# incident

plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.248
country_id: 1269750
description:
Jan 24 17:53:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.248 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.158
country_id: 3469034
description:
Jan 24 17:53:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/home/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/es/images/index.php||SC:/home/indfinitydesign/public_html/es||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.26.109.166
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=45021514883483 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 17:59:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.117.188.97
country_id: 3469034
description:
Jan 24 18:01:21 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.117.188.97 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.237.130.76
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=569531 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.189.121.189
country_id: 337996
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/3249053632.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.213.53
country_id: 933860
description:
Jan 24 18:03:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.213.53 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 18:03:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.229
country_id: 3865483
description:
Jan 24 18:03:53 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.60.212.209
country_id: 3175395
description:
Jan 24 18:03:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.60.212.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.0.46
country_id: 953987
description:
Jan 24 18:03:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.0.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.227.35.229
country_id: 3865483
description:
Jan 24 18:04:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.227.35.229 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.104.246
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86491516693580 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.157.212.152
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-06.185.157.212.152||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.123
country_id: 953987
description:
Jan 24 18:07:51 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.123 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.33.46
country_id: 953987
description:
Jan 24 18:08:30 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.33.46 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 18:08:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.49
country_id: 298795
description:
Jan 24 18:08:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.123
country_id: 953987
description:
Jan 24 18:08:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.123 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 18:08:06 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55707: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 139.59.77.241
country_id: 1269750
description:
Jan 24 18:10:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 139.59.77.241 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.77.241
country_id: 1269750
description:
2026-01-24 18:10:42 dovecot_login authenticator failed for H=(sahajav12dev-test) [139.59.77.241]:40700: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 139.59.77.241
country_id: 1269750
description:
2026-01-24 18:10:59 dovecot_login authenticator failed for H=(sahajav12dev-test) [139.59.77.241]:57116: 535 Incorrect authentication data (set_id=chew@nexuscollection.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.235
country_id: 6252001
description:
Jan 24 18:11:37 sv3 pure-ftpd[3152984]: (?@198.235.24.235) [INFO] New connection from 198.235.24.235


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 82.193.122.91
country_id: 690791
description:
Jan 24 18:12:32 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 82.193.122.91 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 82.193.122.91
country_id: 690791
description:
2026-01-24 18:12:34 dovecot_login authenticator failed for H=(82.193.122.91.cl.ipnet.ua) [82.193.122.91]:56605: 535 Incorrect authentication data (set_id=hello@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.0.122.173
country_id: 3469034
description:
Jan 24 18:15:20 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.0.122.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.107.82
country_id: 3865483
description:
Jan 24 18:15:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.107.82 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:15:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:18:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.123.178
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=513447 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 20.230.136.38
country_id: 6252001
domain: working.magsoft.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.161.71
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=731605 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.136
country_id: 2510769
description:
Jan 24 18:25:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:25:56 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.233.15.25
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-25.104.233.15.25||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.251
country_id: 3469034
description:
Jan 24 18:26:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.136
country_id: 2510769
description:
Jan 24 18:26:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:28:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.66.178.169
country_id: 2017370
description:
Jan 24 18:31:17 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.66.178.169 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.152
country_id: 3077311
description:
Jan 24 18:31:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.22
country_id: 2750405
description:
Jan 24 18:31:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.152
country_id: 3077311
description:
2026-01-24 18:31:48 dovecot_plain authenticator failed for H=([10.22.18.175]) [212.102.39.152]:42609: 535 Incorrect authentication data (set_id=rayerlink@agpc.org.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.248.57.90
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=43301526631723 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 95.66.178.169
country_id: 2017370
description:
2026-01-24 18:31:19 dovecot_plain authenticator failed for H=(mernes) [95.66.178.169]:50060: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.151.182.21
country_id: 2750405
description:
Jan 24 18:31:38 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.151.182.21 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:31:43 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 212.102.39.152
country_id: 3077311
description:
Jan 24 18:32:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 212.102.39.152 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:32:09 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.121.51.247
country_id: 1668284
description:
2026-01-24 18:32:55 H=([45.121.51.247]) [45.121.51.247]:51582 F=<huntington-alerts@huntington.net> rejected RCPT <sales@webhosting2u.com>: Sender verify failed


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 212.102.39.152
country_id: 3077311
description:
2026-01-24 18:32:01 dovecot_plain authenticator failed for H=([10.22.18.175]) [212.102.39.152]:56200: 535 Incorrect authentication data (set_id=entral@agpc.org.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:33:58 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 117.213.245.175
country_id: 1269750
description:
Jan 24 18:34:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 117.213.245.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.114.140.70
country_id: 3469034
description:
Jan 24 18:35:15 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.114.140.70 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 18:36:05 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55731: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 24 18:37:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 24 18:38:04 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:38:10 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.2.57
country_id: 690791
description:
Jan 24 18:38:14 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.2.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.196.171.117
country_id: 3469034
description:
Jan 24 18:40:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.196.171.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.19
country_id: 953987
description:
Jan 24 18:40:52 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.19 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 18:40:10 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:37382: 535 Incorrect authentication data (set_id=support@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.19
country_id: 953987
description:
Jan 24 18:41:00 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.19 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:41:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 176.123.1.159
country_id: 617790
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/126.0.7.0 Safari/537.35||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.213.194.254
country_id: 1269750
description:
Jan 24 18:42:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.213.194.254 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/residential/img/press.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: www.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/about-us/faq/images/about.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.39
country_id: 719819
description:
