worksheet/AutoFilter/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.141
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.150
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/js/glide/css/style.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 113.211.116.177
country_id: 1733045
description:
2026-01-29 23:15:32 H=([100.105.95.110]) [113.211.116.177]:34437 X=TLS1.3:TLS_AES_128_GCM_SHA256:128 F=<kslee@tujusetia.my> A=dovecot_plain:kslee@tujusetia.my rejected RCPT <tania@tujusetia.my>: No such person at this address."


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.215.0.126
country_id: 630336
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.124.126
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=49 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.209.181
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=63491515046145 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.168.123.113
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-21.104.168.123.113||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.28.162.52
country_id: 2921044
description:
2026-01-29 23:21:33 dovecot_plain authenticator failed for H=(DESKTOP-22EVPBQ) [104.28.162.52]:21180: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.143
country_id: 6252001
description:
2026-01-29 23:23:42 942762 [Warning] Aborted connection 942762 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.143' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.248.190.47
country_id: 1831722
description:
Jan 29 23:25:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.248.190.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 23:25:54 H=([46.151.182.48]) [46.151.182.48]:51694 F=<cpanel@fasterget.com.my> rejected RCPT <operation2@fasterget.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.248.190.47
country_id: 1831722
description:
2026-01-29 23:25:56 dovecot_plain authenticator failed for H=(ftgmh2u8p1k6lu2mbkewqzf86d2rtvl) [124.248.190.47]:55084: 535 Incorrect authentication data (set_id=fasya@pftfood.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.5
country_id: 2562770
description:
2026-01-29 23:27:25 dovecot_login authenticator failed for H=(ADMIN) [176.125.230.5]:24937: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.16.20.21
country_id: 953987
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-28.154.16.20.21||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/sitemap.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-29 23:28:36 H=([45.144.212.242]) [45.144.212.242]:53989 F=<lynnied@mhtc.net> rejected RCPT <marina@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.175.96
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=569531 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 60.54.54.52
country_id: 1733045
domain: www.mokshana.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mokshana.com.my/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 23:36:00 H=([46.151.182.48]) [46.151.182.48]:57634 F=<cpanel@ktlog.com.my> rejected RCPT <stacy@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.16
country_id: 2635167
description:
2026-01-29 23:36:26 H=([64.89.160.16]) [64.89.160.16]:49354 F=<AbdullahZida0n003000@outlook.com> rejected RCPT <euratech@euratech.com.my>: SPF: 64.89.160.16 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.16
country_id: 2635167
description:
2026-01-29 23:37:24 H=([64.89.160.16]) [64.89.160.16]:52783 F=<AbdullahZida0n003000@outlook.com> rejected RCPT <mkmadmin@mkmetal.com.my>: SPF: 64.89.160.16 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 23:37:53 H=([46.151.182.48]) [46.151.182.48]:65030 F=<cpanel@empirelog.com.my> rejected RCPT <waynegoh@empirelog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:38:55 dovecot_login authenticator failed for H=(lP8DuhqpJg) [45.154.98.64]:63708: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 23:38:59 H=(localhost.localdomain) [45.150.192.143]:60876 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:39:02 dovecot_login authenticator failed for H=(MnFJNtt0g) [45.154.98.64]:63828: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.153.186
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.69||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/mockery/mockery/docs/getting_started/map.rst.inc||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:40:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:40:09 dovecot_login authenticator failed for H=(hynV8x) [45.154.98.64]:49478: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.73.78.166
country_id: 102358
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=39 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:41:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-29 23:41:22 H=(localhost.localdomain) [78.153.140.207]:56010 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:41:04 dovecot_login authenticator failed for H=(UfKAdzGoZ) [45.154.98.64]:51639: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:42:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:42:17 dovecot_login authenticator failed for H=(MxUUgDAXMV) [45.154.98.64]:54412: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:42:36 dovecot_login authenticator failed for H=(fqQP9v3hrd) [45.154.98.64]:55107: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:43:12 dovecot_login authenticator failed for H=(8OYZLacLB) [45.154.98.64]:56488: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:43:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:44:05 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:44:07 dovecot_login authenticator failed for H=(YfgoP5nBn) [45.154.98.64]:58499: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:45:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:45:02 dovecot_login authenticator failed for H=(UM8FVis) [45.154.98.64]:60573: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:46:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:46:16 dovecot_login authenticator failed for H=(v9nGZepRND) [45.154.98.64]:64892: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.18
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-46.198.145.50.18||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:46:54 dovecot_login authenticator failed for H=(i6Vz7vF2Aj) [45.154.98.64]:50080: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.234.136.31
country_id: 690791
description:
Jan 29 23:47:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.234.136.31 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:47:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:47:13 dovecot_login authenticator failed for H=(vg11WP) [45.154.98.64]:50924: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.86.220
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.86.91
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=286855 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:48:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:48:08 dovecot_login authenticator failed for H=(UfGLIPb) [45.154.98.64]:53412: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/m.me/img/photos/about.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:49:01 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:49:03 dovecot_login authenticator failed for H=(X3sdFu) [45.154.98.64]:55910: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:50:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.114.8
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:50:17 dovecot_login authenticator failed for H=(ECfb59) [45.154.98.64]:59173: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 23:51:10 H=(localhost.localdomain) [45.150.192.143]:42748 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:51:13 dovecot_login authenticator failed for H=(r2i4rYUWD) [45.154.98.64]:61559: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:51:31 dovecot_login authenticator failed for H=(OBXHP2) [45.154.98.64]:62359: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:51:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:52:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:52:08 dovecot_login authenticator failed for H=(UMXzT0) [45.154.98.64]:63964: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:53:01 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:53:03 dovecot_login authenticator failed for H=(XhIH5Nf) [45.154.98.64]:50081: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:54:17 dovecot_login authenticator failed for H=(XKX7dgX3Y2) [45.154.98.64]:53382: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:54:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:55:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:55:12 dovecot_login authenticator failed for H=(HUgopXU) [45.154.98.64]:55740: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:55:30 dovecot_login authenticator failed for H=(Dibe4huO) [45.154.98.64]:56556: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:56:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:56:08 dovecot_login authenticator failed for H=(rLJTK0x) [45.154.98.64]:58027: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 23:56:18 H=([46.151.182.48]) [46.151.182.48]:53314 F=<cpanel@ktlog.com.my> rejected RCPT <cklee@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.61.228.114
country_id: 2077456
description:
2026-01-29 23:56:27 dovecot_login authenticator failed for H=(ADMIN) [179.61.228.114]:40168: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-29 23:56:35 H=([64.89.160.15]) [64.89.160.15]:64046 F=<drdavid00@outlook.com> rejected RCPT <euratech@euratech.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-29 23:56:48 H=(localhost.localdomain) [45.150.192.143]:47594 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.174
country_id: 6252001
description:
2026-01-29 23:56:54 943600 [Warning] Aborted connection 943600 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.174' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.237.125.109
country_id: 6252001
description:
Jan 29 23:56:56 sv3 pure-ftpd[2010776]: (?@135.237.125.109) [INFO] New connection from 135.237.125.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:57:01 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:57:03 dovecot_login authenticator failed for H=(e5s0lkq9) [45.154.98.64]:60534: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:58:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:58:17 dovecot_login authenticator failed for H=(VJV94qD) [45.154.98.64]:63855: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-29 23:58:05 H=([64.89.160.15]) [64.89.160.15]:64138 F=<drdavid00@outlook.com> rejected RCPT <mkmadmin@mkmetal.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 29 23:59:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-29 23:59:14 H=([46.151.182.48]) [46.151.182.48]:64760 F=<cpanel@ktlog.com.my> rejected RCPT <eunice.lee@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:59:49 dovecot_login authenticator failed for H=(W4aj6t) [45.154.98.64]:51594: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-29 23:59:12 dovecot_login authenticator failed for H=(wA24YKzleN) [45.154.98.64]:49940: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.18
