# incident

plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.146.42.23
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/FragmentListener.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.81.117.228
country_id: 2963597
description:
Jan 19 20:55:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.81.117.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.81.117.228
country_id: 2963597
description:
2026-01-19 20:55:08 dovecot_plain authenticator failed for H=228-117.cust.westnet.ie (auseersor) [88.81.117.228]:59879: 535 Incorrect authentication data (set_id=webmaster@ajresorts.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.169.110.18
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/sebastian/exporter/phpunit.xml.dist HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.2.82.107
country_id: 3508796
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-column.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.60.218
country_id: 2300660
description:
Jan 19 21:01:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.60.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.81.131.161
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/make/13/434/1385189 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.137.4.117
country_id: 3469034
description:
Jan 19 21:03:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.137.4.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.21
country_id: 798544
description:
Jan 19 21:04:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.175.30
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/AbstractSessionListener.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.196.36.162
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maennchen/zipstream-php/src/File.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-19 21:13:54 H=([77.83.39.106]) [77.83.39.106]:56499 F=<harshit.m@lizindia.com> rejected RCPT <enquiry@ms-chemicals.net>: SPF: 77.83.39.106 is not allowed to send mail from lizindia.com


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.241.150.246
country_id: 2017370
description:
Jan 19 21:16:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.241.150.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-01-19 21:16:26 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:54407: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.8.120.90
country_id: 3469034
description:
Jan 19 21:16:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.8.120.90 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.8.120.90
country_id: 3469034
description:
2026-01-19 21:16:41 dovecot_login authenticator failed for H=(187-8-120-90.customer.tdatabrasil.net.br) [187.8.120.90]:41723: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.75.39.233
country_id: 2542007
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/history.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350312
name: IM360 WAF: Block system file path in request
abuser: 45.138.16.179
country_id: 798544
domain: www.nobledec.com
description:
IM360 WAF: Block system file path in request||MVN:ARGS:id||MV:../../../../../../../../../etc/passwd||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.13
country_id: 3175395
description:
Jan 19 21:22:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.223.251.172
country_id: 2395170
description:
Jan 19 21:22:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.223.251.172 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.153.172
country_id: 1733045
description:
161.142.153.172 - - [19/Jan/2026:21:24:44 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6581608&pdata=https%253A%252F%252Flnlfireprotection.com%253A2096%252Fcpsess3375224826%252F3rdparty%252Froundcube%252F%253F_task%253Dmail%2526_mbox%253DINBOX&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768829083 HTTP/2.0" 302 0 lnlfireprotection.com "https://lnlfireprotection.com:2096/cpsess3375224826/3rdparty/roundcube/?_task=mail&_mbox=INBOX" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:146.0) Gecko/20100101 Firefox/146.0" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.153.172


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.89
country_id: 6251999
description:
2026-01-19 21:26:29 dovecot_plain authenticator failed for H=([10.20.18.132]) [140.228.21.89]:12928: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.21.89
country_id: 6251999
description:
2026-01-19 21:27:03 dovecot_plain authenticator failed for H=([10.20.18.132]) [140.228.21.89]:49116: 535 Incorrect authentication data (set_id=payment@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.73.195.150
country_id: 290557
description:
Jan 19 21:27:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.73.195.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.73.195.150
country_id: 290557
description:
2026-01-19 21:28:01 dovecot_login authenticator failed for H=([91.73.195.150]) [91.73.195.150]:58137: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.153.46
country_id: 1733045
description:
[2026-01-19 21:29:15 +0800] info [webmaild] 161.142.153.46 - csl@lnlfireprotection.com "GET /cpsess8212371595/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=742&_mbox=INBOX&_framed=1&_search=864f0a1b4cb84740ff77486ce8260cd1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [161.142.153.172] != Current IP Address [161.142.153.46]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 161.142.153.46
country_id: 1733045
description:
[2026-01-19 21:29:19 +0800] info [webmaild] 161.142.153.46 - csl@lnlfireprotection.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.23.236.66
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=598204 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.54.80.178
country_id: 1512440
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95111514512466 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.99.58.36
country_id: 2542007
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/tsm-reps-twitch.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.56
country_id: 732800
description:
Jan 19 21:36:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.56 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.201.134.188
country_id: 3469034
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/fairpoint/00.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/demos/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.126.103.19
country_id: 2017370
description:
2026-01-19 21:42:16 H=([176.126.103.19]) [176.126.103.19]:50369 F=<accounts@globalfinancesolutions.com> rejected RCPT <omoba2011@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.251.184
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=56091516783501 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 159.223.104.216
country_id: 6252001
description:
2026-01-19 21:55:46 369569 [Warning] Aborted connection 369569 to db: 'unconnected' user: 'unauthenticated' host: '159.223.104.216' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.210.105.142
country_id: 3175395
description:
2026-01-19 22:08:13 dovecot_login authenticator failed for H=95-210-105-142.ip.skylogicnet.com [95.210.105.142]:46395: 535 Incorrect authentication data


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.111.109
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-09.146.103.111.109||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.57.27.185
country_id: 1643084
description:
Jan 19 22:09:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.57.27.185 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 202.57.27.185
country_id: 1643084
description:
Jan 19 22:09:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 202.57.27.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.53
country_id: 1668284
description:
Jan 19 22:10:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.32.53
country_id: 1668284
description:
Jan 19 22:10:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.32.53 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 160.202.146.168
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nesbot/carbon/src/Carbon/CarbonInterval.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.132.64.251
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/CacheClearer/ChainCacheClearer.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.32.43
country_id: 798544
description:
Jan 19 22:15:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.32.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/osl.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.184.235.198
country_id: 1269750
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/services.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 106.75.190.150
country_id: 1814991
description:
2026-01-19 22:24:11 370629 [Warning] Aborted connection 370629 to db: 'unconnected' user: 'unauthenticated' host: '106.75.190.150' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.19.189
country_id: 99237
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=789818 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.224.89
country_id: 3469034
description:
Jan 19 22:26:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.224.89 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.105.135
country_id: 3865483
description:
Jan 19 22:26:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.105.135 has been locked due to Imunify RBL


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 31.171.152.136
country_id: 783754
domain: visoft.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/contact-from.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.171.152.136
country_id: 783754
domain: visoft.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:22-29.31.171.152.136||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 199.192.123.12
country_id: 6252001
description:
2026-01-19 22:31:00 dovecot_plain authenticator failed for H=(lumpens) [199.192.123.12]:43518: 535 Incorrect authentication data (set_id=peiqin@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 199.192.123.12
country_id: 6252001
description:
Jan 19 22:30:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 199.192.123.12 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.19.218
country_id: 192950
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/css-selector/XPath/TranslatorInterface.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.2.112
country_id: 99237
domain: www.tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tujusetia.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.236.2.112
country_id: 99237
domain: www.tujusetia.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tujusetia.myhttp/www.tujusetia.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 109.254.254.82
country_id: 690791
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207160215.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.67.160.18
country_id: 895949
description:
[2026-01-19 22:37:35 +0800] info [cpaneld] 102.67.160.18 - thinkclo "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user thinkclo (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.188.253.28
country_id: 337996
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207165858.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.67
country_id: 99237
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162406.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.120.1.113
country_id: 3437598
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162746.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.59.214.202
country_id: 3439705
domain: aire-fresh.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aire-fresh.com/jpg/150x70/q-75/ffffff/223/prod/106207162608.gif HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/news.php||SC:/home/sutsbcom/public_html/services||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 62.217.148.252
country_id: 587116
domain: usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/usfood.com.my/index.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.219.135.97
country_id: 3469034
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/product-detail.php?id=772257 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 150.228.105.244
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteBarChart3D1.xlsx HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.171
country_id: 1880251
domain: pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/pspoly.com.my/css/theme-elements.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.4.179.199
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=30571515379569 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.44.16
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/firstSRO.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.103.216.28
country_id: 3469034
domain: www.symphony-led.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.symphony-led.com/products/media-facade/outdoor-led-screen-c1-series/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 93.190.247.48
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-51.93.190.247.48||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.20.247
country_id: 2589581
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=135803 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.237.213
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=755322 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.231.98
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=1&page_id=1&sub=33 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.28
country_id: 798544
description:
Jan 19 22:55:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.28 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.28
country_id: 798544
description:
Jan 19 22:56:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.28 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.181.244.178
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-58.185.181.244.178||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 131.108.18.30
country_id: 3469034
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-58.131.108.18.30||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.171.152.136
country_id: 783754
domain: www.inter-link.edu.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-01.31.171.152.136||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.139.159
country_id: 1733045
description:
[2026-01-19 23:05:25 +0800] info [webmaild] 161.142.139.159 - csl@lnlfireprotection.com "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.171.4.138
country_id: 1733045
description:
Jan 19 23:06:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.171.4.138 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.171.4.138
country_id: 1733045
description:
2026-01-19 23:06:59 dovecot_login authenticator failed for H=([183.171.4.138]) [183.171.4.138]:59934: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 2.133.122.5
country_id: 1522867
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/SimplePie.php||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.228.66.47
country_id: 1269750
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing-details.php?id=92820634 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.97.190.237
country_id: 6252001
description:
Jan 19 23:11:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.97.190.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-19 23:11:32 dovecot_plain authenticator failed for H=(disse) [75.97.190.237]:44074: 535 Incorrect authentication data (set_id=admin@ajresorts.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.203.231.220
country_id: 2464461
description:
Jan 19 23:12:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.203.231.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 196.203.231.220
country_id: 2464461
description:
2026-01-19 23:12:55 dovecot_login authenticator failed for H=([196.203.231.220]) [196.203.231.220]:53430: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.29.140.140
country_id: 1835841
description:
Jan 19 23:13:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.29.140.140 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.29.140.140
country_id: 1835841
description:
2026-01-19 23:13:04 dovecot_login authenticator failed for H=([120.29.140.140]) [120.29.140.140]:55196: 535 Incorrect authentication data (set_id=lutfi@essemgroup.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.72.92.174
country_id: 1814991
description:
Jan 19 23:13:12 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.72.92.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 125.72.92.174
country_id: 1814991
description:
2026-01-19 23:13:14 dovecot_login authenticator failed for H=([125.72.92.174]) [125.72.92.174]:50397: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 119.160.140.113
country_id: 1820814
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-4.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.133.117.35
country_id: 3686110
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industrial.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.168.179.213
country_id: 3865483
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/history.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.120.51.226
country_id: 1269750
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/about.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.137.74.31
country_id: 1210997
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-2.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.144.66.22
country_id: 953987
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-5.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.69.136.51
country_id: 3658394
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/main-banner-0.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.253.119.0
country_id: 953987
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/pe100-prod.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.236.162.77
country_id: 99237
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/abs-con-p3.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.111.172.24
country_id: 1168579
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-11.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.121.74.165
country_id: 3469034
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-9.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.92.10.219
country_id: 3469034
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.185.20.93
country_id: 1269750
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-10.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.221.95.246
country_id: 953987
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-12.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.159.91.11
country_id: 99237
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/career.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 90.154.216.250
country_id: 732800
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/abs-blue-prod.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.36.168.82
country_id: 1269750
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/duraflo-prod.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.43.178.249
country_id: 1269750
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/strataflo-prod.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.35.230.9
country_id: 3996063
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/hdpe-prod.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.159.74.9
country_id: 3469034
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-1-1.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.176.10.133
country_id: 1562822
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/contact.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.239.82.228
country_id: 1210997
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-8.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.110.239.106
country_id: 3437598
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/product.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.11.199
country_id: 1562822
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/k-flo-prod.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.35.189
country_id: 2245662
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/logo.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.59.124.150
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/news-more.php?id=144331 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.177.179.107
country_id: 3996063
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-3.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 129.45.10.161
country_id: 2589581
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-7.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/transportation-radioactive-materials/images/sliders/monthly-report.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.97.180.94
country_id: 3469034
description:
Jan 19 23:16:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.97.180.94 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.92.197
country_id: 1643084
description:
[2026-01-19 23:15:58 +0800] info [cpaneld] 95.135.92.197 - Intercessors@agpc.org.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 75.97.190.237
country_id: 6252001
description:
Jan 19 23:18:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 75.97.190.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 75.97.190.237
country_id: 6252001
description:
2026-01-19 23:18:07 dovecot_plain authenticator failed for H=(aridisor) [75.97.190.237]:60467: 535 Incorrect authentication data (set_id=webmaster@ajresorts.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/team.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.171.152.136
country_id: 783754
domain: plomalite.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:23-22.31.171.152.136||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 19 23:22:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-19 23:22:04 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:56530: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.161.105.12
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45221516779047 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.111.109
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-31.146.103.111.109||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.18.102.154
country_id: 1562822
description:
2026-01-19 23:31:40 dovecot_plain authenticator failed for H=(mckd.com.my) [123.18.102.154]:57142: 535 Incorrect authentication data (set_id=premalata@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.61
country_id: 6252001
description:
2026-01-19 23:35:43 dovecot_plain authenticator failed for H=([10.2.18.212]) [191.96.227.61]:12174: 535 Incorrect authentication data (set_id=vincent.chong@figofoods.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 174.140.11.84
country_id: 102358
description:
2026-01-19 23:35:01 373322 [Warning] Aborted connection 373322 to db: 'unconnected' user: 'unauthenticated' host: '174.140.11.84' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 191.96.227.61
country_id: 6252001
description:
2026-01-19 23:35:57 dovecot_plain authenticator failed for H=([10.2.18.212]) [191.96.227.61]:58966: 535 Incorrect authentication data (set_id=vincent.chong@figofoods.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.171.171.43
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=755322 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.168
country_id: 6252001
description:
2026-01-19 23:36:31 373378 [Warning] Aborted connection 373378 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.168' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.77.197.230
country_id: 3617476
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/2016/04/04/admission-application-and-academic-essays-7/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.77.197.230
country_id: 3617476
domain: tujusetia.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.myhttp/tujusetia.my/2016/04/04/admission-application-and-academic-essays-7/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.163
country_id: 6252001
description:
2026-01-19 23:41:57 373541 [Warning] Aborted connection 373541 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.163' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.132.153.126
country_id: 6252001
description:
2026-01-19 23:41:59 373545 [Warning] Aborted connection 373545 to db: 'unconnected' user: 'unauthenticated' host: '66.132.153.126' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.210.192.43
country_id: 289688
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=1353287495 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.230.74.79
country_id: 1512440
domain: tujusetia.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tujusetia.my/wp-content/uploads/2021/04/tuju-setia-logo-white.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 27.147.204.173
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=49321514945332 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.209.79.139
country_id: 3865483
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2019-Sungai-Layang-WTP-Johor-Malaysia/pipe-connection-sungai-layan-wtp-09.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-19 23:52:34 H=([45.144.212.242]) [45.144.212.242]:51027 F=<no_reply@admin.com> rejected RCPT <enquiry@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.19.216.146
country_id: 6252001
description:
37.19.216.146 - - [19/Jan/2026:23:54:58 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7050438&pdata=https%253A%252F%252Fwww.geminiflourmill.com%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768838091 HTTP/2.0" 302 0 www.geminiflourmill.com "https://www.geminiflourmill.com:2083/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.19.216.146