Jan 24 18:46:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/photos/private-residence.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 18:46:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.21.78
country_id: 2300660
description:
Jan 24 18:46:19 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.21.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:46:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.48.181.39
country_id: 719819
description:
Jan 24 18:47:01 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.48.181.39 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.187.222.93
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=76 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 18:49:34 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 18:52:11 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 124.13.192.28
country_id: 1733045
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=758571 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.244.67.30
country_id: 3996063
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Profiler/FileProfilerStorage.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.94.247
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=947582 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 216.180.105.15
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:18-58.216.180.105.15||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 18:59:18 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.20.58.176
country_id: 798544
description:
Jan 24 19:01:26 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.20.58.176 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.182.22.173
country_id: 690791
description:
Jan 24 19:01:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.182.22.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.155.135.23
country_id: 3469034
description:
Jan 24 19:01:55 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.155.135.23 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.155.135.23
country_id: 3469034
description:
Jan 24 19:02:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.155.135.23 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 19:04:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55775: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 128.127.94.68
country_id: 798544
description:
Jan 24 19:05:40 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 128.127.94.68 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.100.199.10
country_id: 3658394
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/mockery/mockery/library/Mockery/Recorder.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.43.93
country_id: 953987
description:
Jan 24 19:06:24 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.43.93 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-24 19:07:27 +0800] info [cpaneld] 202.178.120.157 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 19:09:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.227.39
country_id: 3437598
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phar-io/manifest/src/ManifestDocumentMapper.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 19:11:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.213
country_id: 3175395
description:
Jan 24 19:11:29 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.213 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.50
country_id: 3469034
description:
Jan 24 19:11:49 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.240.96.50
country_id: 3469034
description:
Jan 24 19:12:03 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.240.96.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 19:12:46 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:14:47 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.103.166
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=1310 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 19:16:08 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:65165: 535 Incorrect authentication data (set_id=updated)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 19:16:06 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.137
country_id: 3469034
description:
Jan 24 19:17:44 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.137
country_id: 3469034
description:
Jan 24 19:17:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.137 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.38.123
country_id: 953987
description:
Jan 24 19:18:07 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.38.123 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 81.29.142.100
country_id: 2017370
description:
2026-01-24 19:18:30 655834 [Warning] Aborted connection 655834 to db: 'unconnected' user: 'unauthenticated' host: '81.29.142.100' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.110.119.106
country_id: 732800
description:
Jan 24 19:19:25 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.110.119.106 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:19:39 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.35.162
country_id: 3469034
description:
Jan 24 19:19:45 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.35.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.37.35.162
country_id: 3469034
description:
Jan 24 19:19:59 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.37.35.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:20:50 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.171.52.38
country_id: 587116
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=35131515047305 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 81.29.142.100
country_id: 2017370
description:
2026-01-24 19:21:59 655936 [Warning] Aborted connection 655936 to db: 'unconnected' user: 'unauthenticated' host: '81.29.142.100' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 81.29.142.100
country_id: 2017370
description:
2026-01-24 19:21:59 655937 [Warning] Aborted connection 655937 to db: 'unconnected' user: 'unauthenticated' host: '81.29.142.100' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.120
country_id: 3175395
description:
Jan 24 19:23:12 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.120 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.63
country_id: 3057568
description:
Jan 24 19:24:28 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.63 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.226.117
country_id: 3469034
description:
Jan 24 19:24:48 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.226.117 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 168.0.226.117
country_id: 3469034
description:
Jan 24 19:25:02 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 168.0.226.117 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.228.22.60
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=51101516002847 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.162
country_id: 226074
description:
Jan 24 19:27:54 sv3 auth[485642]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 19:29:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.27.72
country_id: 2658434
description:
Jan 24 19:31:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.27.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:31:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.246
country_id: 3469034
description:
Jan 24 19:31:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.225.217.246
country_id: 3469034
description:
Jan 24 19:32:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.225.217.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 19:32:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55812: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.107.170
country_id: 3469034
description:
Jan 24 19:32:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.107.170 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.235
country_id: 2300660
description:
Jan 24 19:33:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:33:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.209
country_id: 953987
description:
Jan 24 19:33:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.209 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:34:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:36:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.135
country_id: 933860
description:
Jan 24 19:36:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 19:36:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.8.49.44
country_id: 3469034
description:
Jan 24 19:36:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.8.49.44 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.175.57.143
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=841251 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.182.189.180
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=17431532676481 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:39:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:40:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.139.125.103
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:19-40.45.139.125.103||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.139
country_id: 1269750
description:
Jan 24 19:42:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 19:41:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.75.139
country_id: 1269750
description:
Jan 24 19:43:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.75.139 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.35
country_id: 1269750
description:
Jan 24 19:45:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.35 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.74.246
country_id: 3469034
description:
Jan 24 19:46:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.74.246 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.131.121
country_id: 3469034
description:
Jan 24 19:46:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.131.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.27.72
country_id: 2658434
description:
Jan 24 19:46:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.27.72 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 19:49:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.160.146
country_id: 1269750
description:
Jan 24 19:50:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.227.160.146 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.190.162.118
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/exhibition.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.49
country_id: 798544
description:
Jan 24 19:53:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.30.230
country_id: 226074
description:
Jan 24 19:54:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.30.230 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.177
country_id: 2510769
description:
Jan 24 19:54:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.231.35.49
country_id: 798544
description:
Jan 24 19:54:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.231.35.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 19:55:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.177
country_id: 2510769
description:
Jan 24 19:55:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:55:14 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.201.189
country_id: 953987
description:
Jan 24 19:55:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.201.189 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.124.196.127
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=98641523525547 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 19:56:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.178.64.135
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=470762 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 19:58:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:58:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 19:59:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 156.204.67.24
country_id: 357994
domain: aoto.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:test01.aoto.com.my||ServerName:aoto.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:e71c6710f020493fcedae0122fa4314a2ecd9201||Title:0x1c8c5b6a||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 20:00:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55834: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:00:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.179.3.79
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=25 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.101.88.45
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=11 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.230.143.4
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=5601 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.125.27.72
country_id: 2658434
description:
Jan 24 20:04:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.125.27.72 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.134.140.136
country_id: 6252001
domain: 127.0.0.1
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/127.0.0.1/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 20:06:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.254.130.129
country_id: 1814991
description:
Jan 24 20:06:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.254.130.129 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/commercial/img/awards.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.237.77.34
country_id: 1880251
description:
Jan 24 20:08:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.237.77.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 20:09:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.61.199.212
country_id: 6252001
description:
Jan 24 20:10:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.61.199.212 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.61.199.212
country_id: 6252001
description:
2026-01-24 20:10:17 dovecot_plain authenticator failed for H=c-24-61-199-212.hsd1.ct.comcast.net (spialiker) [24.61.199.212]:50678: 535 Incorrect authentication data (set_id=ramin.fpp@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:13:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.195.2.245
country_id: 1269750
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=705554 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 20:16:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.56.152.243
country_id: 298795
description:
Jan 24 20:16:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.56.152.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.237.77.34
country_id: 1880251
description:
Jan 24 20:16:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.237.77.34 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.158.227
country_id: 1861060
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/img/slider-images/Cover3.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:20:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.88.127.249
country_id: 1835841
description:
Jan 24 20:20:37 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.88.127.249 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 87.205.109.219
country_id: 798544
description:
Jan 24 20:20:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 87.205.109.219 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/es/img/photos/press.php||SC:/home/indfinitydesign/public_html/es||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 223.254.130.129
country_id: 1814991
description:
Jan 24 20:20:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 223.254.130.129 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.88.127.249
country_id: 1835841
description:
2026-01-24 20:20:39 dovecot_login authenticator failed for H=([220.88.127.249]) [220.88.127.249]:59829: 535 Incorrect authentication data (set_id=noreply@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.56.152.243
country_id: 298795
description:
Jan 24 20:21:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.56.152.243 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/awards.php||SC:/home/indfinitydesign/public_html/img/photos/awards.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 20:25:05 H=(localhost.localdomain) [78.153.140.207]:52468 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/run/tmpfiles.d/static-nodes.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/products.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 20:26:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 2.56.152.243
country_id: 298795
description:
Jan 24 20:26:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 2.56.152.243 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 20:26:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 64.227.160.146
country_id: 1269750
description:
Jan 24 20:28:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 64.227.160.146 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 20:28:41 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:38355: 535 Incorrect authentication data (set_id=office@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 20:28:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55875: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:29:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.169.22.162
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=93 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.253
country_id: 3175395
description:
Jan 24 20:30:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.253 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:32:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.156
country_id: 953987
description:
Jan 24 20:32:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.156
country_id: 953987
description:
Jan 24 20:32:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.251
country_id: 1269750
description:
Jan 24 20:33:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 20:36:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 94.237.77.34
country_id: 1880251
description:
Jan 24 20:38:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 94.237.77.34 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.26
country_id: 3469034
description:
Jan 24 20:37:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.35.74
country_id: 953987
description:
Jan 24 20:38:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.35.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.103.29.83
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/league/flysystem/src/NotSupportedException.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.136.104
country_id: 3175395
description:
Jan 24 20:42:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.136.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 185.131.55.232
country_id: 1269750
domain: www.ms-chemicals.net
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/nul.AWBWSW5356.cer||User:mschemic||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.13.136.104
country_id: 3175395
description:
Jan 24 20:43:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.13.136.104 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/products.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 20:46:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 20:46:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 20:46:20 H=(localhost.localdomain) [78.153.140.207]:38354 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-24 20:47:46 +0800] info [cpaneld] 202.178.120.157 - maalloys "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user maalloys (has_cpuser_file failed)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/about.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.189.199.195
country_id: 3469034
description:
Jan 24 20:49:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.189.199.195 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.36.248.179
country_id: 3469034