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-59.198.145.50.18||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:00:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:00:08 dovecot_login authenticator failed for H=(oTIuVZdV) [45.154.98.64]:52474: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.252.208
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=1353287495 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:01:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:01:02 dovecot_login authenticator failed for H=(ZPN4b9) [45.154.98.64]:54863: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:02:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:02:16 dovecot_login authenticator failed for H=(gH68WbplL) [45.154.98.64]:58154: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-30 00:02:53 H=([45.144.212.242]) [45.144.212.242]:61774 F=<lynnied@mhtc.net> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:03:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:03:10 dovecot_login authenticator failed for H=(ggIk22) [45.154.98.64]:60555: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:04:24 dovecot_login authenticator failed for H=(uuEwqfpJ5) [45.154.98.64]:63844: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.39.200
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/multi-purpose-box-m-sample?tag=multi purpose box - l size HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.245.91
country_id: 953987
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/new-carton-box?product_id=461 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.77.195.101
country_id: 2542007
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/multi-purpose-box-heavy-duty HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.90.39.200
country_id: 3469034
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/multi-purpose-box-m-sample?tag=multi purpose box - l size HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.42.18.73
country_id: 3469034
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/reject-carton-box?product_id=388 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.77.195.101
country_id: 2542007
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/multi-purpose-box-heavy-duty HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:04:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:04:05 dovecot_login authenticator failed for H=(UiRrivheEs) [45.154.98.64]:63027: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.245.91
country_id: 953987
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/new-carton-box?product_id=461 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.42.18.73
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/reject-carton-box?product_id=388 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:05:00 dovecot_login authenticator failed for H=(743pCt9) [45.154.98.64]:65517: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:05:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:06:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:06:14 dovecot_login authenticator failed for H=(z0G5ltwu) [45.154.98.64]:52052: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.23.82.63
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97331515120828 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.43.231.156
country_id: 798544
description:
Jan 30 00:06:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.43.231.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:07:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:07:10 dovecot_login authenticator failed for H=(vCQdp7l) [45.154.98.64]:54360: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:08:24 dovecot_login authenticator failed for H=(a7w1vuh) [45.154.98.64]:57420: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 23.162.113.125
country_id: 6252001
description:
Jan 30 00:08:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 23.162.113.125 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 23.162.113.125
country_id: 6252001
description:
2026-01-30 00:08:32 dovecot_plain authenticator failed for H=(trarous) [23.162.113.125]:48476: 535 Incorrect authentication data (set_id=garylee@autogreastar.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:08:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:08:05 dovecot_login authenticator failed for H=(9Mwma8e) [45.154.98.64]:56677: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:09:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:09:19 dovecot_login authenticator failed for H=(4tRtGr) [45.154.98.64]:59613: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.21.14.97
country_id: 3175395
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-09.82.21.14.97||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.172.106.105
country_id: 1814991
description:
Jan 30 00:09:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.172.106.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.172.106.105
country_id: 1814991
description:
2026-01-30 00:09:12 dovecot_login authenticator failed for H=([112.45.66.28]) [117.172.106.105]:43099: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:10:15 dovecot_login authenticator failed for H=(INryjtJ6qv) [45.154.98.64]:61902: 535 Incorrect authentication data (set_id=cs_jb)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:10:13 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/languages/images/sliders/company.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:11:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:11:09 dovecot_login authenticator failed for H=(QZZxdlECS) [45.154.98.64]:64119: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 00:11:38 H=(localhost.localdomain) [45.150.192.143]:59606 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:12:04 dovecot_login authenticator failed for H=(vTiq9Fk) [45.154.98.64]:50054: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:12:08 dovecot_login authenticator failed for H=(fweRdsQ) [45.154.98.64]:50214: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 00:12:37 H=(localhost.localdomain) [45.150.192.143]:60466 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:12:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:13:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:13:04 dovecot_login authenticator failed for H=(bzyTYE) [45.154.98.64]:52597: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.41
country_id: 690791
description:
2026-01-30 00:13:22 H=([45.144.212.41]) [45.144.212.41]:53226 F=<info@altayer.com> rejected RCPT <shipping@cordage.com.my>: SPF: 45.144.212.41 is not allowed to send mail from altayer.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-30 00:13:48 H=(localhost.localdomain) [78.153.140.207]:32940 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:13:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:14:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:14:12 dovecot_login authenticator failed for H=(g2uCO5e) [45.154.98.64]:55572: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:14:17 dovecot_login authenticator failed for H=(6tFii6N) [45.154.98.64]:55764: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:15:05 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:15:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:15:07 dovecot_login authenticator failed for H=(vHPeF32lxO) [45.154.98.64]:59513: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:16:02 dovecot_login authenticator failed for H=(CHEOPC5e6) [45.154.98.64]:63034: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:16:21 dovecot_login authenticator failed for H=(LWoifDWyzj) [45.154.98.64]:64221: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:16:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:17:02 dovecot_login authenticator failed for H=(lpEyy2GU) [45.154.98.64]:49646: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:17:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:17:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:18:09 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:18:11 dovecot_login authenticator failed for H=(pFpamrc) [45.154.98.64]:52561: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:18:29 dovecot_login authenticator failed for H=(mNFcrCC) [45.154.98.64]:53350: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:19:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:19:06 dovecot_login authenticator failed for H=(Ja1zHZ) [45.154.98.64]:54908: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-30 00:19:24 H=([46.151.182.48]) [46.151.182.48]:60456 F=<cpanel@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:19:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:20:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:19:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:20:01 dovecot_login authenticator failed for H=(rGTIBynPK) [45.154.98.64]:57301: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:20:39 dovecot_login authenticator failed for H=(drfM7hxG) [45.154.98.64]:59165: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:20:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:21:01 dovecot_login authenticator failed for H=(mALFZU) [45.154.98.64]:60281: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:22:51 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:22:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:22:10 dovecot_login authenticator failed for H=(wmHkEJFCB) [45.154.98.64]:63661: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:22:47 dovecot_login authenticator failed for H=(lybSJMg) [45.154.98.64]:65489: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:23:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:23:06 dovecot_login authenticator failed for H=(2a3d0rbmC) [45.154.98.64]:50064: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:24:05 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.184
country_id: 6252001
description:
Jan 30 00:24:27 sv3 pure-ftpd[2035171]: (?@205.210.31.184) [INFO] New connection from 205.210.31.184