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 39.42.249.75
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=58861516695402 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.197.157.23
country_id: 357994
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/tall/16/650/1604335 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 00:07:38 H=([45.144.212.242]) [45.144.212.242]:59012 F=<no_reply@admin.com> rejected RCPT <emma@agsaintifik.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 88.81.117.228
country_id: 2963597
description:
Jan 20 00:09:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 88.81.117.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 88.81.117.228
country_id: 2963597
description:
2026-01-20 00:09:25 dovecot_plain authenticator failed for H=228-117.cust.westnet.ie (halozing) [88.81.117.228]:64292: 535 Incorrect authentication data (set_id=salesjb@col.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/images/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 115.135.26.131
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/like/14/651/1487617 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.32.22.218
country_id: 290557
description:
Jan 20 00:14:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.32.22.218 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 171.225.192.147
country_id: 1562822
description:
[2026-01-20 00:15:32 +0800] info [cpaneld] 171.225.192.147 - reseller "GET /login/?login_only=1&user=reseller&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user reseller (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.196
country_id: 1269750
description:
Jan 20 00:16:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.196 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 118.163.145.175
country_id: 1668284
description:
Jan 20 00:16:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 118.163.145.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.193
country_id: 1269750
description:
Jan 20 00:17:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Jan 20 00:17:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.0.21.80
country_id: 3469034
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 112.194.142.167
country_id: 1814991
description:
Jan 20 00:18:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 112.194.142.167 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.190.186.213
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=791633 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.239.129.2
country_id: 1814991
description:
Jan 20 00:21:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.239.129.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.239.129.2
country_id: 1814991
description:
2026-01-20 00:21:58 dovecot_login authenticator failed for H=(2.129.239.124.broad.ts.he.dynamic.163data.com.cn) [124.239.129.2]:49036: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.166.210.209
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2021-Felda-Sabah-Malaysia/penstock-felda-sabah-07.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.178.235.179
country_id: 1562822
domain: www.chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.chs.com.my/images/project-references/2022-Hydrostatic-Valve/ancillary engineering-hydrostatic-valve-02.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 94.202.103.186
country_id: 290557
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product.php?category&page=2 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.182.75.31
country_id: 3469034
domain: maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/maalloys.com.my/index.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.140.200.47
country_id: 2542007
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=32961515570632 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.72
country_id: 3175395
description:
Jan 20 00:41:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.75.87
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-42.92.71.75.87||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.133.72
country_id: 3175395
description:
Jan 20 00:41:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.133.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.75.167
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/recycling.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.196
country_id: 1269750
description:
Jan 20 00:44:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.196 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 223.199.173.221
country_id: 1814991
description:
Jan 20 00:44:25 sv3 pure-ftpd[560460]: (?@223.199.173.221) [INFO] New connection from 223.199.173.221


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.142
country_id: 3469034
description:
Jan 20 00:44:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.142 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.171.152.136
country_id: 783754
domain: solidfence.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-44.31.171.152.136||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 00:46:52 H=([45.144.212.242]) [45.144.212.242]:53962 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.230.243.112
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-47.23.230.243.112||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.18.233
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/EmailValidator.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.210
country_id: 2300660
description:
Jan 20 00:56:21 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.210 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/druma_photos/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.101
country_id: 1269750
description:
Jan 20 00:59:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.101 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.1.86
country_id: 798544
description:
Jan 20 01:00:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.1.86 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.39.54.192
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-00.45.39.54.192||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.101
country_id: 1269750
description:
Jan 20 01:00:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.101 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.96
country_id: 6252001
description:
2026-01-20  1:02:41 376419 [Warning] Aborted connection 376419 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.96' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/company.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.32.156
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/Chart.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.237
country_id: 130758
description:
Jan 20 01:06:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.237
country_id: 130758
description:
2026-01-20 01:06:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.237]:61398: 535 Incorrect authentication data (set_id=norman)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.202.143.28
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/intervention/image/src/Intervention/Image/Imagick HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.153.113.6
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/intervention/image/src/Intervention/Image/Imagick/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/contact.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.75
country_id: 1880251
domain: dynamic-hr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/service.php||SC:/home2/dynamichrcom/public_html/images/service.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.240.196
country_id: 2921044
description:
Jan 20 01:13:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.240.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/contact.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.72.58.242
country_id: 1835841
description:
Jan 20 01:17:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.72.58.242 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 61.72.58.242
country_id: 1835841
description:
2026-01-20 01:17:56 dovecot_login authenticator failed for H=([61.72.58.242]) [61.72.58.242]:40461: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.10.221.104
country_id: 1814991
description:
Jan 20 01:18:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.10.221.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.10.221.104
country_id: 1814991
description:
2026-01-20 01:18:42 dovecot_login authenticator failed for H=([221.10.221.104]) [221.10.221.104]:37803: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 87.103.126.54
country_id: 2264397
description:
2026-01-20 01:19:27 dovecot_plain authenticator failed for H=54.126.103.87.rev.vodafone.pt (pneuting) [87.103.126.54]:43089: 535 Incorrect authentication data (set_id=azakaria.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.103.126.54
country_id: 2264397
description:
Jan 20 01:19:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.103.126.54 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 172.121.190.46
country_id: 1819730
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/6007538754.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.189.160.175
country_id: 1269750
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/exhibition.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.51.128
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-23.198.145.51.128||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 152.52.244.106
country_id: 1269750
description:
Jan 20 01:24:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 152.52.244.106 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 152.52.244.106
country_id: 1269750
description:
2026-01-20 01:24:04 dovecot_login authenticator failed for H=(nsg-corporate-203.184.185.122.airtel.in) [152.52.244.106]:44592: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.11.162.163
country_id: 298795
description:
2026-01-20 01:24:17 dovecot_login authenticator failed for H=([5.11.162.163]) [5.11.162.163]:36455: 535 Incorrect authentication data (set_id=myloo)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.11.162.163
country_id: 298795
description:
Jan 20 01:24:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.11.162.163 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 105.159.187.78
country_id: 2542007
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/example/16/221/1667288 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.186.72.218
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=8 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.95
country_id: 3175395
description:
Jan 20 01:30:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.95 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.127
country_id: 6252001
description:
Jan 20 01:32:18 sv3 pure-ftpd[587665]: (?@162.142.125.127) [INFO] New connection from 162.142.125.127


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/services/survey-meter/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 165.227.131.156
country_id: 2921044
description:
Jan 20 01:35:50 sv3 pure-ftpd[589569]: (?@165.227.131.156) [INFO] New connection from 165.227.131.156


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.88
country_id: 3175395
description:
Jan 20 01:40:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.124.182.88
country_id: 3175395
description:
Jan 20 01:41:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.124.182.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.208.86.33
country_id: 357994
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/index.php?Itemid=151&id=8:prize-award-ceremony-mssacidb-open-ideas-competition-for-students-2017&option=com_phocagallery&view=category HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 161.142.150.183
country_id: 1733045
description:
161.142.150.183 - - [20/Jan/2026:01:42:14 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=13394543&pdata=https%253A%252F%252Fmckd.com.my%253A2096%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1768844533 HTTP/2.0" 302 0 mckd.com.my "https://mckd.com.my:2096/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.2 Mobile/15E148 Safari/604.1" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:161.142.150.183


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.150.183
country_id: 1733045
description:
[2026-01-20 01:42:23 +0800] info [webmaild] 161.142.150.183 - s-osada@mckd.com.my "GET /cpsess5743535516/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D1%2Cwebp%3D1%2Cpgpmime%3D0&_uid=38423&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 01:43:34 H=([45.144.212.242]) [45.144.212.242]:50082 F=<no_reply@admin.com> rejected RCPT <aoto@aoto.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 01:44:00 H=([45.144.212.242]) [45.144.212.242]:60727 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.101.109.99
country_id: 290557
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:01-53.191.101.109.99||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.16.209.97
country_id: 3865483
description:
Jan 20 01:58:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.16.209.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/demos/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/plug/sms/img/img/index.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.75.122
country_id: 690791
description:
Jan 20 02:00:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.75.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/iso.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/fphortier/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/fphortier||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 198.160.165.192
country_id: 99237
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=264985 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.191.33
country_id: 6252001
description:
Jan 20 02:09:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.191.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-01-20 02:09:45 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (oginet) [73.0.191.33]:38404: 535 Incorrect authentication data (set_id=sales@eminent.st)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.44.51.13
country_id: 2017370
description:
Jan 20 02:09:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.44.51.13 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 178.44.51.13
country_id: 2017370
description:
2026-01-20 02:09:06 dovecot_login authenticator failed for H=([178.44.51.13]) [178.44.51.13]:62717: 535 Incorrect authentication data (set_id=boss@astlog.com.my)


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 54.223.81.128
country_id: 1814991
domain: pftfood.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PFFM10 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36 aweme_250000 JsSdk/1.0 NetType/WIFI Channel/31725782a AppName/aweme app_version/25.0.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BULLET/1 BytedanceWebview/d8a21c6 TTWebView/0881130048402||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.222.223.145
country_id: 1814991
domain: www.pftfood.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.55 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.102.122.20
country_id: 2017370
description:
2026-01-20 02:11:05 dovecot_login authenticator failed for H=([94.102.122.20]) [94.102.122.20]:48936: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 84.211.28.249
country_id: 3144096
description:
Jan 20 02:11:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 84.211.28.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.102.122.20
country_id: 2017370
description:
Jan 20 02:11:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.102.122.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.0.191.33
country_id: 6252001
description:
Jan 20 02:11:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.0.191.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.0.191.33
country_id: 6252001
description:
2026-01-20 02:11:07 dovecot_plain authenticator failed for H=c-73-0-191-33.hsd1.fl.comcast.net (oversm) [73.0.191.33]:43226: 535 Incorrect authentication data (set_id=support@ajresorts.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 84.211.28.249
country_id: 3144096
description:
2026-01-20 02:11:41 dovecot_login authenticator failed for H=(cm-84.211.28.249.get.no) [84.211.28.249]:40159: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.196.76.134
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/we/8/342/804764 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 02:12:25 H=([45.144.212.242]) [45.144.212.242]:64469 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/clientele.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 20 02:18:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/demos/img/img/clientele.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 74.218.95.154
country_id: 6252001
description:
Jan 20 02:24:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 74.218.95.154 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 74.218.95.154
country_id: 6252001
description:
2026-01-20 02:24:02 dovecot_login authenticator failed for H=syn-074-218-095-154.biz.spectrum.com [74.218.95.154]:42948: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.144.237
country_id: 2017370
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Others/Plain RSC LxWxH-2-120x120.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.144.237
country_id: 2017370
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Others/Plain RSC LxWxH-2-120x120.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 212.30.36.132
country_id: 2921044
domain: kimmark.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/assets/images/adriv4.php||SC:/home2/kimmark/public_html/assets/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.177.14.102
country_id: 3865483
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/site/images/stories/janmar2012/bocad/3-bocad.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 203.198.173.145
country_id: 1819730
description:
2026-01-20 02:49:06 dovecot_login authenticator failed for H=145.173.198.203.static.netvigator.com [203.198.173.145]:55173: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.229.98.94
country_id: 2510769
description:
Jan 20 02:54:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.229.98.94 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.145.205.147
country_id: 3469034
description:
Jan 20 02:59:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.145.205.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.70
country_id: 2395170
description:
Jan 20 02:59:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.7.70
country_id: 2395170
description:
Jan 20 03:00:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.7.70 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.163.16
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Copyright.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.70.23.240
country_id: 1668284
description:
2026-01-20 03:06:19 dovecot_login authenticator failed for H=111-70-23-240.emome-ip.hinet.net [111.70.23.240]:34244: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.241.44
country_id: 2750405
description:
Jan 20 03:06:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.241.44 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.92.241.44
country_id: 2750405
description:
2026-01-20 03:06:31 dovecot_login authenticator failed for H=(localhost.localdomain) [91.92.241.44]:50663: 535 Incorrect authentication data (set_id=nick.tee@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.70.23.240
country_id: 1668284
description:
Jan 20 03:06:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.70.23.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.126.103.19
country_id: 2017370
description:
2026-01-20 03:10:19 H=([176.126.103.19]) [176.126.103.19]:59313 F=<accounts@globalfinancesolutions.com> rejected RCPT <omoba2011@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/images/sliders/survey-meter.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-20 03:48:47 H=([77.83.39.92]) [77.83.39.92]:61393 F=<yling123456@gmail.com> rejected RCPT <stevenng@fkr.com.my>: Mail to stevenng@fkr.com.my has been suspended


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.171.152.136
country_id: 783754
domain: www.indfinitydesign.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:03-50.31.171.152.136||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.111
country_id: 6252001
description:
2026-01-20  3:53:56 384900 [Warning] Aborted connection 384900 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.111' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 176.126.103.19
country_id: 2017370
description:
2026-01-20 03:54:13 H=([176.126.103.19]) [176.126.103.19]:61781 F=<accounts@globalfinancesolutions.com> rejected RCPT <omoba2011@outlook.com>: SMTP AUTH is required for message submission on port 587


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.110
country_id: 3175395
description:
Jan 20 03:57:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.110
country_id: 3175395
description:
Jan 20 03:58:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.110 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.248.205.90
country_id: 248816
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/grandma/17/515/1797799 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.20.22.90
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/king/243/622353 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.118.225
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-12.89.110.118.225||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.169.212.206
country_id: 1835841
description:
2026-01-20 04:16:37 dovecot_login authenticator failed for H=([211.169.212.206]) [211.169.212.206]:50621: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.24.141.111
country_id: 1814991
description:
Jan 20 04:16:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.24.141.111 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.24.141.111
country_id: 1814991
description:
2026-01-20 04:16:53 dovecot_login authenticator failed for H=([27.24.141.111]) [27.24.141.111]:45630: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.113.138
country_id: 2960313
description:
Jan 20 04:16:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.113.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.169.212.206
country_id: 1835841
description:
Jan 20 04:16:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.169.212.206 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.138
country_id: 2960313
description:
2026-01-20 04:16:36 dovecot_login authenticator failed for H=(JqTnpOF) [37.46.113.138]:33927: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.46.113.138
country_id: 2960313
description:
2026-01-20 04:16:57 dovecot_login authenticator failed for H=(nBZKos) [37.46.113.138]:15299: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.46.113.138
country_id: 2960313
description:
Jan 20 04:16:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.46.113.138 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-17.89.110.123.39||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 207.248.109.245
country_id: 3996063
description:
Jan 20 04:18:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 207.248.109.245 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.54.111.79
country_id: 3439705
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/123 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.135.170.57
country_id: 192950
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/123/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/commercial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 04:23:52 H=([45.144.212.242]) [45.144.212.242]:49174 F=<lynnied@mhtc.net> rejected RCPT <sales@wohcheong.com.my>: Unrouteable address


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.142.27
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-23.109.248.142.27||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.1.109.41
country_id: 99237
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/hotel.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 192.171.82.21
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-27.192.171.82.21||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 04:28:08 H=([45.144.212.242]) [45.144.212.242]:50371 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/languages/images/sliders/cdn-cgi/l/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77093094
abuser: 18.199.241.34
country_id: 2921044
domain: fkr.com.my
description:


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.93.169
country_id: 1643084
description:
[2026-01-20 04:43:01 +0800] info [cpaneld] 95.135.93.169 - kik! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.155
country_id: 3077311
description:
2026-01-20 04:45:59 dovecot_plain authenticator failed for H=([10.25.18.186]) [212.102.39.155]:23748: 535 Incorrect authentication data (set_id=dzulafiq@essemgroup.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 95.135.93.41
country_id: 1643084
description:
[2026-01-20 04:46:16 +0800] info [cpaneld] 95.135.93.41 - KIk! "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid user name specified


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.136.98.180
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/box/8/446/815186 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.155
country_id: 3077311
description:
Jan 20 04:45:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.155 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/img/about.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.217.120.52
country_id: 1269750
description:
Jan 20 05:00:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.217.120.52 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.48
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 86.98.135.177
country_id: 290557
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/33chartcreate-scatter.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.35
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/storage.googleapis.com/tainew_com/v1/img/top/tyresafetytips.php||SC:/home2/fkrcom/public_html/storage.googleapis.com||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 131.221.54.30
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=33301514942242 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-08.89.110.123.39||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.26.65.25
country_id: 298795
description:
2026-01-20 05:08:35 dovecot_plain authenticator failed for H=(gomanon) [5.26.65.25]:52071: 535 Incorrect authentication data (set_id=sales@usfood.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.182.155
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-11.191.102.182.155||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/about-us/images/sliders/career.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.164
country_id: 3469034
description:
Jan 20 05:11:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.164 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/images/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.82.211.14
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ResponseFunctionalTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.56
country_id: 2542007
description:
2026-01-20 05:13:12 dovecot_login authenticator failed for H=([102.53.15.56]) [102.53.15.56]:34909: 535 Incorrect authentication data