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=967928 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 24 20:49:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.181.215.88
country_id: 3469034
description:
Jan 24 20:50:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.181.215.88 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.116.42.196
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=2&page_id=1&sub=6 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 20:51:13 H=(localhost.localdomain) [78.153.140.207]:50902 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.51.2
country_id: 953987
description:
Jan 24 20:52:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.51.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.168.240
country_id: 3469034
description:
Jan 24 20:55:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.168.240 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 20:56:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55909: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.152.26.169
country_id: 3469034
description:
Jan 24 20:56:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.152.26.169 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.86.131
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/AmqpCaster.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.249.252.196
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/facilities.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.33
country_id: 3469034
description:
Jan 24 21:01:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.33 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.223.91
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=14031527237554 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:03:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.98.53
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=38041515376878 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.96.235.132
country_id: 1210997
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/var-dumper/Caster/ConstStub.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.174.225.34
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/hu/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:05:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.27.133.134
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/hu HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.249.171
country_id: 248816
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ApacheRequestTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 202.178.120.157
country_id: 1831722
description:
[2026-01-24 21:06:17 +0800] info [cpaneld] 202.178.120.157 - afcmalaysia "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user afcmalaysia (has_cpuser_file failed)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.221.78.73
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/img/photos/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:08:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 157.50.189.190
country_id: 1269750
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=86361516002399 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:17:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:18:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.226.27.227
country_id: 294640
description:
Jan 24 21:17:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.226.27.227 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.226.27.227
country_id: 294640
description:
2026-01-24 21:18:01 dovecot_plain authenticator failed for H=(reies) [109.226.27.227]:41422: 535 Incorrect authentication data (set_id=bcteh@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:18:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 21:19:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 8.138.154.105
country_id: 1814991
description:
2026-01-24 21:19:49 660004 [Warning] Aborted connection 660004 to db: 'unconnected' user: 'unauthenticated' host: '8.138.154.105' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:20:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.161.135.10
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25311526631175 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.78.162
country_id: 3469034
description:
Jan 24 21:23:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.190.78.162
country_id: 3469034
description:
Jan 24 21:24:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.190.78.162 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 21:24:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:59084: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.214.138.78
country_id: 2510769
description:
Jan 24 21:24:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.214.138.78 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.211
country_id: 3469034
description:
Jan 24 21:25:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.211 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.223.3.190
country_id: 1269750
description:
Jan 24 21:25:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.223.3.190 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.226.115.112
country_id: 3057568
description:
Jan 24 21:27:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.226.115.112 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.61.10.49
country_id: 3865483
description:
Jan 24 21:27:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.61.10.49 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.57.173
country_id: 953987
description:
Jan 24 21:29:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.57.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.47.190
country_id: 2300660
description:
Jan 24 21:29:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.47.190 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 31.57.43.249
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:21-30.31.57.43.249||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:30:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.191.236.220
country_id: 3469034
description:
Jan 24 21:31:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.191.236.220 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.202
country_id: 6252001
description:
Jan 24 21:31:07 sv3 pure-ftpd[3279122]: (?@167.94.138.202) [INFO] New connection from 167.94.138.202


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 78.153.140.207
country_id: 2635167
description:
2026-01-24 21:31:33 H=(localhost.localdomain) [78.153.140.207]:40160 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 F=<no-reply@no-reply.com> rejected RCPT <a@b12.siagabaja.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.191.236.220
country_id: 3469034
description:
Jan 24 21:32:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.191.236.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 92.55.226.47
country_id: 798544
description:
Jan 24 21:32:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 92.55.226.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:34:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:36:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.119
country_id: 6252001
description:
2026-01-24 21:36:13 660573 [Warning] Aborted connection 660573 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.119' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:38:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:39:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:39:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:40:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 21:40:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.159.121.156
country_id: 3865483
description:
Jan 24 21:41:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.159.121.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.90.134
country_id: 732800
description:
Jan 24 21:41:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.90.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 79.100.90.134
country_id: 732800
description:
Jan 24 21:42:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 79.100.90.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 21:44:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.41
country_id: 617790
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/78.0.3904.70 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 21:45:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 102.88.108.81
country_id: 2328926
description:
[2026-01-24 21:47:15 +0800] info [webmaild] 102.88.108.81 - boonpau.tan@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password hash is missing from system (user probably does not exist)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.48.157.56
country_id: 3865483
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=992414 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 194.41.120.239
country_id: 2635167
domain: www.feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/certificate.php||SC:/home2/feliogroupcom/public_html/images/certificate.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 139.28.122.162
country_id: 2635167
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/product.php||SC:/home2/feliogroupcom/public_html/images/product.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 194.44.201.154
country_id: 690791
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=90 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 152.39.139.101
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/contact.php||SC:/home2/feliogroupcom/public_html/images/contact.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 193.42.56.176
country_id: 2635167
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/index.php||SC:/home2/feliogroupcom/public_html/images/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 162.43.233.208
country_id: 6252001
domain: feliogroup.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/about.php||SC:/home2/feliogroupcom/public_html/images/about.php||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.71.105.198