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.47.3
country_id: 953987
description:
Jan 30 00:24:53 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.47.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:24:56 dovecot_login authenticator failed for H=(vbFKcIOi) [45.154.98.64]:55568: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:24:01 dovecot_login authenticator failed for H=(HFZHbj3S) [45.154.98.64]:52903: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:25:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:25:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.47.3
country_id: 953987
description:
Jan 30 00:25:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.47.3 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:25:02 dovecot_login authenticator failed for H=(YoGFPP2) [45.154.98.64]:55865: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:26:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:26:10 dovecot_login authenticator failed for H=(ClPjr0DKf) [45.154.98.64]:59406: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:26:20 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/druma_photos/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 00:26:03 H=(localhost.localdomain) [45.150.192.143]:43266 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:27:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:27:06 dovecot_login authenticator failed for H=(zKRFxS24) [45.154.98.64]:62228: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:27:11 dovecot_login authenticator failed for H=(0FsaDttbPl) [45.154.98.64]:62471: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.111.163.135
country_id: 3865483
description:
Jan 30 00:27:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.111.163.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.232.115
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/fabricator-member.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:28:01 dovecot_login authenticator failed for H=(AEaBWU6VF) [45.154.98.64]:65033: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:28:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:28:25 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.247.245.61
country_id: 1835841
description:
2026-01-30 00:29:17 dovecot_login authenticator failed for H=([1.247.245.61]) [1.247.245.61]:57611: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:29:01 dovecot_login authenticator failed for H=(HZ3xUfBB) [45.154.98.64]:51721: 535 Incorrect authentication data (set_id=cs_jb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:29:13 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.247.245.61
country_id: 1835841
description:
Jan 30 00:29:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.247.245.61 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:29:15 dovecot_login authenticator failed for H=(C4H1IQU) [45.154.98.64]:52314: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:30:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:30:10 dovecot_login authenticator failed for H=(RyK4YcTV) [45.154.98.64]:54958: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:30:46 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.154.98.64
country_id: 2750405
description:
Jan 30 00:31:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.154.98.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:31:06 dovecot_login authenticator failed for H=(H1HQ7kTL) [45.154.98.64]:57750: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-30 00:31:38 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:46908: 535 Incorrect authentication data (set_id=info@manforce.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 00:31:53 +0800] info [cpaneld] 202.178.120.157 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 45.154.98.64
country_id: 2750405
description:
2026-01-30 00:31:24 dovecot_login authenticator failed for H=(ccKok6) [45.154.98.64]:58640: 535 Incorrect authentication data (set_id=csl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:31:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.191.79.199
country_id: 337996
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sit/19/534/1963179 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/services.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:33:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:36:20 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:37:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.222.82
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/tel:60358887001 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:39:33 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.190.9
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=6 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:41:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:43:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:45:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:47:31 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.124.133.167
country_id: 2782113
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=508596 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/img/druma_photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:48:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.109
country_id: 6252001
description:
2026-01-30  0:49:48 945254 [Warning] Aborted connection 945254 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.109' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:50:44 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.213.202.184
country_id: 1643084
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/new-title.php?id=921412&title=Thank you Frontliner! HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.215
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.140
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/inspiro-icons92ed.ttf?ijzgpf HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.199
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/css/plugins.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.212
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/css/style.css HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:53:05 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:54:13 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:56:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/contact.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 00:57:59 H=(localhost.localdomain) [45.150.192.143]:44894 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:58:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 00:59:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:01:53 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.18
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-02.198.145.50.18||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:04:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.47.131.196
country_id: 587116
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/var-dumper/CHANGELOG.md HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.147.84.194
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-04.82.147.84.194||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:05:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.205.98
country_id: 3469034
description:
Jan 30 01:05:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.205.98 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 141.95.54.132
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/img/img/img/demos/img/demos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.236.228.245
country_id: 6252001
description:
Jan 30 01:06:37 sv3 pure-ftpd[2066208]: (?@172.236.228.245) [INFO] New connection from 172.236.228.245