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.28.188
country_id: 933860
description:
Jan 20 05:14:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.28.188 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.202.109.179
country_id: 3686110
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/StreamedResponseTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.148.108.30
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/ValidateRequestListener.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 14.102.50.25
country_id: 1269750
description:
2026-01-20 05:14:00 dovecot_login authenticator failed for H=([14.102.50.25]) [14.102.50.25]:44396: 535 Incorrect authentication data (set_id=william_althea@imax.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 14.102.50.25
country_id: 1269750
description:
Jan 20 05:13:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 14.102.50.25 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 20 05:19:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.189.127
country_id: 3469034
description:
Jan 20 05:19:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.189.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 99.162.186.51
country_id: 6252001
description:
2026-01-20 05:22:27 dovecot_login authenticator failed for H=99-162-186-51.lightspeed.frsnca.sbcglobal.net ([127.0.0.1]) [99.162.186.51]:36708: 535 Incorrect authentication data (set_id=info@kimland.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.32.95
country_id: 3996063
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/index.html HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 05:27:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 150.107.106.174
country_id: 1282988
description:
[2026-01-20 05:30:11 +0800] info [whostmgrd] 150.107.106.174 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 63.47.135.250
country_id: 6252001
description:
Jan 20 05:34:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 63.47.135.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 63.47.135.250
country_id: 6252001
description:
2026-01-20 05:34:34 dovecot_login authenticator failed for H=host250.sub-63-47-135.myvzw.com [63.47.135.250]:21021: 535 Incorrect authentication data (set_id=jyteh@mckd.com.my)


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 149.102.233.166
country_id: 3469034
domain: smartcable.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:149.102.233.166||TA:149.102.233.166||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.120.218.136
country_id: 1814991
description:
Jan 20 05:38:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.120.218.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.67.127.47
country_id: 1814991
description:
Jan 20 05:38:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.67.127.47 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.67.127.47
country_id: 1814991
description:
2026-01-20 05:38:34 dovecot_login authenticator failed for H=(YsrD10Dq) [49.67.127.47]:41475: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.121.245.52
country_id: 1814991
description:
2026-01-20 05:38:40 dovecot_login authenticator failed for H=(fvSRRO) [180.121.245.52]:58124: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.79.161.49
country_id: 1814991
description:
Jan 20 05:38:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.79.161.49 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.79.161.49
country_id: 1814991
description:
2026-01-20 05:38:46 dovecot_login authenticator failed for H=(OmHmd8bfG0) [49.79.161.49]:2321: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.231.12.18
country_id: 1814991
description:
2026-01-20 05:38:52 dovecot_login authenticator failed for H=(dbzyYNkpy) [114.231.12.18]:47213: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.120.218.136
country_id: 1814991
description:
2026-01-20 05:38:29 dovecot_login authenticator failed for H=(hCWVmEtL) [180.120.218.136]:10804: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.121.245.52
country_id: 1814991
description:
Jan 20 05:38:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.121.245.52 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.231.12.18
country_id: 1814991
description:
Jan 20 05:38:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.231.12.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 221.227.132.242
country_id: 1814991
description:
Jan 20 05:39:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 221.227.132.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.232.166.103
country_id: 1814991
description:
Jan 20 05:39:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.232.166.103 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.121.250.165
country_id: 1814991
description:
2026-01-20 05:38:58 dovecot_login authenticator failed for H=(gEbPALW5) [180.121.250.165]:6135: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.232.166.103
country_id: 1814991
description:
2026-01-20 05:39:04 dovecot_login authenticator failed for H=(osvYU1uqi) [114.232.166.103]:3876: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 221.227.132.242
country_id: 1814991
description:
2026-01-20 05:39:10 dovecot_login authenticator failed for H=(NTpklql) [221.227.132.242]:36473: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 114.232.61.71
country_id: 1814991
description:
Jan 20 05:39:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 114.232.61.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.232.61.71
country_id: 1814991
description:
2026-01-20 05:39:16 dovecot_login authenticator failed for H=(9ppLLYTi) [114.232.61.71]:45149: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.79.146.19
country_id: 1814991
description:
Jan 20 05:39:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.79.146.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.79.146.19
country_id: 1814991
description:
2026-01-20 05:39:21 dovecot_login authenticator failed for H=(CozxcTBz) [49.79.146.19]:8211: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.121.250.165
country_id: 1814991
description:
Jan 20 05:38:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.121.250.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.121.169.176
country_id: 1814991
description:
2026-01-20 05:39:28 dovecot_login authenticator failed for H=(4QKKd3h) [180.121.169.176]:32481: 535 Incorrect authentication data (set_id=teng)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.121.169.176
country_id: 1814991
description:
Jan 20 05:39:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.121.169.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.224
country_id: 3469034
description:
Jan 20 05:43:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 05:49:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.8.46
country_id: 2300660
description:
Jan 20 05:49:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.8.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.25.219
country_id: 690791
description:
Jan 20 05:50:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.25.219 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.8.46
country_id: 2300660
description:
Jan 20 05:50:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.8.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 05:51:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-20 05:56:12 H=([91.92.240.254]) [91.92.240.254]:60817 F=<6-03-55495suffian@pspoly.com.my> rejected RCPT <6-03-55495suffian@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 91.92.240.254
country_id: 2921044
description:
2026-01-20 06:00:36 H=([91.92.240.254]) [91.92.240.254]:54214 F=<suffian@pspoly.com.my> rejected RCPT <suffian@pspoly.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 132.148.72.41
country_id: 6252001
description:
Jan 20 06:02:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 132.148.72.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.92.68.200
country_id: 732800
description:
Jan 20 06:14:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.92.68.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 20 06:16:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.193.83.170
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-17.185.193.83.170||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 06:18:03 H=([45.144.212.242]) [45.144.212.242]:54892 F=<no_reply@admin.com> rejected RCPT <enquiry@nexuscollection.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.243.19.204
country_id: 3469034
description:
2026-01-20 06:20:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [186.243.19.204]:59242: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.73.20.204
country_id: 3469034
description:
2026-01-20 06:20:24 dovecot_plain authenticator failed for H=([89.116.164.85]) [187.73.20.204]:46478: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.104.227.235
country_id: 3895114
description:
2026-01-20 06:20:40 dovecot_plain authenticator failed for H=186-104-227-235.fo.baf.movistar.cl ([89.116.164.85]) [186.104.227.235]:58862: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 06:20:48 H=([45.144.212.242]) [45.144.212.242]:50728 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.243.19.204
country_id: 3469034
description:
2026-01-20 06:21:03 dovecot_login authenticator failed for H=([89.116.164.85]) [186.243.19.204]:59242: 535 Incorrect authentication data (set_id=info@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.73.205.138
country_id: 3469034
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/mssa/index.php/about/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 06:22:44 H=([45.144.212.242]) [45.144.212.242]:59927 F=<no_reply@admin.com> rejected RCPT <leeyw@fkr.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.164.189
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/mockery/mockery/docs/reference/spies.rst HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 91.210.65.232
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-26.91.210.65.232||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 06:30:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 202.76.138.20
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/sodium_compat/autoload.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.17
country_id: 2750405
description:
Jan 20 06:34:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.212.28.128
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/317365.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.16.190
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/731253.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.211.94.226
country_id: 289688
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/application/themes/bishop/css/all.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.50.45.130
country_id: 2464461
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/894944.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.76.138.197
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/167083.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 43.246.202.29
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/352654.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.74.241.101
country_id: 2542007
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/253294.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.234.190.194
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/475644.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.102.15
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=5 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.224.0.22
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/250043.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.207.22
country_id: 3625428
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/989897.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.172.58.23
country_id: 3625428
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/397880.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.100.12.30
country_id: 2542007
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/865410.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.244.244.199
country_id: 3865483
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/img/photos/389181.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.92
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-49.92.71.74.92||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.98.163
country_id: 3469034
description:
Jan 20 06:51:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.98.163 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.51
country_id: 3175395
description:
Jan 20 06:51:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.51 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 202.76.163.51
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Locator.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.113.112.140
country_id: 3469034
description:
2026-01-20 06:53:07 dovecot_plain authenticator failed for H=([89.116.164.85]) [179.113.112.140]:39738: 535 Incorrect authentication data (set_id=admin@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 06:54:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 06:56:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.62.79.17
country_id: 6252001
domain: chs.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/chs.com.my/images/product-range/Pipe-Repairs/M1160-C-RESTRAINT-T-JOINT.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 77.238.232.202
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-57.77.238.232.202||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.251.139.150
country_id: 1814991
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/movie/12/233/1289410 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.99.67
country_id: 3469034
description:
Jan 20 07:06:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.99.67 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 173.224.125.232
country_id: 6252001
description:
2026-01-20 07:06:49 dovecot_plain authenticator failed for H=static-ip-173-224-125-232.inaddr.ip-pool.com (localhost) [173.224.125.232]:51426: 535 Incorrect authentication data (set_id=info@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.212.174
country_id: 732800
description:
Jan 20 07:07:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.212.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.80
country_id: 6252001
description:
2026-01-20 07:18:05 dovecot_plain authenticator failed for H=([10.23.18.10]) [140.228.24.80]:26853: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 140.228.24.80
country_id: 6252001
description:
2026-01-20 07:18:58 dovecot_plain authenticator failed for H=([10.23.18.10]) [140.228.24.80]:38141: 535 Incorrect authentication data (set_id=admin@agsaintifik.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 177.72.226.122
country_id: 3469034
description:
2026-01-20 07:23:29 dovecot_plain authenticator failed for H=([89.116.164.85]) [177.72.226.122]:11021: 535 Incorrect authentication data (set_id=support@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 76.109.194.31
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/ribbon/7/643/743389 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 07:35:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 46.8.223.89
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-39.46.8.223.89||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 07:39:36 H=([45.144.212.242]) [45.144.212.242]:63521 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/about.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jan 20 07:41:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.201.243
country_id: 3469034
description:
Jan 20 07:44:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.201.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
country_id: 1835841
description:
Jan 20 07:44:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
country_id: 1835841
description:
Jan 20 07:45:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/residential/images/article.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.162.155.182
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Examples/31docproperties_write.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.193
country_id: 1269750
description:
Jan 20 07:47:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.193 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 183.171.69.97
country_id: 1733045
description:
[2026-01-20 07:50:32 +0800] info [webmaild] 183.171.69.97 - payment@tujusetia.my "GET /cpsess6029145737/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [183.171.76.214] != Current IP Address [183.171.69.97]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.90.118.141
country_id: 2328926
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/violin/369/560803 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.125.121
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.76.210.200
country_id: 2802361
description:
2026-01-20  7:54:08 395247 [Warning] Aborted connection 395247 to db: 'unconnected' user: 'unauthenticated' host: '34.76.210.200' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.164.126.218
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/hundred/265/399760 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 08:01:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 08:01:45 H=([45.144.212.242]) [45.144.212.242]:60248 F=<no_reply@admin.com> rejected RCPT <sales@acburn.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 08:02:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.123.101.181
country_id: 3437598
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/http-foundation/Tests/RequestTest.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 20 08:06:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.118.225
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-07.89.110.118.225||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-20 08:09:42 +0800] info [webmaild] 180.75.72.60 - regalacc@smartcable.com.my "GET /skins/elastic/images/favicon.ico?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.40.195.172
country_id: 1814991
description:
Jan 20 08:09:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.40.195.172 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.40.195.172
country_id: 1814991
description:
2026-01-20 08:09:48 dovecot_login authenticator failed for H=(iZbp1bb19cfy2bhxh45ximZ) [121.40.195.172]:60352: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 121.40.195.172
country_id: 1814991
description:
2026-01-20 08:09:58 dovecot_login authenticator failed for H=(iZbp1bb19cfy2bhxh45ximZ) [121.40.195.172]:54960: 535 Incorrect authentication data (set_id=eeyh@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 121.40.195.172
country_id: 1814991
description:
Jan 20 08:10:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 121.40.195.172 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.209
country_id: 6252001
description:
2026-01-20  8:10:43 395872 [Warning] Aborted connection 395872 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.209' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 158.181.19.144
country_id: 1527747
description:
Jan 20 08:12:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 158.181.19.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 158.181.19.144
country_id: 1527747
description:
2026-01-20 08:12:09 dovecot_login authenticator failed for H=(158.181.19.144.mega.kg) [158.181.19.144]:39590: 535 Incorrect authentication data (set_id=bptioh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.107.102.154
country_id: 1269750
description:
Jan 20 08:13:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.107.102.154 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.202.157.173
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-13.185.202.157.173||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.107.102.154
country_id: 1269750
description:
2026-01-20 08:13:52 dovecot_login authenticator failed for H=(static-154.102.107.27-tataidc.co.in) [27.107.102.154]:48054: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/home/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.225.188.105
country_id: 2510769
description:
2026-01-20 08:19:40 dovecot_login authenticator failed for H=([5.225.188.105]) [5.225.188.105]:36439: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.225.188.105
country_id: 2510769
description:
Jan 20 08:19:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.225.188.105 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 08:19:49 H=([45.144.212.242]) [45.144.212.242]:62592 F=<no_reply@admin.com> rejected RCPT <ang@aircarbonic.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.225.27.243
country_id: 2017370
description:
2026-01-20 08:22:04 dovecot_plain authenticator failed for H=([89.116.164.85]) [109.225.27.243]:45678: 535 Incorrect authentication data (set_id=marketing@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 08:25:12 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64861: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.16
country_id: 2750405
description:
Jan 20 08:25:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.16 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 08:26:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52049: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.15.244.203
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/brush/14/374/1427643 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-20 08:27:04 +0800] info [webmaild] 180.75.72.60 - pr@smartcable.com.my "GET /cpsess9084765842/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 08:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:52521: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-20 08:31:52 +0800] info [webmaild] 219.95.228.51 - info@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 08:32:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:64048: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.82.108.129
country_id: 1733045
description:
[2026-01-20 08:33:03 +0800] info [webmaild] 124.82.108.129 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 08:35:47 H=([45.144.212.242]) [45.144.212.242]:60734 F=<no_reply@admin.com> rejected RCPT <astbki@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.206.245.191
country_id: 798544
description:
Jan 20 08:35:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.206.245.191 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.192.87.25
country_id: 3469034
domain: euratech.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/euratech.com.my/img/industry-6.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 08:36:00 H=([45.144.212.242]) [45.144.212.242]:56402 F=<no_reply@admin.com> rejected RCPT <asttwu@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.109
country_id: 3175395
description:
Jan 20 08:36:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.109 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.109
country_id: 3175395
description:
Jan 20 08:36:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.109 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/img/photos/img/photos/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 08:40:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62623: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 08:40:27 H=([46.151.182.48]) [46.151.182.48]:59864 F=<cklee@ktlog.com.my> rejected RCPT <cklee@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 08:41:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.35.115
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=11 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.142.119.17
country_id: 1733045
description:
[2026-01-20 08:52:47 +0800] info [webmaild] 175.142.119.17 - admin@pftfood.com "GET /cpsess0297360586/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.118.225
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-53.89.110.118.225||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/images/press.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 08:56:44 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62800: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-20 08:56:56 +0800] info [webmaild] 175.144.229.115 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 08:57:02 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62804: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/druma/press.php||SC:/home/indfinitydesign/public_html/images/druma||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.165
country_id: 798544
description:
Jan 20 09:02:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.165 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.105.141.165
country_id: 798544
description:
Jan 20 09:03:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.105.141.165 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 09:03:38 H=([45.144.212.242]) [45.144.212.242]:49476 F=<no_reply@admin.com> rejected RCPT <boss@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.159.210.193
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/finder/Tests/Fixtures/one/a HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-20 09:04:30 H=([185.214.10.21]) [185.214.10.21]:53850 F=<info@oxbold.com> rejected RCPT <info@oxbold.com>: smtp auth required