country_id: 3469034
domain: box.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:94381.box.my||ServerName:box.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:fb166f3e24f43ba754706d223a0b116e2aa5b07b||Title:0xb9508123||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 21:52:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55831: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.255.73.229
country_id: 1269750
description:
Jan 24 21:53:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.255.73.229 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 21:53:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 45.71.105.198
country_id: 3469034
domain: box.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:49505.box.com.my||ServerName:box.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c08e50e11825a2e20130a824308ffdd23eae4932||Title:0xef3b39bf||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.187.220.190
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=25011514882695 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.186.35.33
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=443235 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 24 22:03:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.9.9
country_id: 2300660
description:
Jan 24 22:03:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.9.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 22:04:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.42.116
country_id: 2395170
description:
Jan 24 22:04:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.42.116 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.9.9
country_id: 2300660
description:
Jan 24 22:04:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.9.9 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.101.194.172
country_id: 690791
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=434148 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.108.242
country_id: 3469034
description:
Jan 24 22:08:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.108.242 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 22:08:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 191.102.131.2
country_id: 3608932
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-09.191.102.131.2||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.52.133.243
country_id: 3437598
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=360128 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 179.190.96.234
country_id: 3469034
description:
Jan 24 22:13:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 179.190.96.234 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 22:14:29 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:38246: 535 Incorrect authentication data (set_id=help@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/img/private-residence.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.233.205.35
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?page_id=22 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 67.204.23.4
country_id: 6252001
description:
Jan 24 22:15:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 67.204.23.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.195
country_id: 3469034
description:
Jan 24 22:16:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.125
country_id: 3469034
description:
Jan 24 22:17:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.228.33.57
country_id: 798544
description:
Jan 24 22:17:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.228.33.57 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 183.167.193.127
country_id: 1814991
description:
Jan 24 22:20:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 183.167.193.127 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 183.167.193.127
country_id: 1814991
description:
2026-01-24 22:20:24 dovecot_login authenticator failed for H=([183.167.193.127]) [183.167.193.127]:34997: 535 Incorrect authentication data (set_id=help@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 22:20:03 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55878: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 22:20:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 22:20:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.10.210.68
country_id: 732800
description:
Jan 24 22:21:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.10.210.68 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 46.10.210.68
country_id: 732800
description:
2026-01-24 22:21:24 dovecot_plain authenticator failed for H=(lationg) [46.10.210.68]:57983: 535 Incorrect authentication data (set_id=vsloh@mckd.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 22:21:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.179.189.84
country_id: 3469034
description:
Jan 24 22:23:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.179.189.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 166.0.161.72
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-24.166.0.161.72||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 35.77.8.203
country_id: 1861060
description:
Jan 24 22:25:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 35.77.8.203 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 22:27:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.148.73
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97471515379533 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 22:28:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.187.162
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=670535 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 24 22:33:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 24 22:34:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.113.44
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=174516 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.62.116.11
country_id: 3439705
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=48691516782865 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.72.28
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=34&sub=91 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.78.140.118
country_id: 2802361
description:
2026-01-24 22:41:38 663000 [Warning] Aborted connection 663000 to db: 'unconnected' user: 'unauthenticated' host: '34.78.140.118' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 34.78.140.118
country_id: 2802361
description:
2026-01-24 22:42:21 663285 [Warning] Aborted connection 663285 to db: 'unconnected' user: 'unauthenticated' host: '34.78.140.118' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.2.249.160
country_id: 3469034
description:
Jan 24 22:43:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.2.249.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.96.161
country_id: 3865483
description:
Jan 24 22:44:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.96.161 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 24 22:44:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.2.249.160
country_id: 3469034
description:
Jan 24 22:44:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.2.249.160 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 194.44.75.122
country_id: 690791
description:
Jan 24 22:44:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 194.44.75.122 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.252.173
country_id: 1562822
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/product-category.php?id=5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.253.159.94
country_id: 732800
description:
Jan 24 22:45:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.253.159.94 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 169.149.227.12
country_id: 1269750
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/variousactivities.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 22:48:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55901: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 145.223.59.128
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:22-49.145.223.59.128||RSV:7.67||T:APACHE||


plugin: cl_dos
name: DOS detection
abuser: 152.53.52.160
country_id: 6252001
description:
2026-01-24 22:51:48.01375265 +0800 +08 m=+688196.247193055 Denial of Service attack was discovered from 152.53.52.160, on port 443. Open connections: 475


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.185.159.75
country_id: 953987
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=381667 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.20.50
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=70&page=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.109.92.55
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=600737 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 24 22:55:37 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 22:57:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 22:58:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.206.70.75
country_id: 1831722
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/video.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:01:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.37.77.227
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=71251516863446 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.34.199
country_id: 6252001
description:
Jan 24 23:07:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.34.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:08:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 43.153.34.199
country_id: 6252001
description:
Jan 24 23:08:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 43.153.34.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:10:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 24 23:11:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.232.119.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 210.97.109.192
country_id: 1835841