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.205.98
country_id: 3469034
description:
Jan 30 01:06:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.205.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.237.24
country_id: 3625428
description:
2026-01-30 01:06:04 dovecot_login authenticator failed for H=(ADMIN) [95.181.237.24]:13843: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.54.18.18
country_id: 2623032
description:
Jan 30 01:06:09 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.54.18.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:07:26 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 01:07:28 +0800] info [cpaneld] 202.178.120.157 - mkmetalc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:09:47 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.87.227
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=558493 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:10:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.184.69.189
country_id: 1814991
description:
Jan 30 01:12:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.184.69.189 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.184.69.189
country_id: 1814991
description:
2026-01-30 01:12:32 dovecot_login authenticator failed for H=(189.69.184.123.broad.sy.ln.dynamic.163data.com.cn) [123.184.69.189]:36049: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.123.104.142
country_id: 1269750
description:
Jan 30 01:12:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.123.104.142 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-30 01:12:09 H=(localhost.localdomain) [78.153.140.207]:48480 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.123.104.142
country_id: 1269750
description:
2026-01-30 01:12:54 dovecot_login authenticator failed for H=([27.123.104.142]) [27.123.104.142]:60778: 535 Incorrect authentication data (set_id=jobstore.comchew)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.208.204.5
country_id: 272103
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/index.php?product_id=403&route=product/product&tag=d010-0004 - rsc printed carton HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:12:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:15:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:16:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.149.43
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/about-us/faq/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:18:34 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 68.183.138.44
country_id: 6252001
description:
2026-01-30  1:19:30 946168 [Warning] Aborted connection 946168 to db: 'unconnected' user: 'unauthenticated' host: '68.183.138.44' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:20:55 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/radiation.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:22:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.135.237.139
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/css-selector/XPath/Translator.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:24:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.141.236
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=7 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.181.232.48
country_id: 2542007
description:
2026-01-30 01:26:49 dovecot_login authenticator failed for H=(ADMIN) [95.181.232.48]:14419: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:26:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:27:34 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.36
country_id: 1269750
description:
2026-01-30 01:29:37 dovecot_login authenticator failed for H=(nsg-corporate-36.229.187.122.airtel.in) [122.187.229.36]:57332: 535 Incorrect authentication data (set_id=hr@figofoods.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:29:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.36
country_id: 1269750
description:
Jan 30 01:29:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.36 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.188.205
country_id: 99237
description:
2026-01-30 01:30:58 dovecot_login authenticator failed for H=(localhost) [65.20.188.205]:55690: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:32:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 01:33:05 H=(localhost.localdomain) [45.150.192.143]:50300 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:33:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.196.14.150
country_id: 3658394
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Document Box/Document Box - 3 Rev 2-500x500.JPG HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:35:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 119.28.110.12
country_id: 1880251
domain: www.oxbold.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.192 Safari/537.36||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 01:37:39 H=(localhost.localdomain) [45.150.192.143]:54746 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:37:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:38:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:40:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:43:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.101.12.164
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/_fixture HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.13.157.180
country_id: 1831722
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/tests/_fixture/ HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:44:13 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:46:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.45
country_id: 3175395
description:
Jan 30 01:46:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.45 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 138.199.24.15
country_id: 1880251
description:
2026-01-30 01:47:34 dovecot_login authenticator failed for H=(ADMIN) [138.199.24.15]:7303: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.137.145
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=23 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:48:38 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.255.187
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=68&page=6 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:49:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 01:51:33 H=(localhost.localdomain) [45.150.192.143]:38638 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:51:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:54:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:55:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-30 01:55:33 H=(localhost.localdomain) [78.153.140.207]:46614 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:57:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.169.7.188
country_id: 272103
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dream/10/284/1008391 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 01:59:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:00:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:02:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.64.33.52
country_id: 1522867
domain: cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cabe.com.my/product-category.php?id=5&sub=24&page_id=3 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:05:14 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:06:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.70.59.14
country_id: 2264397
description:
2026-01-30 02:07:46 dovecot_login authenticator failed for H=(ADMIN) [146.70.59.14]:31399: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:08:26 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/photos/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/fphortier/images/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:10:46 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 02:11:49 H=(localhost.localdomain) [45.150.192.143]:58792 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:11:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.140.76.153
country_id: 3703430
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/employees/show.blade.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:13:59 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 110.25.112.151
country_id: 1668284
description:
Jan 30 02:14:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 110.25.112.151 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 110.25.112.151
country_id: 1668284
description:
2026-01-30 02:14:12 dovecot_login authenticator failed for H=110-25-112-151.adsl.fetnet.net [110.25.112.151]:50920: 535 Incorrect authentication data (set_id=ysl@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.194.128.158
country_id: 1269750
description:
Jan 30 02:14:44 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.194.128.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.194.128.158
country_id: 1269750
description:
2026-01-30 02:14:46 dovecot_login authenticator failed for H=(static-158.128.194.14-tataidc.co.in) [14.194.128.158]:44856: 535 Incorrect authentication data (set_id=ysl)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:16:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 136.60.150.194
country_id: 6252001
description:
Jan 30 02:17:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 136.60.150.194 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 136.60.150.194
country_id: 6252001
description:
2026-01-30 02:17:13 dovecot_login authenticator failed for H=(136-60-150-194.googlefiber.net) [136.60.150.194]:34608: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:17:26 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.250.230.1
country_id: 298795
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/camera/605899 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.214.130
country_id: 99237
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/tyre_safety_tips_tread_wear_indicator.html HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:19:31 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.236.176.91
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dish/12/1243484 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.236
country_id: 2510769
description:
Jan 30 02:20:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:21:51 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 50.235.31.47
country_id: 6252001
description:
Jan 30 02:22:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 50.235.31.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 50.235.31.47
country_id: 6252001
description:
2026-01-30 02:22:23 dovecot_login authenticator failed for H=(netmail.nasmhpd.org) [50.235.31.47]:36210: 535 Incorrect authentication data (set_id=support@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:22:58 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.176.204.214
country_id: 1814991
description:
Jan 30 02:23:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.176.204.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.176.204.214
country_id: 1814991
description:
2026-01-30 02:23:38 dovecot_login authenticator failed for H=([117.176.204.214]) [117.176.204.214]:37861: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:25:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.86.19.229
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=126424 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.141.81
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28091532676614 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-30 02:26:41 H=([45.144.212.242]) [45.144.212.242]:55191 F=<hr@etteharo.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:27:23 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:28:31 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.41.212
country_id: 3175395
description:
2026-01-30 02:29:29 dovecot_login authenticator failed for H=(ADMIN) [156.146.41.212]:1948: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:30:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 02:32:43 H=(localhost.localdomain) [45.150.192.143]:49910 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:32:55 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.105.209.18
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=4&sub=3 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:34:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.15.38.127
country_id: 690791
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-34.185.15.38.127||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.11.115
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/generator/StaticMethodFile.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:36:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:38:29 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:39:37 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:41:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 02:42:12 H=([64.89.160.15]) [64.89.160.15]:61091 F=<drdavid000908090098087890@outlook.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.72.2
country_id: 690791
description:
Jan 30 02:43:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.72.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 147.124.222.151
country_id: 6252001
description:
2026-01-30 02:44:26 H=([147.124.222.151]) [147.124.222.151]:56807 F=<quickbooks@notification.intuit.com> rejected RCPT <ar@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:44:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:45:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:47:16 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:49:37 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:50:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 02:50:21 H=(localhost.localdomain) [45.150.192.143]:39784 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.182.46.154
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=182180 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.125.230.26
country_id: 2562770
description:
2026-01-30 02:51:05 dovecot_login authenticator failed for H=(ADMIN) [176.125.230.26]:52191: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-30 02:51:10 H=([77.83.39.56]) [77.83.39.56]:57065 F=<supply@skyseamarine.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from skyseamarine.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:52:49 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:55:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 220.154.134.114
country_id: 1814991
description:
2026-01-30 02:55:33 H=([220.154.134.114]) [220.154.134.114]:53146 F=<dse_NA2@docusign.net> rejected RCPT <ap@wohcheong.com.my>: Unrouteable address