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 185.214.10.21
country_id: 2750405
description:
2026-01-20 09:06:25 H=([185.214.10.21]) [185.214.10.21]:53470 F=<info@ktlog.com.my> rejected RCPT <marylinkoh@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 175.144.229.115
country_id: 1733045
description:
[2026-01-20 09:07:17 +0800] info [webmaild] 175.144.229.115 - claimservice@evergrown.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.233.178.216
country_id: 2017370
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/Candy Box/Candy - Open-150x150.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.233.178.216
country_id: 2017370
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/Candy Box/Candy - Open-150x150.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 09:09:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 09:10:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.223.46
country_id: 1269750
description:
Jan 20 09:11:41 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.223.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.2
country_id: 1814991
description:
Jan 20 09:11:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.2 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.2
country_id: 1814991
description:
2026-01-20 09:11:11 dovecot_login authenticator failed for H=([111.61.177.2]) [111.61.177.2]:22740: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-20 09:11:43 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:41602: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 46.246.92.216
country_id: 2661886
domain: manforce.net
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.46 (KHTML, like Gecko) Mobile Safari/337.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.22
country_id: 3469034
description:
Jan 20 09:13:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-16.89.110.123.39||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 70.92.224.230
country_id: 6252001
domain: oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/oxbold.com/ninebottourskualalumpur-tnc.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 09:17:26 H=([45.144.212.242]) [45.144.212.242]:56727 F=<no_reply@admin.com> rejected RCPT <carol@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.177.190
country_id: 1814991
description:
Jan 20 09:17:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.177.190 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.177.190
country_id: 1814991
description:
2026-01-20 09:17:46 dovecot_login authenticator failed for H=([111.61.177.190]) [111.61.177.190]:57106: 535 Incorrect authentication data (set_id=shinwen.ong@tujusetia.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 09:18:19 sv3 pure-ftpd[917694]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 09:18:21 sv3 pure-ftpd[917694]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 09:18:43 sv3 pure-ftpd[917694]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/Inactive_Customer_A_n_B/images/1.jpg


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 09:19:11 sv3 pure-ftpd[918748]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.208.150.239
country_id: 6252001
domain: www.manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/121.0.6167.85 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.233.21.109
country_id: 272103
description:
2026-01-20 09:19:07 dovecot_login authenticator failed for H=([109.233.21.109]) [109.233.21.109]:50724: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.100.43.185
country_id: 6251999
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/brown/728/644211 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 09:19:26 sv3 pure-ftpd[919064]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 09:19:38 sv3 pure-ftpd[919625]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/merge267/premier_edm.html uploaded  (75855 bytes, 516.09KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.233.21.109
country_id: 272103
description:
Jan 20 09:19:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.233.21.109 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 114.10.42.223
country_id: 1643084
description:
2026-01-20 09:20:20 dovecot_plain authenticator failed for H=([89.116.164.85]) [114.10.42.223]:63475: 535 Incorrect authentication data (set_id=contato@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.38.1.125
country_id: 290557
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/rice/19/480/1994079 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 09:23:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 09:25:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:62930: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 09:26:59 H=([46.151.182.48]) [46.151.182.48]:64719 F=<eunice.lee@ktlog.com.my> rejected RCPT <eunice.lee@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.223.46
country_id: 1269750
description:
Jan 20 09:27:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.223.46 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.223.46
country_id: 1269750
description:
2026-01-20 09:27:17 dovecot_login authenticator failed for H=([182.95.223.46]) [182.95.223.46]:39908: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 09:30:21 H=([45.144.212.242]) [45.144.212.242]:53207 F=<no_reply@admin.com> rejected RCPT <chloe@ms-chemicals.net>: Sender verify failed


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.70.147
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-32.142.111.70.147||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.148
country_id: 1269750
description:
Jan 20 09:34:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.148 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.2
country_id: 3175395
description:
Jan 20 09:35:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.58.115.148
country_id: 1269750
description:
Jan 20 09:35:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.58.115.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 09:35:16 H=([45.144.212.242]) [45.144.212.242]:57841 F=<no_reply@admin.com> rejected RCPT <cklee@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.92.247.166
country_id: 3469034
description:
Jan 20 09:35:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.92.247.166 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.70.96.26
country_id: 927384
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/news.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.72.118
country_id: 1733045
description:
[2026-01-20 09:36:14 +0800] info [webmaild] 115.164.72.118 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [175.139.178.45] != Current IP Address [115.164.72.118]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.26.169
country_id: 3469034
description:
Jan 20 09:36:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.26.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-01-20 09:37:27 dovecot_login authenticator failed for H=(YPf3aSwb) [77.83.39.164]:59133: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.129.232.94
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-37.45.129.232.94||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.164
country_id: 690791
description:
Jan 20 09:37:25 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.164 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.164
country_id: 690791
description:
Jan 20 09:37:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-01-20 09:38:00 dovecot_login authenticator failed for H=(qciYFYs) [77.83.39.164]:55965: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.164
country_id: 690791
description:
Jan 20 09:38:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-01-20 09:39:01 dovecot_login authenticator failed for H=(K31bHP) [77.83.39.164]:52224: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.252
country_id: 1269750
description:
Jan 20 09:39:52 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.252 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-01-20 09:39:58 dovecot_login authenticator failed for H=(YbloSaPQPV) [77.83.39.164]:54590: 535 Incorrect authentication data (set_id=jb-sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.252
country_id: 1269750
description:
Jan 20 09:39:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.164
country_id: 690791
description:
Jan 20 09:39:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.164
country_id: 690791
description:
2026-01-20 09:39:58 dovecot_login authenticator failed for H=(pWTvUPe) [77.83.39.164]:54832: 535 Incorrect authentication data (set_id=png-sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.164
country_id: 690791
description:
Jan 20 09:40:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.164 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.164
country_id: 690791
description:
2026-01-20 09:40:58 dovecot_login authenticator failed for H=(kRWES7m) [77.83.39.164]:51925: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 09:43:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 1.250.67.114
country_id: 1835841
description:
Jan 20 09:43:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 1.250.67.114 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.250.67.114
country_id: 1835841
description:
2026-01-20 09:43:44 dovecot_login authenticator failed for H=([1.250.67.114]) [1.250.67.114]:34864: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.0.234.187
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/src/Psy/Input HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.162.3.106
country_id: 1282988
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/psy/psysh/src/Psy/Input/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.171.98.175
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-44.185.171.98.175||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-20 09:45:46 H=(localhost.localdomain) [78.153.140.207]:40338 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 09:46:44 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:65058: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.152.76.65
country_id: 3469034
description:
Jan 20 09:46:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.152.76.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77166413
name: IM360 WAF: The Events Calendar - Potential SQL Injection in order parameter (CVE-2024-8275)
abuser: 185.209.196.188
country_id: 2921044
domain: www.box.com.my
description:
IM360 WAF: The Events Calendar - Potential SQL Injection in order parameter (CVE-2024-8275)||MV:asc'||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 09:49:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.48.116.12
country_id: 6252001
description:
2026-01-20 09:49:54 dovecot_plain authenticator failed for H=([89.116.164.85]) [67.48.116.12]:52387: 535 Incorrect authentication data (set_id=contacto@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.48.116.12
country_id: 6252001
description:
2026-01-20 09:50:01 dovecot_login authenticator failed for H=([89.116.164.85]) [67.48.116.12]:52387: 535 Incorrect authentication data (set_id=contacto@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 09:50:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:59256: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 09:51:08 H=([45.144.212.242]) [45.144.212.242]:62581 F=<no_reply@admin.com> rejected RCPT <csjb2@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 09:52:52 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:59320: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 09:52:58 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:59320: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 09:53:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:63040: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.154.220
country_id: 3865483
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/girl/18/1802212 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.22.238.50
country_id: 3865483
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/MongoCaster.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 09:55:39 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:54203: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-20 10:00:06 H=([127.0.0.1]) [103.197.57.71]:50456 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 10:03:32 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 89.110.123.39
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-04.89.110.123.39||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 10:06:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:54254: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.201
country_id: 6252001
description:
Jan 20 10:07:35 sv3 pure-ftpd[1022846]: (?@198.235.24.201) [INFO] New connection from 198.235.24.201


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 220.167.233.156
country_id: 1814991
description:
Jan 20 10:11:41 sv3 pure-ftpd[1029833]: (?@220.167.233.156) [INFO] New connection from 220.167.233.156


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 10:13:24 H=([46.151.182.48]) [46.151.182.48]:62606 F=<info@astlog.com.my> rejected RCPT <info@astlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 10:17:53 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:18:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:18:33 dovecot_login authenticator failed for H=(qVh9loea) [137.220.199.220]:54900: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.77.211.39
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/img/photos/about.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:19:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:19:09 dovecot_login authenticator failed for H=(RjC6f1) [137.220.199.220]:55767: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 145.239.83.37
country_id: 798544
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/img/demos/img/img/photos/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 218.22.187.66
country_id: 1814991
description:
Jan 20 10:19:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 218.22.187.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:20:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.147.191.144
country_id: 1210997
description:
2026-01-20 10:20:37 dovecot_plain authenticator failed for H=([89.116.164.85]) [27.147.191.144]:34982: 535 Incorrect authentication data (set_id=customerservice@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:20:03 dovecot_login authenticator failed for H=(nRtKKXCj4f) [137.220.199.220]:59100: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 10:20:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.217.3.232
country_id: 2017370
description:
2026-01-20 10:20:23 dovecot_plain authenticator failed for H=([89.116.164.85]) [91.217.3.232]:1487: 535 Incorrect authentication data (set_id=customerservice@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.163.182.177
country_id: 1282988
description:
2026-01-20 10:20:48 dovecot_plain authenticator failed for H=([89.116.164.85]) [103.163.182.177]:56020: 535 Incorrect authentication data (set_id=customerservice@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:20:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:21:00 dovecot_login authenticator failed for H=(02tQEbDc1C) [137.220.199.220]:63054: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 10:21:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:56903: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:21:11 dovecot_login authenticator failed for H=(6IElLagfj) [137.220.199.220]:63436: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:21:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:21:58 dovecot_login authenticator failed for H=(NG2PZ73qHD) [137.220.199.220]:65028: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:23:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:23:09 dovecot_login authenticator failed for H=(uVnC3hVAh) [137.220.199.220]:52262: 535 Incorrect authentication data (set_id=sales)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/demos/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 10:23:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.172.227.41
country_id: 3865483
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/clients.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:24:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 10:24:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:49171: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:24:03 dovecot_login authenticator failed for H=(kDv8d2AS) [137.220.199.220]:55408: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:24:29 dovecot_login authenticator failed for H=(04tQCRNKHr) [137.220.199.220]:57610: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:25:05 dovecot_login authenticator failed for H=(vOY9pw5PMS) [137.220.199.220]:58647: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 10:25:46 H=([45.144.212.242]) [45.144.212.242]:50514 F=<no_reply@admin.com> rejected RCPT <aoto@aoto.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:25:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:25:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 10:26:11 H=([45.144.212.242]) [45.144.212.242]:51264 F=<no_reply@admin.com> rejected RCPT <info@aire-fresh.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:25:58 dovecot_login authenticator failed for H=(eOlLnb95zA) [137.220.199.220]:61235: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.59.8.106
country_id: 1668284
description:
2026-01-20 10:27:07 dovecot_login authenticator failed for H=116-59-8-106.emome-ip.hinet.net [116.59.8.106]:42653: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:27:09 dovecot_login authenticator failed for H=(To6JGmTT14) [137.220.199.220]:64746: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:27:51 dovecot_login authenticator failed for H=(ePTnvTEp) [137.220.199.220]:51388: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.59.8.106
country_id: 1668284
description:
Jan 20 10:27:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.59.8.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:27:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:27:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:28:00 dovecot_login authenticator failed for H=(xGTkBp8B) [137.220.199.220]:51648: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:29:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:29:05 dovecot_login authenticator failed for H=(UrEYWH) [137.220.199.220]:54313: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:29:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:29:59 dovecot_login authenticator failed for H=(LYcP9bAoJt) [137.220.199.220]:57574: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:31:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:31:10 dovecot_login authenticator failed for H=(z499Ox5j9P) [137.220.199.220]:61215: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:31:13 dovecot_login authenticator failed for H=(jwrB8e) [137.220.199.220]:61966: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:32:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:32:12 dovecot_login authenticator failed for H=(SRPqal35z) [137.220.199.220]:64339: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:33:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:33:05 dovecot_login authenticator failed for H=(0YKCsEHYJ) [137.220.199.220]:50628: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:33:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:33:59 dovecot_login authenticator failed for H=(oOqBBnCB8) [137.220.199.220]:53220: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:34:35 dovecot_login authenticator failed for H=(q0wNhEjvO) [137.220.199.220]:55099: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:34:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:35:01 dovecot_login authenticator failed for H=(zC3ZgMGgh) [137.220.199.220]:56874: 535 Incorrect authentication data (set_id=sales@mckd.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.132.153.119
country_id: 6252001
description:
2026-01-20 10:35:45 403089 [Warning] Aborted connection 403089 to db: 'unconnected' user: 'unauthenticated' host: '66.132.153.119' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:36:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:36:12 dovecot_login authenticator failed for H=(FT11CWMv) [137.220.199.220]:60142: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-20 10:36:57 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess6825531216/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:37:41 dovecot_login authenticator failed for H=(HD0BpC) [137.220.199.220]:65057: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:37:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:37:06 dovecot_login authenticator failed for H=(HWubFqw2h4) [137.220.199.220]:63011: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-20 10:38:48 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess5760788743/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 137.220.199.220
country_id: 1861060
description:
2026-01-20 10:37:59 dovecot_login authenticator failed for H=(3MoUEGsT9) [137.220.199.220]:49615: 535 Incorrect authentication data (set_id=sales)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 137.220.199.220
country_id: 1861060
description:
Jan 20 10:37:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 137.220.199.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-20 10:39:48 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess5760788743/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.213.29.15
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-41.216.213.29.15||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.32.167
country_id: 3865483
description:
Jan 20 10:42:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.32.167 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 10:43:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 115.164.72.118
country_id: 1733045
description:
[2026-01-20 10:44:09 +0800] info [webmaild] 115.164.72.118 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 10:44:20 H=([45.144.212.242]) [45.144.212.242]:53818 F=<no_reply@admin.com> rejected RCPT <hooishian@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 161.29.248.59
country_id: 2186224
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/present/701/161135 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 10:49:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57001: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.26.53.222
country_id: 3469034
description:
2026-01-20 10:52:48 dovecot_plain authenticator failed for H=189.26.53.222.dynamic.adsl.gvt.net.br ([89.116.164.85]) [189.26.53.222]:52020: 535 Incorrect authentication data (set_id=financeiro@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 200.24.133.26
country_id: 3658394
description:
2026-01-20 10:52:33 dovecot_plain authenticator failed for H=([89.116.164.85]) [200.24.133.26]:21017: 535 Incorrect authentication data (set_id=financeiro@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.159.174.0
country_id: 2017370
description:
2026-01-20 10:53:02 dovecot_plain authenticator failed for H=([89.116.164.85]) [185.159.174.0]:33800: 535 Incorrect authentication data (set_id=financeiro@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.74
country_id: 1733045
description:
[2026-01-20 10:53:13 +0800] info [webmaild] 27.125.243.74 - jlpom@ajplantations.com.my "GET /cpsess0289770686/3rdparty/roundcube/?_task=mail&_action=getunread&_page=1&_remote=1&_unlock=0&_=1768877591942 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.154] != Current IP Address [27.125.243.74]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.95.14.161
country_id: 6252001
description:
2026-01-20 10:53:52 dovecot_login authenticator failed for H=([127.0.0.1]) [71.95.14.161]:35400: 535 Incorrect authentication data (set_id=info@dps-comsec.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 10:54:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:55151: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 10:56:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.51.86
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-57.166.0.51.86||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.237.244.47
country_id: 3686110
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/storm/90/168631 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 11:00:18 H=([45.144.212.242]) [45.144.212.242]:60310 F=<no_reply@admin.com> rejected RCPT <info@aircarbonic.my>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: pspoly.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/122.0.6261.94 Safari/537.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.128.144.45
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/vacation/637/341909 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.53.53.26
country_id: 1733045
description:
[2026-01-20 11:02:14 +0800] info [webmaild] 60.53.53.26 - sge@ajplantations.com.my "POST /cpsess2558836044/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [60.48.37.143] != Current IP Address [60.53.53.26]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-20 11:02:49 H=([45.144.212.54]) [45.144.212.54]:65391 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 11:04:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 11:04:18 H=([45.144.212.242]) [45.144.212.242]:60122 F=<no_reply@admin.com> rejected RCPT <info@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-20 11:09:01 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess8085054164/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-20 11:10:01 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess8085054164/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-20 11:10:35 H=([45.144.212.54]) [45.144.212.54]:61998 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 136.0.202.54
country_id: 2635167
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-10.136.0.202.54||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.73.59.60
country_id: 1562822
description:
2026-01-20 11:11:01 dovecot_login authenticator failed for H=([27.73.59.60]) [27.73.59.60]:60415: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-20 11:11:02 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "POST /cpsess8085054164/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 20 11:12:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-20 11:12:32 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:37560: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.154
country_id: 1733045
description:
[2026-01-20 11:14:46 +0800] info [webmaild] 27.125.243.154 - jlpom@ajplantations.com.my "POST /cpsess1270459630/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.74] != Current IP Address [27.125.243.154]