description:
Jan 24 23:12:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 210.97.109.192 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 210.97.109.192
country_id: 1835841
description:
2026-01-24 23:13:00 dovecot_login authenticator failed for H=([210.97.109.192]) [210.97.109.192]:52634: 535 Incorrect authentication data (set_id=orders@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.232.119.77
country_id: 2921044
description:
Jan 24 23:13:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.232.119.77 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 221.199.73.233
country_id: 1814991
description:
Jan 24 23:14:42 sv3 pure-ftpd[3343518]: (?@221.199.73.233) [INFO] New connection from 221.199.73.233


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 23:14:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 23:14:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:65485: 535 Incorrect authentication data (set_id=volgograd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 23:14:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 189.44.133.238
country_id: 3469034
description:
Jan 24 23:15:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 189.44.133.238 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 189.44.133.238
country_id: 3469034
description:
2026-01-24 23:15:07 dovecot_login authenticator failed for H=(189-56-191-126.customer.tdatabrasil.net.br) [189.44.133.238]:60239: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 1.9.150.182
country_id: 1733045
description:
2026-01-24 23:16:02 dovecot_plain authenticator failed for H=([IPv6:::ffff:192.168.1.5]) [1.9.150.182]:55938: 535 Incorrect authentication data (set_id=amirul@ms-chemicals.net)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 206.0.24.177
country_id: 3686110
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 40.76.167.156
country_id: 6252001
description:
Jan 24 23:18:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 40.76.167.156 has been locked due to Imunify RBL


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.210.132.14
country_id: 1269750
description:
[2026-01-24 23:19:13 +0800] info [cpaneld] 103.210.132.14 - agpc "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user agpc (has_cpuser_file failed)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:20:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 150.228.189.205
country_id: 1694008
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/run/systemd/system.control/imunify360-agent.service.d/50-CPUQuota.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.29.221.123
country_id: 3439705
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?page=92 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.30.139.241
country_id: 1694008
description:
2026-01-24 23:26:53 dovecot_plain authenticator failed for H=(DRACO.tail1faf7e.ts.net) [149.30.139.241]:51129: 535 Incorrect authentication data (set_id=kevinliau@medigo.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:26:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 149.30.139.241
country_id: 1694008
description:
Jan 24 23:26:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 149.30.139.241 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.72.160
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-26.92.71.72.160||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 24 23:27:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 23:27:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:50938: 535 Incorrect authentication data (set_id=wts)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 149.30.139.241
country_id: 1694008
description:
2026-01-24 23:26:59 dovecot_login authenticator failed for H=(DRACO.tail1faf7e.ts.net) [149.30.139.241]:51129: 535 Incorrect authentication data (set_id=kevinliau@medigo.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.26.147
country_id: 798544
description:
Jan 24 23:27:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.26.147 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 23:27:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:27:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 162.142.125.199
country_id: 6252001
description:
Jan 24 23:30:25 sv3 pure-ftpd[3353970]: (?@162.142.125.199) [INFO] New connection from 162.142.125.199


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 24 23:31:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 222.254.239.104
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87811515566080 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:35:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:38:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/login.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/about-us||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 23:40:41 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63376: 535 Incorrect authentication data (set_id=script)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 23:40:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 156.241.212.216
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-41.156.241.212.216||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/cdn-cgi/l/sitemap.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.78.247.150
country_id: 1269750
description:
Jan 24 23:44:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.78.247.150 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-24 23:44:59 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:37126: 535 Incorrect authentication data (set_id=finance@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.122.81.39
country_id: 953987
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/ramsey/uuid/CODE_OF_CONDUCT.md HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.140.167.69
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=74351515570613 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 24 23:48:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/company.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.8
country_id: 690791
description:
Jan 24 23:50:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 199.34.88.5
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-51.199.34.88.5||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.5.8
country_id: 690791
description:
Jan 24 23:50:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.5.8 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.249.53.31
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-52.104.249.53.31||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/testimonial.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.88.92
country_id: 1168579
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=79591514882509 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 24 23:53:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.96.55.37
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-53.116.96.55.37||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-24 23:53:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57057: 535 Incorrect authentication data (set_id=asd)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.204.244
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:23-55.171.224.204.244||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 205.210.31.170
country_id: 6252001
description:
Jan 24 23:57:28 sv3 pure-ftpd[3372198]: (?@205.210.31.170) [INFO] New connection from 205.210.31.170


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.229.61.203
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/resources/views/admin/clients/index.blade.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:00:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 00:01:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.54
country_id: 1269750
description:
Jan 25 00:02:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:05:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 00:06:49 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60454: 535 Incorrect authentication data (set_id=B'Trey)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.242
country_id: 6252001
description:
2026-01-25  0:06:02 666587 [Warning] Aborted connection 666587 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.242' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/asia/images/tyresafetytips.php||SC:/home2/fkrcom/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.47.83.21
country_id: 732800
description:
Jan 25 00:08:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.47.83.21 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.8
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/man/pt/index.db||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.3
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/cache/dnf/packages.db||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.222
country_id: 226074
description:
Jan 25 00:10:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.222 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 00:10:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.159.91.180
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteColumnStackedChart2.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 213.211.80.153
country_id: 1522867
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/Controller HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.43.133.122
country_id: 719819
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/Tests/Fixtures/Controller/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 00:13:26 H=([45.144.212.242]) [45.144.212.242]:65198 F=<no_reply@admin.com> rejected RCPT <garylee@autogreastar.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.10.98
country_id: 226074
description:
Jan 25 00:15:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.10.98 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.122.97.196
country_id: 3996063
description:
Jan 25 00:16:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.122.97.196 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.232.147.60
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=872055 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.171.206
country_id: 1210997
domain: www.mkmetal.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mkmetal.com.my/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.224.108.55
country_id: 3469034
description:
Jan 25 00:18:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.224.108.55 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 00:19:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.130.169.125
country_id: 3469034
description:
Jan 25 00:19:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.130.169.125 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:19:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.35
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/c-bible/images/resource/index.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.46.136.83
country_id: 3865483
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=60091516587529 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.85
country_id: 3469034
description:
Jan 25 00:19:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.85 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 00:19:59 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56278: 535 Incorrect authentication data (set_id=ike)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.85.104.85
country_id: 3469034
description:
Jan 25 00:20:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.85.104.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.74.6.71
country_id: 2395170
description:
Jan 25 00:23:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.74.6.71 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.18.235
country_id: 2300660
description:
Jan 25 00:23:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.18.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.133.200
country_id: 690791
description:
Jan 25 00:23:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.133.200 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.251
country_id: 1269750
description:
Jan 25 00:23:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.251 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.54
country_id: 3469034
description:
Jan 25 00:23:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.180
country_id: 798544
description:
Jan 25 00:23:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.178.155
country_id: 3175395
description:
Jan 25 00:23:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.178.155 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.126
country_id: 953987
description:
Jan 25 00:23:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.169.30
country_id: 3175395
description:
Jan 25 00:24:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.169.30 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.32.126
country_id: 953987
description:
Jan 25 00:23:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.32.126 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/img||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 117.0.180.43
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:00-25.117.0.180.43||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.171
country_id: 3175395
description:
Jan 25 00:26:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.171 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.24.182.58
country_id: 1269750
description:
Jan 25 00:27:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.24.182.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 00:28:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.0.0.50
country_id: 3469034
description:
Jan 25 00:28:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.0.0.50 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:32:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.55.105.252
country_id: 1269750
description:
Jan 25 00:33:37 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.55.105.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 00:33:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 00:33:43 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:59215: 535 Incorrect authentication data (set_id=sks)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.154.16
country_id: 690791
description:
Jan 25 00:34:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.154.16 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.54
country_id: 3175395
description:
Jan 25 00:34:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.26.179.54
country_id: 3175395
description:
Jan 25 00:35:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.26.179.54 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.32.66
country_id: 298795
description:
Jan 25 00:35:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.32.66 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.102.9.144
country_id: 3469034
domain: tst-ma.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/tst-ma.com/recond/wp-content/themes/cordobo-green-park-2/img/top-sprite.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:39:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.37.29
country_id: 953987
description:
Jan 25 00:41:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.37.29 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 83.143.30.75
country_id: 933860
description:
Jan 25 00:42:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 83.143.30.75 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 38.80.62.78
country_id: 1269750
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/61-urw-z003.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 170.79.98.42
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=39921515046027 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.184.172.67
country_id: 1210997
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/1568199212.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.234.178
country_id: 1562822
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/5730437046.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.123.81.11
country_id: 248816
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/1611853303.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.94.228.240
country_id: 3437598
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/6125494826.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.229.118.248
country_id: 1562822
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/4029879185.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.128.246.221
country_id: 690791
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/4012497733.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.64.22.19
country_id: 1522867
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/8239495639.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.151.175.151
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/6370697018.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 197.244.156.32
country_id: 2464461
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/www.google-analytics.com/analytics.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.204.211.71
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=849737 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.189.31.168
country_id: 3865483
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/product.php?page=96 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 176.29.246.131
country_id: 248816
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/assets/plugins/jquery.easing.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.244.10.182
country_id: 1562822
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/7834857109.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 106.200.4.122
country_id: 1269750
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/9540148620.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.151.171.169
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=881760 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.90.172.167
country_id: 192950
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/6812744878.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.151.119.108
country_id: 3595528
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/img/photos/3147220600.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.29.13
country_id: 798544
description:
Jan 25 00:48:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.29.13 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 00:48:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 00:48:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:54175: 535 Incorrect authentication data (set_id=benz)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/lib64/cracklib_dict.pwd||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 00:49:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 156.238.61.238
country_id: 1819730
domain: www.snymetalstamping.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.snymetalstamping.com/fpl-soft-umx/assets/pic/0.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.235.24.85
country_id: 6252001
description:
2026-01-25  0:51:19 668054 [Warning] Aborted connection 668054 to db: 'unconnected' user: 'unauthenticated' host: '198.235.24.85' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.255.29.44
country_id: 3624060
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/press-details.php?id=578354 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.48.57
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.45.3.48.57||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.48.3
country_id: 6252001
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.45.3.48.3||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 154.213.165.132
country_id: 2921044
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.154.213.165.132||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.116