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:56:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-30 02:58:06 H=([77.83.39.56]) [77.83.39.56]:58624 F=<supply@skyseamarine.com> rejected RCPT <astbtu@astlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from skyseamarine.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 02:58:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:00:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.6.118
country_id: 1814991
domain: www.pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.57.207
country_id: 1814991
domain: www.pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.44.143
country_id: 1814991
domain: www.pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 111.76.46.23
country_id: 1814991
domain: pftfood.com
description:


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 03:01:06 H=([64.89.160.15]) [64.89.160.15]:61802 F=<drdavid000908090098087890@outlook.com> rejected RCPT <sales@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.228.31.148
country_id: 1814991
domain: www.pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.43.188.157
country_id: 1814991
domain: www.pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 117.40.100.185
country_id: 1814991
domain: www.pftfood.com
description:


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:01:53 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 182.96.165.36
country_id: 1814991
domain: www.pftfood.com
description:


plugin: modsec
rule: 77556976
name: IM360 WAF: Malformed URI Open Redirect Probe Detected
abuser: 106.5.168.118
country_id: 1814991
domain: www.pftfood.com
description:


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 03:03:47 H=([45.144.212.50]) [45.144.212.50]:56025 F=<waikeong.poon@seatrium.com> rejected RCPT <celine@ktlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from seatrium.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:03:58 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:06:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 03:07:03 H=(localhost.localdomain) [45.150.192.143]:54854 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.89.104.139
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=78001708731070 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:07:27 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:09:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.16.80
country_id: 2300660
description:
Jan 30 03:10:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.16.80 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.148.240.97
country_id: 3469034
description:
Jan 30 03:11:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.148.240.97 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 03:11:49 H=(localhost.localdomain) [45.150.192.143]:59266 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:11:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:13:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:15:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 147.124.222.151
country_id: 6252001
description:
2026-01-30 03:15:56 H=([147.124.222.151]) [147.124.222.151]:49816 F=<quickbooks@notification.intuit.com> rejected RCPT <ap@astlog.com.my>: No Such User Here