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/contact-us.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.189.112.27
country_id: 2921044
description:
Jan 20 11:16:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.189.112.27 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.210
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 11:17:09 sv3 pure-ftpd[1146890]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 11:17:31 sv3 pure-ftpd[1147598]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/merge267/index_edm.html uploaded  (55415 bytes, 304.35KB/sec)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/demos/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 11:17:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57082: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 11:17:06 sv3 pure-ftpd[1146890]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:18:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:61537: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:20:11 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58430: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:21:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:61540: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 201.63.138.70
country_id: 3469034
description:
Jan 20 11:22:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 201.63.138.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 11:22:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:55237: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:23:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58434: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:23:08 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58434: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:24:09 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:61542: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 11:24:43 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 23.109.201.138
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-25.23.109.201.138||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.73.208.42
country_id: 6252001
description:
2026-01-20 11:25:33 dovecot_plain authenticator failed for H=([89.116.164.85]) [172.73.208.42]:48459: 535 Incorrect authentication data (set_id=comercial@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.186.235.72
country_id: 3469034
domain: www.vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.vc-b.com.my/teamwork.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 108.77.28.27
country_id: 6252001
description:
2026-01-20 11:25:49 dovecot_plain authenticator failed for H=108-77-28-27.lightspeed.tukrga.sbcglobal.net ([89.116.164.85]) [108.77.28.27]:54623: 535 Incorrect authentication data (set_id=comercial@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:26:09 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58438: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:26:59 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:61544: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:27:50 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:61545: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 11:28:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 11:28:13 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58711: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:29:17 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58442: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 11:31:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 11:31:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58762: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.200.139.114
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-31.185.200.139.114||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 11:33:18 H=([46.151.182.48]) [46.151.182.48]:59912 F=<jacklim@ktlog.com.my> rejected RCPT <jacklim@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 11:33:57 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58804: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 11:34:03 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58804: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 11:36:23 H=([46.151.182.48]) [46.151.182.48]:53741 F=<jaya@ktlog.com.my> rejected RCPT <jaya@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 11:36:48 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58816: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 11:37:01 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58817: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:37:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:61549: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58446: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 52.125.141.24
country_id: 2750405
domain: autodiscover.krisfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/autodiscover/autodiscover.json/v1.0/marketing@krisfood.com||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.179.153.133
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-40.185.179.153.133||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 11:41:15 H=([45.144.212.242]) [45.144.212.242]:65259 F=<no_reply@admin.com> rejected RCPT <jacklim@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 11:44:01 H=([45.144.212.242]) [45.144.212.242]:51501 F=<no_reply@admin.com> rejected RCPT <marina@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 11:45:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57168: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 11:45:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 11:47:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58863: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 11:49:40 H=([45.144.212.242]) [45.144.212.242]:57044 F=<no_reply@admin.com> rejected RCPT <marylinkoh@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 11:50:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:51626: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.179.228.33
country_id: 798544
description:
Jan 20 11:53:09 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.179.228.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:61555: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 11:57:01 H=([45.144.212.242]) [45.144.212.242]:61124 F=<no_reply@admin.com> rejected RCPT <meifoong@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 11:57:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58450: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.92.79.34
country_id: 3469034
description:
2026-01-20 11:58:53 dovecot_plain authenticator failed for H=201-92-79-34.dsl.telesp.net.br ([89.116.164.85]) [201.92.79.34]:44998: 535 Incorrect authentication data (set_id=mail@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 94.204.53.129
country_id: 290557
description:
2026-01-20 11:59:21 dovecot_plain authenticator failed for H=([89.116.164.85]) [94.204.53.129]:56832: 535 Incorrect authentication data (set_id=mail@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 201.92.79.34
country_id: 3469034
description:
2026-01-20 11:59:00 dovecot_login authenticator failed for H=201-92-79-34.dsl.telesp.net.br ([89.116.164.85]) [201.92.79.34]:44998: 535 Incorrect authentication data (set_id=mail@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.61.167.36
country_id: 286963
description:
2026-01-20 11:59:07 dovecot_plain authenticator failed for H=([89.116.164.85]) [62.61.167.36]:58898: 535 Incorrect authentication data (set_id=mail@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.64.135
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack   FileBox/DocQ Rack-4-120x120.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.242.64.135
country_id: 6252001
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Image/Products/DocQ Rack   FileBox/DocQ Rack-4-120x120.JPG HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 12:02:53 H=([45.144.212.242]) [45.144.212.242]:53079 F=<no_reply@admin.com> rejected RCPT <michelle.soo@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.98.99.149
country_id: 3077311
description:
Jan 20 12:04:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.98.99.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 12:05:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58874: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 12:05:16 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 12:06:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.18
country_id: 241170
description:
Jan 20 12:07:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 12:09:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 98.116.149.19
country_id: 6252001
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/product-details.php?id=6286 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.148
country_id: 1880251
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/feliogroup.com.my/css/ionicons.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/feliogroup.com.my/css/style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 12:10:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.131
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/css/slick-theme.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.136
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/css/jquery.fancybox.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/feliogroup.com.my/css/jquery.fancybox.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.137
country_id: 1880251
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/feliogroup.com.my/css/slick.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.95.199.79
country_id: 3469034
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/feliogroup.com.my/product-details.php?id=6286 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.130
country_id: 1880251
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/feliogroup.com.my/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.144
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/css/slick.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.132
country_id: 1880251
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/feliogroup.com.my/css/no-js.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.154
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/css/jquery.scrollbar.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.145
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/css/animate.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.153
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.149
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/css/ionicons.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.138
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/css/no-js.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.142
country_id: 1880251
domain: feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/feliogroup.com.my/css/jquery.scrollbar.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.164.155
country_id: 1880251
domain: www.feliogroup.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.feliogroup.com.my/fonts/ionicons28b5.ttf?v=2.0.0 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 12:13:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57235: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.74
country_id: 1733045
description:
[2026-01-20 12:15:51 +0800] info [webmaild] 27.125.243.74 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.34
country_id: 1733045
description:
[2026-01-20 12:15:51 +0800] info [webmaild] 27.125.243.34 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.74] != Current IP Address [27.125.243.34]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.210.127.2
country_id: 192950
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/apple/18/511/1820410 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 12:17:14 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.75
country_id: 2510769
description:
Jan 20 12:17:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.75 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.241.202.216
country_id: 6252001
description:
Jan 20 12:18:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.241.202.216 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.216
country_id: 6252001
description:
2026-01-20 12:18:35 dovecot_plain authenticator failed for H=cm-72-241-202-216.buckeyecom.net (sterse) [72.241.202.216]:33570: 535 Incorrect authentication data (set_id=sales@usfood.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 211.93.6.230
country_id: 1814991
description:
Jan 20 12:18:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 211.93.6.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 211.93.6.230
country_id: 1814991
description:
2026-01-20 12:18:39 dovecot_login authenticator failed for H=([211.93.6.230]) [211.93.6.230]:48976: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 12:18:18 H=([45.144.212.242]) [45.144.212.242]:59263 F=<no_reply@admin.com> rejected RCPT <munch@nexuscollection.com>: Sender verify failed


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 12:18:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:60216: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77350224
name: IM360 WAF: Common DB Name in Request
abuser: 138.226.236.155
country_id: 3582678
domain: www.kendek.com
description:
IM360 WAF: Common DB Name in Request||MVN:ARGS:id||MV:167434'  AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- '||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.226.236.155
country_id: 3582678
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET /product-detail.php?id=167434' and  AND 1 GROUP BY CONCAT(CAST(VERSION() AS CHAR),0x7e, 0x7e, FLOOR(RAND(0) * 2)) HAVING MIN(0)# and '1'='1 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 138.226.236.155
country_id: 3582678
domain: www.kendek.com
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:7.64||T:APACHE||SC:/home2/kendek/public_html/product-detail.php||


plugin: modsec
rule: 77317978
name: IM360 WAF: Generic SQL injection in id parameter
abuser: 138.226.236.155
country_id: 3582678
domain: www.kendek.com
description:
IM360 WAF: Generic SQL injection in id parameter||MVN:ARGS:id||MV:167434'  and (select 1 from (select count(*), concat((select (select concat(cast(version() as char),0x7e))), floor(rand(0) * 2)) x from information_schema.tables group by x) a)-- '||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 138.226.236.155
country_id: 3582678
domain: www.kendek.com
description:
IM360 WAF: PHP Injection Low value||MV:167434'  AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- '||MVN:ARGS:id||RSV:7.64||T:APACHE||SC:/home2/kendek/public_html/product-detail.php||


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 138.226.236.155
country_id: 3582678
domain: www.kendek.com
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:167434'  AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (SELECT CONCAT(CAST(VERSION() AS CHAR),0x7e))), FLOOR(RAND(0) * 2)) x FROM INFORMATION_SCHEMA.TABLES GROUP BY x) a)-- '||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.189.111.166
country_id: 3895114
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/yeah/413/552003 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.74
country_id: 1733045
description:
[2026-01-20 12:21:24 +0800] info [webmaild] 27.125.243.74 - jlpom@ajplantations.com.my "GET /cpsess4386149299/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.34] != Current IP Address [27.125.243.74]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.23
country_id: 241170
description:
Jan 20 12:21:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.23 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 12:22:22 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "POST /cpsess4386149299/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.215
country_id: 3469034
description:
Jan 20 12:23:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.215 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 12:23:22 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "POST /cpsess4386149299/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 20 12:23:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.215
country_id: 3469034
description:
Jan 20 12:24:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 12:24:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.114.146.142
country_id: 1655842
description:
2026-01-20 12:24:48 408621 [Warning] Aborted connection 408621 to db: 'unconnected' user: 'unauthenticated' host: '103.114.146.142' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 12:25:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:62128: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 12:27:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 12:27:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58454: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.19
country_id: 241170
description:
Jan 20 12:26:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.19 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.74.226.182
country_id: 1733045
description:
2026-01-20 12:31:12 dovecot_plain authenticator failed for H=([89.116.164.85]) [180.74.226.182]:18229: 535 Incorrect authentication data (set_id=webmaster@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.103.119.54
country_id: 1282988
description:
2026-01-20 12:31:25 dovecot_plain authenticator failed for H=([89.116.164.85]) [117.103.119.54]:49346: 535 Incorrect authentication data (set_id=webmaster@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 12:32:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.137.60.175
country_id: 1733045
description:
[2026-01-20 12:33:31 +0800] info [webmaild] 175.137.60.175 - jle@ajplantations.com.my "GET /cpsess2805900351/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 12:33:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 12:35:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:58982: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77093094
abuser: 62.146.232.43
country_id: 1880251
domain: www.wcc.com.my
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('powershell -c \\\"43717*42015\\\"').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.7
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/log/cloudlinux-backup-utils.log||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 12:39:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 12:39:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 12:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57387: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.7
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dpkg/dpkg.cfg||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 12:42:40 H=([45.144.212.242]) [45.144.212.242]:64845 F=<no_reply@admin.com> rejected RCPT <nuratiqah@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 12:43:18 H=([46.151.182.48]) [46.151.182.48]:57949 F=<mustapa@astlog.com.my> rejected RCPT <mustapa@astlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 12:43:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 12:46:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:49896: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 194.110.247.102
country_id: 617790
domain: pspoly.com.my
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (compatible; Bytespider; spider-feedback@bytedance.com) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.0.0 Safari/547.36||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Radioactive_Waste_Management.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 12:47:48 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 207.182.29.113
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:12-47.207.182.29.113||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.78.255.193
country_id: 1210997
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=145994 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.12.230
country_id: 2300660
description:
Jan 20 12:50:26 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.12.230 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 12:50:55 H=([45.144.212.242]) [45.144.212.242]:54439 F=<no_reply@admin.com> rejected RCPT <ongkonaun@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 12:53:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:62136: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.10
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/sysusers.d/chrony.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 12:54:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 12:55:02 H=([45.144.212.242]) [45.144.212.242]:53517 F=<no_reply@admin.com> rejected RCPT <oscar@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 12:55:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:58460: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 12:58:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 13:02:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 13:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59013: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.205.145.67
country_id: 290557
description:
2026-01-20 13:04:41 dovecot_plain authenticator failed for H=bba-176-205-145-67.alshamil.net.ae ([89.116.164.85]) [176.205.145.67]:57660: 535 Incorrect authentication data (set_id=it@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.100.45.56
country_id: 3469034
description:
2026-01-20 13:04:56 dovecot_plain authenticator failed for H=([89.116.164.85]) [179.100.45.56]:53858: 535 Incorrect authentication data (set_id=it@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.2.209.148
country_id: 1562822
description:
2026-01-20 13:05:10 dovecot_plain authenticator failed for H=([89.116.164.85]) [27.2.209.148]:39135: 535 Incorrect authentication data (set_id=it@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 179.100.45.56
country_id: 3469034
description:
2026-01-20 13:05:03 dovecot_login authenticator failed for H=([89.116.164.85]) [179.100.45.56]:53858: 535 Incorrect authentication data (set_id=it@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 13:08:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 13:09:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57462: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.197.25.155
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-10.196.197.25.155||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-20 13:11:55 H=([77.83.39.106]) [77.83.39.106]:58066 F=<Fix@coscoshippingspe.nl> rejected RCPT <mustapa@astlog.com.my>: SPF: 77.83.39.106 is not allowed to send mail from coscoshippingspe.nl