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan 30 03:16:52 sv3 pure-ftpd[2153896]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:17:29 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.81.142.243
country_id: 3996063
description:
2026-01-30 03:17:25 dovecot_login authenticator failed for H=(ADMIN) [77.81.142.243]:16702: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:18:37 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:20:41 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:23:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:24:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.247.171.186
country_id: 1814991
description:
2026-01-30 03:25:53 dovecot_login authenticator failed for H=([218.75.123.109]) [183.247.171.186]:57561: 535 Incorrect authentication data (set_id=msc.einvoice@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.37.151.183
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Event/GetResponseForExceptionEvent.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 03:25:28 H=(localhost.localdomain) [45.150.192.143]:43216 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.247.171.186
country_id: 1814991
description:
Jan 30 03:25:51 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.247.171.186 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:26:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 03:26:18 H=(localhost.localdomain) [45.150.192.143]:44022 F=<info@kapkenya.org> temporarily rejected RCPT <celine@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:28:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.112.200
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=30 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:29:43 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:31:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.121.12.216
country_id: 1210997
description:
2026-01-30 03:32:17 dovecot_plain authenticator failed for H=(L7V1JJ7) [103.121.12.216]:52432: 535 Incorrect authentication data (set_id=prayerlink@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:34:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:35:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:37:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.31.46
country_id: 3017382
description:
2026-01-30 03:39:28 dovecot_login authenticator failed for H=(ADMIN) [191.101.31.46]:25164: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:39:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 117.99.197.158
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:40:53 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:42:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.115
country_id: 3175395
description:
Jan 30 03:44:25 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 03:44:59 H=(localhost.localdomain) [45.150.192.143]:34114 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:45:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:46:26 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 147.124.222.151
country_id: 6252001
description:
2026-01-30 03:47:41 H=([147.124.222.151]) [147.124.222.151]:52763 F=<quickbooks@notification.intuit.com> rejected RCPT <info@astlog.com.my>: SPF: 147.124.222.151 is not allowed to send mail from notification.intuit.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:48:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.147.136.24
country_id: 1831722
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=913632 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:50:51 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:51:58 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:54:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.15.50.124
country_id: 1562822
description:
Jan 30 03:54:35 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.15.50.124 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.15.50.124
country_id: 1562822
description:
2026-01-30 03:54:37 dovecot_plain authenticator failed for H=(0lc4wdhxxlzrf28avv2qkf4w5btnouiz) [103.15.50.124]:43274: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.218
country_id: 6252001
description:
2026-01-30  3:55:32 951607 [Warning] Aborted connection 951607 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.218' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 03:55:54 H=([64.89.160.15]) [64.89.160.15]:59800 F=<drdavid000908090098087890@outlook.com> rejected RCPT <tst@tst-ma.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:56:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:57:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.122.32
country_id: 3042058
description:
2026-01-30 03:59:17 dovecot_login authenticator failed for H=(ADMIN) [91.90.122.32]:8713: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 03:59:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:02:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:03:33 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.5
country_id: 3469034
description:
Jan 30 04:03:44 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.84
country_id: 690791
description:
Jan 30 04:04:41 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:05:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 04:05:59 H=(localhost.localdomain) [45.150.192.143]:53290 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.23.2.160
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=785897 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.9.57
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:08:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.205.135.11
country_id: 2589581
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=611667 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.250.94.65
country_id: 1814991
description:
Jan 30 04:08:43 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.250.94.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.250.94.65
country_id: 1814991
description:
2026-01-30 04:08:45 dovecot_login authenticator failed for H=([114.250.94.65]) [114.250.94.65]:3341: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:09:23 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 153.141.241.44
country_id: 1861060
description:
2026-01-30 04:09:41 dovecot_login authenticator failed for H=p54044-obmd01.osaka.ocn.ne.jp (localhost) [153.141.241.44]:53799: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.196.189.8
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-10.185.196.189.8||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:11:29 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.91.22.47
country_id: 3017382
description:
2026-01-30 04:12:39 dovecot_plain authenticator failed for H=([100.64.100.6]) [45.91.22.47]:5119: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:13:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:14:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:17:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.30
country_id: 6252001
description:
Jan 30 04:17:44 sv3 pure-ftpd[2200343]: (?@147.185.132.30) [INFO] New connection from 147.185.132.30