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 216.131.122.21
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/dress/14/476/1433641 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.203
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/screen.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 13:12:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 20 13:13:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 13:14:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:49717: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-20 13:16:50 H=([45.144.212.50]) [45.144.212.50]:62908 F=<azlan@permalanka.lk> rejected RCPT <mustapa@astlog.com.my>: SPF: 45.144.212.50 is not allowed to send mail from permalanka.lk


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 13:17:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.109.178.28
country_id: 1269750
description:
Jan 20 13:18:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.109.178.28 has been locked due to Imunify RBL


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 8.138.116.94
country_id: 1814991
description:
2026-01-20 13:19:46 410940 [Warning] Aborted connection 410940 to db: 'unconnected' user: 'unauthenticated' host: '8.138.116.94' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.63.50
country_id: 1269750
description:
Jan 20 13:19:33 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.63.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.63.50
country_id: 1269750
description:
2026-01-20 13:19:35 dovecot_login authenticator failed for H=([125.16.246.121]) [182.95.63.50]:36414: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 8.138.116.94
country_id: 1814991
description:
2026-01-20 13:19:41 410932 [Warning] Aborted connection 410932 to db: 'unconnected' user: 'unauthenticated' host: '8.138.116.94' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 13:21:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 13:21:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:62151: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.237.188.170
country_id: 3469034
description:
Jan 20 13:21:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.237.188.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 13:23:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 13:23:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59031: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 8.138.116.94
country_id: 1814991
description:
2026-01-20 13:24:46 411182 [Warning] Aborted connection 411182 to db: 'unconnected' user: 'unauthenticated' host: '8.138.116.94' (This connection closed normally without authentication)


plugin: ossec
rule: 50146
name: Multiple aborted logins to database.
abuser: 8.138.116.94
country_id: 1814991
description:
2026-01-20 13:24:51 411189 [Warning] Aborted connection 411189 to db: 'unconnected' user: 'unauthenticated' host: '8.138.116.94' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.110
country_id: 3175395
description:
Jan 20 13:25:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.110 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.144.212.7
country_id: 690791
description:
Jan 20 13:27:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.144.212.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 13:27:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 13:30:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 136.0.38.195
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-30.136.0.38.195||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 13:31:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59031: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.91.64.7
country_id: 2017370
description:
2026-01-20 13:36:16 411734 [Warning] Aborted connection 411734 to db: 'unconnected' user: 'unauthenticated' host: '45.91.64.7' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 13:37:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57578: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 104.13.99.222
country_id: 6252001
domain: www.oxbold.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.oxbold.com/windsurfingmalaysia-howtogetthere.htm HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.119.45
country_id: 1733045
description:
2026-01-20 13:38:02 dovecot_plain authenticator failed for H=([89.116.164.85]) [161.142.119.45]:26573: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 186.41.162.101
country_id: 3895114
description:
2026-01-20 13:38:17 dovecot_plain authenticator failed for H=([89.116.164.85]) [186.41.162.101]:36233: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 68.110.193.218
country_id: 6252001
description:
2026-01-20 13:38:33 dovecot_plain authenticator failed for H=ip68-110-193-218.ri.ri.cox.net ([89.116.164.85]) [68.110.193.218]:39803: 535 Incorrect authentication data (set_id=accounts@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 13:40:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.169
country_id: 798544
description:
Jan 20 13:41:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.169 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 13:42:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:49987: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.238.166.169
country_id: 798544
description:
Jan 20 13:42:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.238.166.169 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.149.106
country_id: 1733045
description:
[2026-01-20 13:43:53 +0800] info [webmaild] 161.142.149.106 - brendon@mckd.com.my "GET /cpsess4479841697/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 13:43:02 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 13:43:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 13:46:51 H=([46.151.182.48]) [46.151.182.48]:56038 F=<sales@cordage.com.my> rejected RCPT <sales@cordage.com.my>: smtp auth required


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.111.7.89
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/sukiya.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.219.218.235
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/images/s1.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.105.247.124
country_id: 3996063
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/images/sfinal.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.41.52.117
country_id: 286963
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/application/themes/bishop/images/quote.svg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.11.247.215
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/images/logoo-cabee.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.82.181.84
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/images/s2.png HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 13:49:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:62165: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 13:49:18 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 13:51:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.138.65
country_id: 1733045
description:
2026-01-20 13:51:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.138.65]:59038: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.6
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/mysql/russian/errmsg.sys||User:root||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.56
country_id: 690791
description:
2026-01-20 13:55:52 H=([77.83.39.56]) [77.83.39.56]:61191 F=<shassan@rsms.com> rejected RCPT <celine@ktlog.com.my>: SPF: 77.83.39.56 is not allowed to send mail from rsms.com


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 13:55:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.168.192
country_id: 3175395
description:
Jan 20 13:58:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.168.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.87.194.80
country_id: 1168579
description:
2026-01-20 13:59:05 dovecot_login authenticator failed for H=([103.253.19.87]) [103.87.194.80]:39899: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 14:00:55 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 14:02:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.67.155.107
country_id: 298795
description:
Jan 20 14:02:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.67.155.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 14:04:16 H=([45.144.212.242]) [45.144.212.242]:52455 F=<no_reply@admin.com> rejected RCPT <sabrina@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 14:05:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57666: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 14:05:45 H=([45.144.212.242]) [45.144.212.242]:59892 F=<no_reply@admin.com> rejected RCPT <saiful@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 14:06:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 143.44.168.137
country_id: 1694008
domain: medinova.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:79621.medinova.com.my||ServerName:medinova.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:11a5c70012749ac4b353b8f214e1929c0aebb2a3||Title:0xcd422e65||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 14:10:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:49838: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.214.127.246
country_id: 1814991
description:
Jan 20 14:10:17 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.214.127.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.214.127.246
country_id: 1814991
description:
2026-01-20 14:10:19 dovecot_login authenticator failed for H=([60.214.127.246]) [60.214.127.246]:51709: 535 Incorrect authentication data (set_id=weisiong.wan@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 14:11:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.112.7.133
country_id: 3469034
description:
2026-01-20 14:11:52 dovecot_plain authenticator failed for H=([89.116.164.85]) [187.112.7.133]:55294: 535 Incorrect authentication data (set_id=staff@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.24.57.112
country_id: 3686110
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/_files/ HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 20 14:12:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 187.112.7.133
country_id: 3469034
description:
2026-01-20 14:11:59 dovecot_login authenticator failed for H=([89.116.164.85]) [187.112.7.133]:55294: 535 Incorrect authentication data (set_id=staff@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 203.106.96.63
country_id: 1733045
description:
[2026-01-20 14:12:02 +0800] info [webmaild] 203.106.96.63 - ehsan@sutsb.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 67.61.148.182
country_id: 6252001
description:
2026-01-20 14:12:07 dovecot_plain authenticator failed for H=67-61-148-182.cpe.sparklight.net ([89.116.164.85]) [67.61.148.182]:41441: 535 Incorrect authentication data (set_id=staff@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 118.100.145.238
country_id: 1733045
description:
2026-01-20 14:12:20 dovecot_plain authenticator failed for H=([89.116.164.85]) [118.100.145.238]:37362: 535 Incorrect authentication data (set_id=staff@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.232.152.128
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/tests/Mockery/_files HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.106
country_id: 690791
description:
2026-01-20 14:14:44 H=([77.83.39.106]) [77.83.39.106]:55729 F=<Fix@coscoshippingspe.nl> rejected RCPT <astkbr@astlog.com.my>: No Such User Here


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 134.122.173.240
country_id: 1880251
domain: smartcable.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:134.122.173.240||TA:134.122.173.240||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.166
country_id: 1733045
description:
2026-01-20 14:17:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.166]:36653: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 14:18:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.166
country_id: 1733045
description:
2026-01-20 14:19:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.166]:54056: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.50
country_id: 690791
description:
2026-01-20 14:20:05 H=([45.144.212.50]) [45.144.212.50]:55700 F=<azlan@permalanka.lk> rejected RCPT <astkua@astlog.com.my>: No Such User Here


plugin: ossec
rule: 11314
name: FTP file deleted from server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 14:22:40 sv3 pure-ftpd[1418966]: (eminent@113.211.215.143) [NOTICE] Deleted /home/eminent//public_html/folder/merge267/images/Cross-sell-banner-(for-Mass-eDM-only).jpg


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 14:22:47 sv3 pure-ftpd[1419633]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/merge267/premier_edm.html uploaded  (75762 bytes, 920.19KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.53.15.180
country_id: 2542007
description:
Jan 20 14:21:57 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.53.15.180 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 102.53.15.180
country_id: 2542007
description:
2026-01-20 14:21:59 dovecot_plain authenticator failed for H=(ledis) [102.53.15.180]:53254: 535 Incorrect authentication data (set_id=sales@u-net.com.my)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 14:22:24 sv3 pure-ftpd[1418966]: (?@113.211.215.143) [INFO] New connection from 113.211.215.143


plugin: ossec
rule: 11305
name: Attempt to access invalid directory
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 14:22:26 sv3 pure-ftpd[1418966]: (eminent@113.211.215.143) [INFO] Can't change directory to /42.0.28.63: No such file or directory


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-20 14:22:16 +0800] info [webmaild] 180.75.72.60 - salesadmin@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-20 14:23:14 +0800] info [webmaild] 180.75.72.60 - salesadmin@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 113.211.215.143
country_id: 1733045
description:
Jan 20 14:22:57 sv3 pure-ftpd[1419633]: (eminent@113.211.215.143) [NOTICE] /home/eminent//public_html/folder/merge267/images/Premier_cross-sell.jpg uploaded  (77882 bytes, 126.52KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 14:24:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 71.224.169.28
country_id: 6252001
description:
Jan 20 14:24:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 71.224.169.28 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 71.224.169.28
country_id: 6252001
description:
2026-01-20 14:24:17 dovecot_plain authenticator failed for H=c-71-224-169-28.hsd1.pa.comcast.net (henes) [71.224.169.28]:34134: 535 Incorrect authentication data (set_id=webmaster@u-net.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 14:27:07 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 14:28:10 H=([45.144.212.242]) [45.144.212.242]:57018 F=<no_reply@admin.com> rejected RCPT <shahzila@chs.com.my>: Sender verify failed


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.232.28
country_id: 6252001
description:
2026-01-20 14:28:53 414179 [Warning] Aborted connection 414179 to db: 'unconnected' user: 'unauthenticated' host: '71.6.232.28' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 14:29:44 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.3.254
country_id: 1168579
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/idea/311/11366 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.26
country_id: 2750405
description:
Jan 20 14:33:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.26 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 14:33:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:57791: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.0.27.220
country_id: 192950
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/die/9/39/901513 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 14:33:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.196.163
country_id: 1733045
description:
[2026-01-20 14:35:33 +0800] info [webmaild] 60.52.196.163 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.51.31.167
country_id: 1733045
description:
2026-01-20 14:38:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.196]) [60.51.31.167]:49891: 535 Incorrect authentication data (set_id=kasim_kn@ajplantations.com.my)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 114.10.115.70
country_id: 1643084
description:
[2026-01-20 14:38:06 +0800] info [cpaneld] 114.10.115.70 - oxboldc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 14:42:10 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.35.197.41
country_id: 6252001
description:
2026-01-20 14:43:53 dovecot_plain authenticator failed for H=([89.116.164.85]) [24.35.197.41]:60321: 535 Incorrect authentication data (set_id=suporte@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.35.197.41
country_id: 6252001
description:
2026-01-20 14:44:00 dovecot_login authenticator failed for H=([89.116.164.85]) [24.35.197.41]:60321: 535 Incorrect authentication data (set_id=suporte@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 184.101.78.94
country_id: 6252001
description:
2026-01-20 14:44:07 dovecot_plain authenticator failed for H=([89.116.164.85]) [184.101.78.94]:55359: 535 Incorrect authentication data (set_id=suporte@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.166
country_id: 1733045
description:
2026-01-20 14:45:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.166]:36656: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.166
country_id: 1733045
description:
2026-01-20 14:47:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.166]:54063: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 14:49:41 H=([45.144.212.242]) [45.144.212.242]:59742 F=<no_reply@admin.com> rejected RCPT <stacy@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 114.119.138.185
country_id: 1880251
domain: www.appointment.visoft.com.my
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/vendor/symfony/translation/Tests/fixtures/resources.ini||User:visoftcom||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 122.114.11.109
country_id: 1814991
description:
2026-01-20 14:53:00 H=(localhost.localdomain) [122.114.11.109]:60354 F=<procurement.manager@hausproperties.com> rejected RCPT <info@symphony-led.com>: SPF: 122.114.11.109 is not allowed to send mail from hausproperties.com


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 14:57:44 H=([45.144.212.242]) [45.144.212.242]:56175 F=<no_reply@admin.com> rejected RCPT <hr_admin@smartcable.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 14:58:11 H=([46.151.182.48]) [46.151.182.48]:58717 F=<waynegoh@empirelog.com.my> rejected RCPT <waynegoh@empirelog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 15:00:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 15:01:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59121: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 15:02:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-20 15:04:05 H=(localhost.localdomain) [78.153.140.207]:38854 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 15:06:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 15.235.148.148
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Enclosure.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-20 15:07:51 dovecot_login authenticator failed for H=(User) [77.90.185.33]:14462: 535 Incorrect authentication data (set_id=luck)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 20 15:07:49 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 96.236.24.15
country_id: 6252001
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/world/640/649282 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.234.11.10
country_id: 2017370
description:
Jan 20 15:10:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.234.11.10 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 213.234.11.10
country_id: 2017370
description:
2026-01-20 15:10:36 dovecot_login authenticator failed for H=([213.234.11.10]) [213.234.11.10]:44000: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 15:11:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 20 15:12:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-20 15:12:07 dovecot_login authenticator failed for H=(User) [77.90.185.33]:32072: 535 Incorrect authentication data (set_id=client)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.166
country_id: 1733045
description:
2026-01-20 15:13:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.166]:36662: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 15:14:31 H=([45.144.212.242]) [45.144.212.242]:60471 F=<no_reply@admin.com> rejected RCPT <teegh@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.166
country_id: 1733045
description:
2026-01-20 15:15:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.166]:54643: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.118.150.170
country_id: 1269750
description:
2026-01-20 15:15:25 416403 [Warning] Aborted connection 416403 to db: 'unconnected' user: 'unauthenticated' host: '103.118.150.170' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 20 15:16:20 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-20 15:16:22 dovecot_login authenticator failed for H=(User) [77.90.185.33]:49646: 535 Incorrect authentication data (set_id=pwrchute)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 15:18:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.33
country_id: 2921044
description:
Jan 20 15:20:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.33 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.90.185.33
country_id: 2921044
description:
2026-01-20 15:20:38 dovecot_login authenticator failed for H=(User) [77.90.185.33]:2691: 535 Incorrect authentication data (set_id=root)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 38.242.206.74
country_id: 3017382
description:
Jan 20 15:22:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 38.242.206.74 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 15:25:34 H=([45.144.212.242]) [45.144.212.242]:49171 F=<no_reply@admin.com> rejected RCPT <tini@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 114.5.213.2
country_id: 1643084
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=70971526631903 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 15:27:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-20 15:28:13 H=(localhost.localdomain) [78.153.140.207]:54768 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 15:29:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59259: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 15:29:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.250.163
country_id: 99237
description:
Jan 20 15:29:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.250.163 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.250.163
country_id: 99237
description:
2026-01-20 15:29:33 dovecot_plain authenticator failed for H=(uncen) [65.20.250.163]:55276: 535 Incorrect authentication data (set_id=sales@usfood.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.246.3.236
country_id: 1835841
description:
Jan 20 15:33:36 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.246.3.236 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.239.45.10
country_id: 1269750
description:
Jan 20 15:32:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.239.45.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.64
country_id: 1269750
description:
Jan 20 15:35:00 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.64 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.185.132.108
country_id: 6252001
description:
2026-01-20 15:35:08 417395 [Warning] Aborted connection 417395 to db: 'unconnected' user: 'unauthenticated' host: '147.185.132.108' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.239.41.102
country_id: 3469034
description:
Jan 20 15:37:47 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.239.41.102 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.184.55.92
country_id: 1733045
description:
[2026-01-20 15:37:48 +0800] info [cpaneld] 202.184.55.92 - indfinitydesign "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.172
country_id: 1269750
description:
Jan 20 15:37:01 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.172 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.184.85.167
country_id: 3469034
description:
Jan 20 15:37:24 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.184.85.167 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 66.132.153.118
country_id: 6252001
description:
2026-01-20 15:38:26 417525 [Warning] Aborted connection 417525 to db: 'unconnected' user: 'unauthenticated' host: '66.132.153.118' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.35.182.176
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/set/523/83804 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.184.55.92
country_id: 1733045
description:
[2026-01-20 15:38:11 +0800] info [cpaneld] 202.184.55.92 - indfinitydesign "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.166
country_id: 1733045
description:
2026-01-20 15:41:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.166]:36667: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.128.166
country_id: 1733045
description:
2026-01-20 15:43:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.128.166]:54651: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 70.40.81.20
country_id: 6252001
description:
2026-01-20 15:44:36 dovecot_plain authenticator failed for H=([89.116.164.85]) [70.40.81.20]:39902: 535 Incorrect authentication data (set_id=webadmin@dsc-expat.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.234
country_id: 1733045
description:
[2026-01-20 15:45:48 +0800] info [webmaild] 27.125.243.234 - jlpom@ajplantations.com.my "POST /cpsess3881840997/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.154] != Current IP Address [27.125.243.234]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
country_id: 3895114
description:
Jan 20 15:45:56 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.165.170.41
country_id: 3895114
description:
Jan 20 15:46:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.165.170.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.34.247.95
country_id: 2750405
domain: www.eminent.st
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-20 15:48:55 H=(localhost.localdomain) [78.153.140.207]:42558 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.234
country_id: 1733045
description:
[2026-01-20 15:49:03 +0800] info [webmaild] 27.125.243.234 - jlpom@ajplantations.com.my "POST /cpsess2655430348/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.154] != Current IP Address [27.125.243.234]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.234
country_id: 1733045
description:
[2026-01-20 15:53:46 +0800] info [webmaild] 27.125.243.234 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.74] != Current IP Address [27.125.243.234]