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.6.216.206
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.227.193.21
country_id: 1814991
description:
Jan 30 04:18:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.227.193.21 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.227.193.21
country_id: 1814991
description:
2026-01-30 04:18:05 dovecot_login authenticator failed for H=([124.227.193.21]) [124.227.193.21]:55113: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 04:19:07 H=([64.89.160.15]) [64.89.160.15]:65332 F=<drdavid000908090098087890@outlook.com> rejected RCPT <janice@smartcable.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 147.124.222.151
country_id: 6252001
description:
2026-01-30 04:19:09 H=([147.124.222.151]) [147.124.222.151]:59588 F=<quickbooks@notification.intuit.com> rejected RCPT <sale@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.75.23.195
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=88 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.107.225.22
country_id: 248816
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/5773924170.jpg&size=1000x1000 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 04:21:27 H=(localhost.localdomain) [45.150.192.143]:41512 F=<info@kapkenya.org> temporarily rejected RCPT <jacklim@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.28.217.71
country_id: 1814991
description:
Jan 30 04:22:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.28.217.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.28.217.71
country_id: 1814991
description:
2026-01-30 04:22:04 dovecot_plain authenticator failed for H=(cm92lrnfj7pugyqwvam) [60.28.217.71]:38383: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.126.53.11
country_id: 1835841
description:
Jan 30 04:23:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.126.53.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.126.53.11
country_id: 1835841
description:
2026-01-30 04:23:21 dovecot_login authenticator failed for H=([168.126.53.11]) [168.126.53.11]:57242: 535 Incorrect authentication data (set_id=admin@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.32.50.224
country_id: 6252001
description:
2026-01-30 04:24:15 dovecot_login authenticator failed for H=(ADMIN) [212.32.50.224]:62395: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:24:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.24
country_id: 3175395
description:
Jan 30 04:26:48 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:26:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.243.222
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=3 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.24
country_id: 3175395
description:
Jan 30 04:27:01 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:28:09 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.23.41.122
country_id: 1269750
description:
Jan 30 04:29:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.23.41.122 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.23.41.122
country_id: 1269750
description:
2026-01-30 04:29:54 dovecot_login authenticator failed for H=([125.23.243.66]) [125.23.41.122]:35570: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:30:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:31:37 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.220
country_id: 1269750
description:
Jan 30 04:33:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:33:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 04:33:53 H=([64.89.160.15]) [64.89.160.15]:49354 F=<drdavid000908090098087890@outlook.com> rejected RCPT <miya@hmz.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.235
country_id: 1269750
description:
Jan 30 04:34:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:36:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:37:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.126.53.11
country_id: 1835841
description:
Jan 30 04:37:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.126.53.11 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.210.57
country_id: 933860
description:
Jan 30 04:38:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.210.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:39:17 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 88.229.54.134
country_id: 298795
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dollar/13/238/1326033 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 04:39:58 H=(localhost.localdomain) [45.150.192.143]:58220 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 04:40:14 +0800] info [cpaneld] 202.178.120.157 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 79.127.181.78
country_id: 390903
description:
2026-01-30 04:41:25 dovecot_login authenticator failed for H=(ADMIN) [79.127.181.78]:65219: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:41:37 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:42:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:44:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 04:44:27 H=([45.144.212.50]) [45.144.212.50]:50484 F=<waikeong.poon@seatrium.com> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from seatrium.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 04:44:28 H=(localhost.localdomain) [45.150.192.143]:34218 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:47:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:48:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:50:23 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.2.35
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.43
country_id: 6252001
description:
Jan 30 04:50:57 sv3 pure-ftpd[2228963]: (?@147.185.132.43) [INFO] New connection from 147.185.132.43


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 147.124.222.151
country_id: 6252001
description:
2026-01-30 04:50:01 H=([147.124.222.151]) [147.124.222.151]:49986 F=<quickbooks@notification.intuit.com> rejected RCPT <sales@astlog.com.my>: SPF: 147.124.222.151 is not allowed to send mail from notification.intuit.com


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-30 04:51:43 +0800] info [cpaneld] 202.178.120.157 - kitty.yap@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:52:43 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.204.23.59
country_id: 6252001
description:
2026-01-30 04:53:27 dovecot_login authenticator failed for H=108-204-23-59.lightspeed.tukrga.sbcglobal.net ([127.0.0.1]) [108.204.23.59]:53180: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:53:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:55:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.112.44.232
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=27 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 04:58:00 H=(localhost.localdomain) [45.150.192.143]:45632 F=<info@kapkenya.org> temporarily rejected RCPT <astpkg@astlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:58:18 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.137.209.162
country_id: 3469034
description:
Jan 30 04:59:19 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.137.209.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 04:59:25 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:01:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 30 05:02:04 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:03:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.244.163.103
country_id: 3489940
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/leave/7/492/766822 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:05:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:07:10 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.176.26.239
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/history.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.209.103
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=24 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.97.34
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=99141514886400 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.73.160.75
country_id: 2186224
description:
Jan 30 05:08:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.73.160.75 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.73.160.75
country_id: 2186224
description:
2026-01-30 05:08:04 dovecot_login authenticator failed for H=([121.73.160.75]) [121.73.160.75]:49668: 535 Incorrect authentication data (set_id=jobstore.comchew@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:09:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:10:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 05:11:46 H=([64.89.160.15]) [64.89.160.15]:55253 F=<drdavid000908090098087890@outlook.com> rejected RCPT <roz@af-sb.com>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:12:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.168.86.6
country_id: 2017370
description:
2026-01-30 05:13:44 dovecot_login authenticator failed for H=([188.168.86.6]) [188.168.86.6]:59464: 535 Incorrect authentication data (set_id=zainuddin@astlog.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.168.86.6
country_id: 2017370
description:
Jan 30 05:13:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.168.86.6 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.243.43
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/gallery.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 05:15:48 H=(localhost.localdomain) [45.150.192.143]:36166 F=<info@kapkenya.org> temporarily rejected RCPT <inquiries@ktlog.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 30 05:15:55 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.77.197
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product.php?category=2K Thinner Series&page=2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:15:06 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 158.140.191.71
country_id: 1643084
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/service-refrigerator HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 113.22.156.7
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-16.113.22.156.7||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.108.228.97
country_id: 3996063
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/about HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:16:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/languages/images/sliders/radioactive.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.224.106
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=5 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:18:20 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.185.81
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/index.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 05:20:22 H=([64.89.160.15]) [64.89.160.15]:60578 F=<drdavid000908090098087890@outlook.com> rejected RCPT <sales@cordage.com.my>: SPF: 64.89.160.15 is not allowed to send mail from outlook.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:20:42 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.130.54
country_id: 3469034
description:
Jan 30 05:21:26 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.130.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.135.159.6
country_id: 3439705
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=263428 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:21:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:23:55 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-30 05:23:56 H=([45.144.212.50]) [45.144.212.50]:53933 F=<zuleyha@savalanshipping.com> rejected RCPT <astmyy@astlog.com.my>: No Such User Here