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.184.55.92
country_id: 1733045
description:
[2026-01-20 15:52:57 +0800] info [cpaneld] 202.184.55.92 - indfinitydesign "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.194
country_id: 1733045
description:
[2026-01-20 15:55:07 +0800] info [webmaild] 27.125.243.194 - jlpom@ajplantations.com.my "GET /cpsess7517399237/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.234] != Current IP Address [27.125.243.194]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.54
country_id: 690791
description:
2026-01-20 15:55:31 H=([45.144.212.54]) [45.144.212.54]:55531 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<mertul@kit-fa.com> rejected RCPT <azman@ajplantations.com.my>: No Such User Here"


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 15:55:51 H=([45.144.212.242]) [45.144.212.242]:61353 F=<no_reply@admin.com> rejected RCPT <vimala@ktlog.com.my>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.154
country_id: 1733045
description:
[2026-01-20 15:55:07 +0800] info [webmaild] 27.125.243.154 - jlpom@ajplantations.com.my "GET /cpsess7517399237/3rdparty/roundcube/?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX.Sent&_page=&_remote=1&_unlock=loading1768895708180&_=1768895708082 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.234] != Current IP Address [27.125.243.154]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 15:57:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59408: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 142.93.210.165
country_id: 1269750
description:
2026-01-20 15:59:10 418444 [Warning] Aborted connection 418444 to db: 'unconnected' user: 'unauthenticated' host: '142.93.210.165' (This connection closed normally without authentication)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 16:00:08 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "POST /cpsess7517399237/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.34
country_id: 1733045
description:
[2026-01-20 16:00:24 +0800] info [webmaild] 27.125.243.34 - jlpom@ajplantations.com.my "GET /cpsess0223938892/3rdparty/roundcube/program/js/editor.min.js?s=1765700565 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.114] != Current IP Address [27.125.243.34]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 16:01:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.34
country_id: 1733045
description:
[2026-01-20 16:03:18 +0800] info [webmaild] 27.125.243.34 - jlpom@ajplantations.com.my "POST /cpsess9688055798/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.114] != Current IP Address [27.125.243.34]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.34
country_id: 1733045
description:
[2026-01-20 16:04:09 +0800] info [webmaild] 27.125.243.34 - jlpom@ajplantations.com.my "GET /cpsess4141641316/3rdparty/roundcube/?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX.Drafts&_page=1&_remote=1&_unlock=loading1768896250879&_=1768896246343 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.74] != Current IP Address [27.125.243.34]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.34
country_id: 1733045
description:
[2026-01-20 16:05:40 +0800] info [webmaild] 27.125.243.34 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 16:05:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 16:07:08 H=([45.144.212.242]) [45.144.212.242]:62276 F=<no_reply@admin.com> rejected RCPT <waynegoh@empirelog.com.my>: Sender verify failed


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.154
country_id: 1733045
description:
[2026-01-20 16:08:06 +0800] info [webmaild] 27.125.243.154 - jlpom@ajplantations.com.my "POST /cpsess0759653484/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.194] != Current IP Address [27.125.243.154]


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 16:08:35 H=([45.144.212.242]) [45.144.212.242]:64323 F=<no_reply@admin.com> rejected RCPT <wendy@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 16:09:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:11542: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 16:09:16 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "GET /cpsess0759653484/3rdparty/roundcube/?_task=mail&_mbox=INBOX.Drafts HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 60.52.196.163
country_id: 1733045
description:
[2026-01-20 16:10:45 +0800] info [webmaild] 60.52.196.163 - cle@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 16:10:01 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.198
country_id: 3469034
description:
Jan 20 16:10:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 16:11:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:19016: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 16:11:07 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59127: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.77.198
country_id: 3469034
description:
Jan 20 16:10:59 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.77.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 16:12:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.252.118.34
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/generator/GlobalFunctionFile.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 211.25.18.142
country_id: 1733045
description:
[2026-01-20 16:13:36 +0800] info [webmaild] 211.25.18.142 - safuddin@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 16:14:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59176: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 211.25.18.142
country_id: 1733045
description:
[2026-01-20 16:14:52 +0800] info [webmaild] 211.25.18.142 - safuddin@ajplantations.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 161.142.154.2
country_id: 1733045
description:
2026-01-20 16:15:01 dovecot_plain authenticator failed for H=([89.116.164.85]) [161.142.154.2]:5348: 535 Incorrect authentication data (set_id=office@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 16:16:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.234
country_id: 1733045
description:
[2026-01-20 16:16:11 +0800] info [webmaild] 27.125.243.234 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.194
country_id: 1733045
description:
[2026-01-20 16:16:12 +0800] info [webmaild] 27.125.243.194 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.234] != Current IP Address [27.125.243.194]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 16:16:28 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 16:16:54 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59226: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 16:17:00 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59226: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 180.188.253.150
country_id: 1269750
description:
Jan 20 16:17:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 180.188.253.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 180.188.253.150
country_id: 1269750
description:
2026-01-20 16:17:44 dovecot_login authenticator failed for H=([180.188.253.150]) [180.188.253.150]:53374: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 16:19:44 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59232: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 91.202.57.43
country_id: 614540
description:
[2026-01-20 16:19:49 +0800] info [webmaild] 91.202.57.43 - kw.chee@nmahir.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 193.34.73.154
country_id: 6252001
description:
[2026-01-20 16:19:50 +0800] info [webmaild] 193.34.73.154 - nmahir@nmahir.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 16:20:02 dovecot_login authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59233: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 16:21:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.106.41.249
country_id: 99237
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/tennis/10/1005165 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 16:25:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59537: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 16:25:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 16:26:54 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/malaysia-infinity-design-projects/img/about.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 16:27:50 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "GET /cpsess7395598020/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.34] != Current IP Address [27.125.243.114]


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.118.47.174
country_id: 1562822
description:
Jan 20 16:28:35 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.118.47.174 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 16:28:39 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "GET /cpsess0572064552/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.74] != Current IP Address [27.125.243.114]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.74
country_id: 1733045
description:
[2026-01-20 16:29:00 +0800] info [webmaild] 27.125.243.74 - jlpom@ajplantations.com.my "GET /cpsess0572064552/3rdparty/roundcube/?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX.Sent&_page=1&_remote=1&_unlock=loading1768897741986&_=1768897685901 HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 16:30:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59311: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.194
country_id: 1733045
description:
[2026-01-20 16:31:19 +0800] info [webmaild] 27.125.243.194 - jlpom@ajplantations.com.my "GET /cpsess4692668842/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.34] != Current IP Address [27.125.243.194]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.154
country_id: 1733045
description:
[2026-01-20 16:31:30 +0800] info [webmaild] 27.125.243.154 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.141.249.116
country_id: 3469034
description:
Jan 20 16:32:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.141.249.116 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-20 16:32:46 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "POST /cpsess7853193206/3rdparty/roundcube/?_task=mail&_action=refresh HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.246.208.80
country_id: 798544
description:
Jan 20 16:32:03 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.246.208.80 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-20 16:33:24 +0800] info [webmaild] 180.75.72.60 - ken@smartcable.com.my "GET /cpsess7853193206/3rdparty/roundcube/?_task=mail&_caps=pdf%3D1%2Cflash%3D0%2Ctiff%3D0%2Cwebp%3D1%2Cpgpmime%3D0&_uid=30234&_mbox=INBOX&_framed=1&_action=preview HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 16:33:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.234
country_id: 1733045
description:
[2026-01-20 16:35:37 +0800] info [webmaild] 27.125.243.234 - jlpom@ajplantations.com.my "GET /cpsess1999415682/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.154] != Current IP Address [27.125.243.234]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-20 16:36:41 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [115.164.72.118] != Current IP Address [175.139.178.45]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 16:37:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:11545: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 16:38:38 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.34
country_id: 1733045
description:
[2026-01-20 16:38:48 +0800] info [webmaild] 27.125.243.34 - jlpom@ajplantations.com.my "GET /cpsess9265289032/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.74] != Current IP Address [27.125.243.34]


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.121.226
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:16-38.147.53.121.226||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 16:39:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:19025: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.149.106
country_id: 1733045
description:
[2026-01-20 16:40:52 +0800] info [webmaild] 161.142.149.106 - brendon@mckd.com.my "GET /cpsess4479841697/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.158.119
country_id: 1733045
domain: www.modern.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.myhttp/www.modern.com.my/wp-content/uploads/HP-Pavilion-g4.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 108.165.158.119
country_id: 1733045
domain: www.modern.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.modern.com.my/wp-content/uploads/HP-Pavilion-g4.jpg HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 16:42:19 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "GET /cpsess9244159268/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.154] != Current IP Address [27.125.243.114]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 16:43:01 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "GET /cpsess9762723739/3rdparty/roundcube/program/js/jquery.min.js?s=1765700567 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.154] != Current IP Address [27.125.243.114]


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 76.32.40.92
country_id: 6252001
description:
2026-01-20 16:44:45 dovecot_plain authenticator failed for H=([89.116.164.85]) [76.32.40.92]:7542: 535 Incorrect authentication data (set_id=soporte@dsc-expat.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/images/portfolio/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/images||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.194
country_id: 1733045
description:
[2026-01-20 16:46:03 +0800] info [webmaild] 27.125.243.194 - jlpom@ajplantations.com.my "GET /cpsess9072823020/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.154] != Current IP Address [27.125.243.194]


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 80.240.22.5
country_id: 2921044
domain: thinkcloud.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:title||MV:598336'nvOpzp; AND 1=1 OR (<'\">iKO)),||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 16:48:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59379: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 16:47:58 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 16:49:38 H=([45.144.212.242]) [45.144.212.242]:56677 F=<lynnied@mhtc.net> rejected RCPT <sales@wohcheong.com.my>: Unrouteable address


plugin: modsec
rule: 77350541
name: IM360 WAF: Possible SQL injection attack
abuser: 80.240.22.5
country_id: 2921044
domain: mail1.vc-b.com.my
description:
IM360 WAF: Possible SQL injection attack||MVN:ARGS:id||MV:191716'nvOpzp; AND 1=1 OR (<'\">iKO)),||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 103.179.239.201
country_id: 1210997
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/09-autohint-if-no-hinting.conf||User:root||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.154
country_id: 1733045
description:
[2026-01-20 16:50:26 +0800] info [webmaild] 27.125.243.154 - jlpom@ajplantations.com.my "GET /cpsess0155336109/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.194] != Current IP Address [27.125.243.154]