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 42.114.31.88
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-24.42.114.31.88||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 93.159.184.22
country_id: 798544
description:
Jan 30 05:25:25 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 93.159.184.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.90.126.27
country_id: 3703430
description:
2026-01-30 05:26:49 dovecot_login authenticator failed for H=(ADMIN) [91.90.126.27]:47885: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:26:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:27:23 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.246.238
country_id: 1814991
description:
Jan 30 05:28:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.246.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-30 05:28:13 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:34808: 535 Incorrect authentication data (set_id=info@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.115.33.56
country_id: 3865483
description:
2026-01-30 05:28:28 dovecot_login authenticator failed for H=(localhost) [190.115.33.56]:57946: 535 Incorrect authentication data (set_id=project@tujusetia.my)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.53.181.15
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.36||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:29:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.37.149.154
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/Xmas/411/524732 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:31:50 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-30 05:32:02 H=([45.144.212.242]) [45.144.212.242]:55716 F=<lynnied@mhtc.net> rejected RCPT <zainuddin@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 05:32:23 H=([64.89.160.15]) [64.89.160.15]:55849 F=<essential@mailling.uk> rejected RCPT <sales@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:32:57 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:35:03 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.49.166
country_id: 1269750
description:
Jan 30 05:35:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.49.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-30 05:35:47 dovecot_login authenticator failed for H=([182.95.21.30]) [182.95.49.166]:58058: 535 Incorrect authentication data (set_id=www.facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 139.192.92.144
country_id: 1643084
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=449403 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.165.240
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=264985 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.49.166
country_id: 1269750
description:
Jan 30 05:36:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.49.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.49.166
country_id: 1269750
description:
2026-01-30 05:36:42 dovecot_login authenticator failed for H=([182.95.49.166]) [182.95.49.166]:40758: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:37:23 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.201.242.17
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=621414 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.91.48
country_id: 1562822
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=8429605304 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 05:37:12 H=(localhost.localdomain) [45.150.192.143]:57272 F=<info@kapkenya.org> temporarily rejected RCPT <info@pspoly.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:38:31 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:40:36 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:42:58 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.246.201
country_id: 1562822
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/krisfood.com/certificate.php HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 05:43:28 H=([64.89.160.15]) [64.89.160.15]:59341 F=<essential@mailling.uk> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:44:05 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.106
country_id: 3469034
description:
Jan 30 05:44:12 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:46:11 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:48:32 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.39.67
country_id: 6252001
description:
2026-01-30 05:48:23 dovecot_login authenticator failed for H=(ADMIN) [156.146.39.67]:36934: 535 Incorrect authentication data (set_id=jaya@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.205.107.49
country_id: 6252001
description:
2026-01-30 05:48:29 dovecot_login authenticator failed for H=c-71-205-107-49.hsd1.co.comcast.net ([127.0.0.1]) [71.205.107.49]:50866: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:49:40 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 30 05:49:46 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.39.215
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=69&page=2 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.13
country_id: 2750405
description:
Jan 30 05:51:24 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:51:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.52.83.160
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/street/11/205/1184960 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 147.45.226.36
country_id: 2017370
description:
2026-01-30 05:54:26 dovecot_login authenticator failed for H=(localhost) [147.45.226.36]:55648: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.69||T:APACHE||MV:/index.php/images/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:54:07 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.73.223
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=19 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.136.178
country_id: 1562822
domain: stealthvenom.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/stealthvenom.com/clients/keeheong/upload/index.php?route=common/home HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:55:15 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-01-30 05:55:35 +0800] info [cpaneld] 103.210.132.14 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:57:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.19.198.243
country_id: 6252001
description:
Jan 30 05:57:39 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.19.198.243 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.198.243
country_id: 6252001
description:
2026-01-30 05:57:41 dovecot_plain authenticator failed for H=(DESKTOP-22EVPBQ) [37.19.198.243]:41244: 535 Incorrect authentication data (set_id=info@oxbold.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 05:59:44 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:00:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:03:00 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.25
country_id: 2750405
description:
Jan 30 06:03:52 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:05:21 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:06:28 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:08:33 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 06:09:16 H=(localhost.localdomain) [45.150.192.143]:59678 F=<info@kapkenya.org> temporarily rejected RCPT <cky@ahfengineering.com>: Could not complete sender verify


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 181.215.182.118
country_id: 6252001
description:
2026-01-30 06:10:36 dovecot_login authenticator failed for H=(ADMIN) [181.215.182.118]:51817: 535 Incorrect authentication data (set_id=dsc_team@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 64.89.160.15
country_id: 2635167
description:
2026-01-30 06:10:50 H=([64.89.160.15]) [64.89.160.15]:56496 F=<essential@mailling.uk> rejected RCPT <sales@hmz.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:10:54 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:12:02 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.150.192.143
country_id: 2510769
description:
2026-01-30 06:13:41 H=(localhost.localdomain) [45.150.192.143]:35944 F=<info@kapkenya.org> temporarily rejected RCPT <info@mkmetal.com.my>: Could not complete sender verify


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.152
country_id: 1269750
description:
Jan 30 06:13:45 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.152 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.138.121.165
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/monolog/monolog/doc/04-extending.md HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:14:08 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.135.32.78
country_id: 3439705
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/yaml/Tests/Fixtures/sfTests.yml HTTP/1.1||RSV:7.69||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.85.220
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=708804 HTTP/1.1||RSV:7.69||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:16:30 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:17:38 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 30 06:19:43 sv3 auth[1641938]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.207.196
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=234981 HTTP/1.1||RSV:7.69||T:APACHE||