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.154
country_id: 1733045
description:
[2026-01-20 16:50:58 +0800] info [webmaild] 27.125.243.154 - jlpom@ajplantations.com.my "GET /cpsess8937872785/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.95.183
country_id: 3895114
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/incoming-list.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.121.34.111
country_id: 953987
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/pre-owned.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.246.58.116
country_id: 3932488
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/stock-list.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 149.255.231.4
country_id: 99237
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/contact.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.217.94
country_id: 1562822
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/pre-order.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.13.195.63
country_id: 1733045
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/index.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 182.253.188.27
country_id: 1643084
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/about.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.29.161
country_id: 1562822
domain: vmsmotorsports.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vmsmotorsports.com.my/delivery-unit.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 16:53:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59702: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-20 16:56:48 +0800] info [webmaild] 180.75.72.60 - general@smartcable.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 180.75.72.60
country_id: 1733045
description:
[2026-01-20 16:56:55 +0800] info [webmaild] 180.75.72.60 - general@smartcable.com.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 104.131.111.225
country_id: 6252001
description:
2026-01-20 16:59:36 421066 [Warning] Aborted connection 421066 to db: 'unconnected' user: 'unauthenticated' host: '104.131.111.225' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 17:00:46 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 124.82.108.129
country_id: 1733045
description:
[2026-01-20 17:01:53 +0800] info [webmaild] 124.82.108.129 - pylim@af-sb.com "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 17:05:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:11548: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 65.20.160.107
country_id: 99237
description:
Jan 20 17:06:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 65.20.160.107 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 65.20.160.107
country_id: 99237
description:
2026-01-20 17:06:07 dovecot_plain authenticator failed for H=(knatel) [65.20.160.107]:47619: 535 Incorrect authentication data (set_id=jun@kdiballoon.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 147.53.121.25
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-07.147.53.121.25||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 17:07:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:19595: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">payment to supplies (do bank transfer - save as draft tomorrow payment)</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">check &amp; print supplier invoice</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">keyin supplies invoice - purchase invoices in software</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">go to find the old document payment voucher for tax audit - get approve ms. kho</li>\r\n<li class=\"msonormal\" style=\"mso-margin-top-alt: auto; mso-margin-bottom-alt: auto; mso-list: l0 level1 lfo1; tab-stops: list 36.0pt;\">open new vendor</li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 17:10:06 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 204.12.227.222
country_id: 6252001
domain: www.mckd.com.my
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.64||T:APACHE||RA:204.12.227.222||TA:204.12.227.222||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 109.123.250.240
country_id: 3017382
description:
[2026-01-20 17:11:36 +0800] info [cpaneld] 109.123.250.240 - manforce "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-20 17:13:13 +0800] info [webmaild] 42.191.134.208 - kelly62@fkr.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.232.30
country_id: 6252001
description:
2026-01-20 17:14:09 421815 [Warning] Aborted connection 421815 to db: 'unconnected' user: 'unauthenticated' host: '71.6.232.30' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 168.197.225.71
country_id: 3469034
description:
2026-01-20 17:14:35 dovecot_plain authenticator failed for H=([89.116.164.85]) [168.197.225.71]:60872: 535 Incorrect authentication data (set_id=ventas@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.49.20.248
country_id: 3017382
description:
2026-01-20 17:14:50 dovecot_plain authenticator failed for H=5-49-20-248.hfc.dyn.abo.bbox.fr ([89.116.164.85]) [5.49.20.248]:64589: 535 Incorrect authentication data (set_id=ventas@dsc-expat.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.49.20.248
country_id: 3017382
description:
2026-01-20 17:14:57 dovecot_login authenticator failed for H=5-49-20-248.hfc.dyn.abo.bbox.fr ([89.116.164.85]) [5.49.20.248]:64589: 535 Incorrect authentication data (set_id=ventas@dsc-expat.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-20 17:17:50 H=(localhost.localdomain) [78.153.140.207]:42810 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 17:18:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59448: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 146.174.160.42
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/sutsbcom/public_html/wp-includes/SimplePie/src/Item.php||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 17:21:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59876: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 17:22:23 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 17:22:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 72.241.202.104
country_id: 6252001
description:
Jan 20 17:23:27 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 72.241.202.104 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2026-01-20 17:23:29 dovecot_plain authenticator failed for H=cm-72-241-202-104.buckeyecom.net (moritess) [72.241.202.104]:39317: 535 Incorrect authentication data (set_id=sales@kdiballoon.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.241.150.246
country_id: 2017370
description:
2026-01-20 17:24:52 dovecot_login authenticator failed for H=91-241-150-246-dyn.neotele.com.ru [91.241.150.246]:48876: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.209.248.138
country_id: 798544
description:
Jan 20 17:24:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.209.248.138 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 49.231.31.220
country_id: 1605651
description:
Jan 20 17:24:42 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 49.231.31.220 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 49.231.31.220
country_id: 1605651
description:
2026-01-20 17:24:44 dovecot_login authenticator failed for H=([49.231.31.220]) [49.231.31.220]:64706: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.241.150.246
country_id: 2017370
description:
Jan 20 17:24:50 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.241.150.246 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 219.95.228.51
country_id: 1733045
description:
[2026-01-20 17:25:44 +0800] info [webmaild] 219.95.228.51 - support@u-net.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.184.86.15
country_id: 1269750
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/var-dumper/phpunit.xml.dist HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 17:32:08 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 17:33:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:11553: 535 Incorrect authentication data (set_id=WM Chan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.231.35
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/reject-carton-box?product_id=129 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.231.35
country_id: 1562822
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/reject-carton-box?product_id=129 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.159.16
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/question-some-questions-about-on-line-information/images/sliders/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/question-some-questions-about-on-line-information||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 17:35:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:19602: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.40
country_id: 2921044
description:
Jan 20 17:35:11 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.40 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 42.191.134.208
country_id: 1733045
description:
[2026-01-20 17:35:58 +0800] info [webmaild] 42.191.134.208 - cheahbanfoo@fkr.com.my "GET / HTTP/1.1" DEFERRED LOGIN webmaild: security token missing


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-20 17:36:55 H=(localhost.localdomain) [78.153.140.207]:60594 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 4.247.137.86
country_id: 1269750
domain: manforce.my
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:7.64||T:APACHE||MV:/wp-admin/includes/index.php||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 4.247.137.86
country_id: 1269750
domain: manforce.my
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home2/manforce/public_html/wp-includes||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 4.247.137.86
country_id: 1269750
domain: manforce.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/wp-admin/images/commentv.php||SC:/home2/manforce/public_html/wp-admin||


plugin: modsec
rule: 77350390
name: IM360 WAF: Interaction with fake plugin
abuser: 4.247.137.86
country_id: 1269750
domain: manforce.my
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/pwnd/as.php||WPU:||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.54
country_id: 3469034
description:
Jan 20 17:39:22 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.250
country_id: 2921044
description:
Jan 20 17:39:40 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.250 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.215.53.155
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/DependencyInjection/LoggerPass.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.62.85.184
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/reject-carton-box?product_id=346 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.62.85.184
country_id: 3865483
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/reject-carton-box?product_id=346 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 115.134.210.197
country_id: 1733045
domain: cofreth.com.my
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.64||T:APACHE||MVN:REQUEST_FILENAME||MV:/includes/contact-form.php||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 27.125.249.41
country_id: 1733045
domain: dsc-expat.com
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 14; CPH2359 Build/UKQ1.230924.001; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/143.0.7499.192 Mobile Safari/537.36 trill_430104 JsSdk/1.0 NetType/MOBILE Channel/googleplay AppName/trill app_version/43.1.4 ByteLocale/en-GB ByteFullLocale/en-GB Region/MY AppId/1180 Spark/1.7.2 AppVersion/43.1.4 PIA/2.5.3 RevealType/Dialog BytedanceWebview/d8a21c6||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.41
country_id: 2921044
description:
Jan 20 17:43:31 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.41 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 176.89.1.32
country_id: 298795
description:
2026-01-20 17:44:33 dovecot_plain authenticator failed for H=([89.116.164.85]) [176.89.1.32]:16072: 535 Incorrect authentication data (set_id=clients@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 17:44:51 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 17:46:15 H=([45.144.212.242]) [45.144.212.242]:52555 F=<no_reply@admin.com> rejected RCPT <yuki@ms-chemicals.net>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.132.248.149
country_id: 1733045
description:
2026-01-20 17:46:04 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.126]) [115.132.248.149]:59479: 535 Incorrect authentication data (set_id=info@aire-fresh.com)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 17:48:13 H=([45.144.212.242]) [45.144.212.242]:51088 F=<no_reply@admin.com> rejected RCPT <zainuddin@astlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.219
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/theme-elements.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.217
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/owl.carousel/assets/owl.theme.default.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.195
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/theme.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.178
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/demos/demo-business-consulting.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.206
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/rs-plugin/css/navigation.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/skins/skin-business-consulting.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 209.161.195.228
country_id: 6251999
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/box-bag HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.201
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/owl.carousel/assets/owl.carousel.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.136
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/magnific-popup/magnific-popup.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.147
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/rs-plugin/css/layers.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.244
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/animate/animate.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.223
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/rs-plugin/css/settings.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.152
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/font-awesome/css/fontawesome-all.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/vendor/linear-icons/css/linear-icons.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 17:49:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59981: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.185
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/www.pspoly.com.my/portfolio/css/custom.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.128.202
country_id: 3865483
description:
Jan 20 17:50:05 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.128.202 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.175.233
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/multi-purpose-box-m-sample?tag=multi purpose box - m size HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.175.233
country_id: 1562822
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/multi-purpose-box-m-sample?tag=multi purpose box - m size HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.147.237.158
country_id: 2542007
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/rsc-document-box-filebox-set-sample HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.147.237.158
country_id: 2542007
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/rsc-document-box-filebox-set-sample HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.20
country_id: 241170
description:
Jan 20 17:51:19 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.20 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 17:52:09 H=([46.151.182.48]) [46.151.182.48]:54588 F=<astpkg@astlog.com.my> rejected RCPT <astpkg@astlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 17:54:04 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 149.126.88.252
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:17-58.149.126.88.252||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 17:58:54 H=([45.144.212.242]) [45.144.212.242]:53048 F=<no_reply@admin.com> rejected RCPT <enquiry@symphony-led.com>: Sender verify failed


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<ul>\r\n<li class=\"msolistparagraphcxspfirst\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do released s/o tian poh enterprise for albert</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do released s/o(18 d) tsb-so-067912 &amp; 067913<span style=\"mso-spacerun: yes;\">&nbsp; </span>for daryl</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>updated daily collection report &amp; daily cash flow</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>posted assembly orders</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>send soa dec&rsquo;25 for cw choi racing</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>create new customer card &ldquo;barkat niaga&rdquo; for sam</li>\r\n<li class=\"msolistparagraphcxspmiddle\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do posting sales invoices &amp; filing sales invoice</li>\r\n<li class=\"msolistparagraphcxsplast\" style=\"text-indent: -0.25in;\"><span style=\"mso-ascii-font-family: aptos; mso-fareast-font-family: aptos; mso-hansi-font-family: aptos; mso-bidi-font-family: aptos;\"><span style=\"mso-list: ignore;\"><span style=\"font: 7.0pt 'times new roman';\">&nbsp; &nbsp; &nbsp;</span></span></span>do sales return</li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 18:01:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:11556: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.211.124.164
country_id: 1733045
description:
2026-01-20 18:03:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.0.15]) [113.211.124.164]:19610: 535 Incorrect authentication data (set_id=WM Chan)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 18:03:21 H=([45.144.212.242]) [45.144.212.242]:57870 F=<no_reply@admin.com> rejected RCPT <info@mkmetal.com.my>: Sender verify failed


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 46.151.182.48
country_id: 2750405
description:
2026-01-20 18:05:21 H=([46.151.182.48]) [46.151.182.48]:54362 F=<celine@ktlog.com.my> rejected RCPT <celine@ktlog.com.my>: smtp auth required


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 18:06:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 113.211.124.53
country_id: 1733045
description:
[2026-01-20 18:08:50 +0800] info [webmaild] 113.211.124.53 - s-osada@mckd.com.my "GET /cpsess0498528515/3rdparty/roundcube/skins/elastic/watermark.html HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.37.120
country_id: 3469034
description:
Jan 20 18:09:15 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.37.120 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.198.151.49
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/king/516/437366 HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 80.15.223.148
country_id: 3017382
description:
Jan 20 18:11:39 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 80.15.223.148 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 80.15.223.148
country_id: 3017382
description:
2026-01-20 18:11:41 dovecot_login authenticator failed for H=80-15-223-148.ftth.fr.orangecustomers.net [80.15.223.148]:58420: 535 Incorrect authentication data (set_id=myloo@euratech.com.my)


plugin: modsec
rule: 77391379
name: IM360 WAF: Possible XSS in arguments
abuser: 175.139.168.128
country_id: 1733045
domain: dailyreport.tallahesse.com
description:
IM360 WAF: Possible XSS in arguments||MV:<p><span style=\"text-decoration: underline;\"><strong>tuesday 20-jan-26</strong></span></p>\r\n<ul>\r\n<li>update tsb container arrival worksheet</li>\r\n<li>follow up clearance and delivery status for import container</li>\r\n<li>18d feb b container already out.</li>\r\n<li>apply permit</li>\r\n<li>arrange runner for phyto collection</li>\r\n<li>checking draft k1/k2</li>\r\n<li>prepare shpping document</li>\r\n<li>on forwarding and clearance side in tsb - having an issue on container arrangement as greenpen is short staff- since last thursday we pending container to come in. from 6 container waiting, only one container arrived as for now. spoke with their leader and sales already but seems the situation getting worst. still working for this.</li>\r\n<li>update tpy import schedule</li>\r\n<li>arrange kk return order and preparing shipping document</li>\r\n<li>proceed with kk#ngb shipment to be consolidate together</li>\r\n</ul>||RSV:7.64||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.185.233.251
country_id: 798544
description:
Jan 20 18:14:30 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.185.233.251 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 5.185.233.251
country_id: 798544
description:
2026-01-20 18:14:32 dovecot_plain authenticator failed for H=5.185.233.251.ipv4.public.orange.pl (trishmism) [5.185.233.251]:45420: 535 Incorrect authentication data (set_id=support@ajresorts.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 45.91.64.7
country_id: 2017370
description:
2026-01-20 18:14:46 424271 [Warning] Aborted connection 424271 to db: 'unconnected' user: 'unauthenticated' host: '45.91.64.7' (This connection closed normally without authentication)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-20 18:14:53 H=([45.144.212.242]) [45.144.212.242]:59629 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.141
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/css/layers.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.220
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/fancybox/jquery.fancybox.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 27.125.243.114
country_id: 1733045
description:
[2026-01-20 18:15:33 +0800] info [webmaild] 27.125.243.114 - jlpom@ajplantations.com.my "GET /cpsess2532273770/3rdparty/roundcube/?_task=mail&_action=list&_refresh=1&_layout=widescreen&_mbox=INBOX.Sent&_page=&_remote=1&_unlock=loading1768904132106&_=1768904131979 HTTP/1.1" DEFERRED LOGIN webmaild: cookie ip check: IP address has changed: IP Address [27.125.243.234] != Current IP Address [27.125.243.114]


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.150
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/animations/animate.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.216
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/revolutionslider/css/settings.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.190
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/bxslider/jquery.bxslider.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.177
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/miuiconfont/miuiconfont.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.144
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/css/pages-style.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.162
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/js/ytplayer/css/YTPlayer.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.251
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/css/bootstrap.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 115.135.25.89
country_id: 1733045
description:
2026-01-20 18:15:31 dovecot_plain authenticator failed for H=([89.116.164.85]) [115.135.25.89]:36465: 535 Incorrect authentication data (set_id=office@dsc-expat.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.158.252.27
country_id: 1643084
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/about-us.php HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.138
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/css/custom.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.202
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/assets/fontawesome/css/font-awesome.min.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.247
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/css/navigation.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.179
country_id: 1880251
domain: www.kimmark.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kimmark.com/vendor/rs-plugin/css/settings.css HTTP/1.1||RSV:7.64||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 172.117.252.153
country_id: 6252001
description:
2026-01-20 18:15:18 dovecot_plain authenticator failed for H=([89.116.164.85]) [172.117.252.153]:48911: 535 Incorrect authentication data (set_id=office@dsc-expat.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 203.161.55.17
country_id: 6252001
description:
Jan 20 18:15:45 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 203.161.55.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.251.102.22
country_id: 241170
description:
Jan 20 18:16:13 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.251.102.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-20 18:17:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:60113: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:18:33 sv3 pure-ftpd[1784096]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/images/charts/oxbold-clients-world-map-large.jpg uploaded  (321592 bytes, 7338.96KB/sec)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 123.193.152.64
country_id: 1668284
description:
2026-01-20 18:18:39 dovecot_login authenticator failed for H=123-193-152-64.dynamic.kbronet.com.tw [123.193.152.64]:60232: 535 Incorrect authentication data (set_id=gabriela_faulkner@sutsb.com.my)


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 175.139.178.45
country_id: 1733045
description:
[2026-01-20 18:18:29 +0800] info [webmaild] 175.139.178.45 - payment@tujusetia.my "GET /cpsess9134142965/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.202.230.214
country_id: 798544
description:
Jan 20 18:18:34 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.202.230.214 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 91.202.230.214
country_id: 798544
description:
2026-01-20 18:18:36 dovecot_plain authenticator failed for H=host-91-202-230-214.static.oc3.zagan.visnet.pl (uncidia) [91.202.230.214]:49749: 535 Incorrect authentication data (set_id=support@fkr.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 123.193.152.64
country_id: 1668284
description:
Jan 20 18:18:37 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 123.193.152.64 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:18:09 sv3 pure-ftpd[1783872]: (?@175.139.12.169) [INFO] New connection from 175.139.12.169


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-20 18:18:19 H=([31.145.189.54]) [31.145.189.54]:59267 F=<dse_NA2@docusign.net> rejected RCPT <fkr@fkr.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: ossec
rule: 11313
name: FTP file uploaded to server
abuser: 175.139.12.169
country_id: 1733045
description:
Jan 20 18:19:01 sv3 pure-ftpd[1784096]: (oxboldc@175.139.12.169) [NOTICE] /home/oxboldc//public_html/iframe/oxbold-clients-world-map.htm uploaded  (1363 bytes, 673.61KB/sec)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 125.32.245.134
country_id: 1814991
description:
Jan 20 18:19:29 sv3 auth[2729693]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 125.32.245.134 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.64||T:APACHE||MV:/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/img/photos/testimonial.php||