country_id: 6252001
description:
Jan 25 00:52:25 sv3 pure-ftpd[3405255]: (?@198.235.24.116) [INFO] New connection from 198.235.24.116


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.3.44.218
country_id: 2510769
domain: geminiflourmill.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:00-52.45.3.44.218||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/lkwconstructions/mysql.sql||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.76.241.47
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=453297 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.104.17
country_id: 3175395
description:
Jan 25 00:58:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.104.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.84.202.230
country_id: 1269750
description:
Jan 25 00:58:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.84.202.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/acburnco/homedir/etc/acburnco.rcube.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.226.24.207
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=40431514882203 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/acburnco/homedir/etc/acburn.com.my/sales.rcube.db||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.72.78.204
country_id: 3469034
description:
Jan 25 01:01:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.72.78.204 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/acburnco/homedir/mail/dovecot.mailbox.log||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 01:02:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.33.97
country_id: 660013
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/G09-051 -Lami PP 2-150x150.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 178.93.33.97
country_id: 660013
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/G09-051 -Lami PP 2-150x150.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 01:02:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 01:02:35 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61109: 535 Incorrect authentication data (set_id=adonix)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.243
country_id: 6252001
description:
2026-01-25  1:04:55 668414 [Warning] Aborted connection 668414 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.243' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.98.222.146
country_id: 3865483
description:
Jan 25 01:09:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.98.222.146 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 01:09:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 25 01:10:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 01:10:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/clean-commerce/third-party/images/sliders/news.php||SC:/home/sutsbcom/public_html/wp-content/themes/clean-commerce||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.177
country_id: 953987
description:
Jan 25 01:11:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.64.46.177
country_id: 953987
description:
Jan 25 01:12:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.64.46.177 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 193.43.230.6
country_id: 798544
description:
Jan 25 01:12:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 193.43.230.6 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 72.241.202.104
country_id: 6252001
description:
2026-01-25 01:12:15 dovecot_plain authenticator failed for H=cm-72-241-202-104.buckeyecom.net (epdoak) [72.241.202.104]:38766: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 25 01:13:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.135.240
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=599376 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 124.228.32.34
country_id: 1814991
description:
Jan 25 01:15:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 124.228.32.34 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 124.228.32.34
country_id: 1814991
description:
2026-01-25 01:15:02 dovecot_login authenticator failed for H=([124.228.32.34]) [124.228.32.34]:41814: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.44.238
country_id: 2300660
description:
Jan 25 01:17:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.44.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 01:17:12 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 01:17:14 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56027: 535 Incorrect authentication data (set_id=sftpuser)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.150
country_id: 3865483
description:
Jan 25 01:18:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.150 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.178
country_id: 3469034
description:
Jan 25 01:18:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.178 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.11
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/named.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.128.143
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/c-bible/images/resource/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 217.113.194.6
country_id: 3017382
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/lib/tmpfiles.d/tmp.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.150
country_id: 3865483
description:
Jan 25 01:19:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.150 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.229.177
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=52 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.13.61.56
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=15211514884198 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.166
country_id: 1269750
description:
Jan 25 01:25:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 170.82.52.136
country_id: 3469034
description:
Jan 25 01:25:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 170.82.52.136 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.166
country_id: 1269750
description:
Jan 25 01:26:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.166 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 01:26:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 01:27:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.141
country_id: 6252001
description:
Jan 25 01:29:05 sv3 pure-ftpd[3426598]: (?@198.235.24.141) [INFO] New connection from 198.235.24.141


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.106.240
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=735818 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 01:31:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 01:31:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57374: 535 Incorrect authentication data (set_id=save)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 89.223.118.100
country_id: 1522867
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=299091 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.126
country_id: 3469034
description:
Jan 25 01:38:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.63.132.238
country_id: 3175395
description:
Jan 25 01:38:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.63.132.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.54.180
country_id: 953987
description:
Jan 25 01:39:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.54.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.88.3
country_id: 3469034
description:
Jan 25 01:39:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.88.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.126
country_id: 3469034
description:
Jan 25 01:39:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.164.246.134
country_id: 1269750
description:
Jan 25 01:39:23 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.164.246.134 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.22.88.3
country_id: 3469034
description:
Jan 25 01:40:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.22.88.3 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 01:41:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.96.176.109
country_id: 3469034
domain: www.ahfengineering.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.ahfengineering.com/cgi-bin HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.108.98.162
country_id: 294640
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/news-detail.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.22.28.28
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=212395 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 01:45:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 01:45:28 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53167: 535 Incorrect authentication data (set_id=badin)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.179.149.12
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=222966 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 65.20.251.208
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=192351 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.112.151.20
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=942713 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 118.179.17.225
country_id: 1210997
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=4&page_id=1&sub=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 01:47:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.61.245.162
country_id: 2017370
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/finder/Iterator/CustomFilterIterator.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.164.235.253
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=28 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.2.49
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 161.142.118.151
country_id: 1733045
description:
[2026-01-25 01:48:34 +0800] info [webmaild] 161.142.118.151 - s-osada@mckd.com.my "GET /cpsess6293287042/3rdparty/roundcube/?_task=mail&_mbox=INBOX HTTP/1.1" DEFERRED LOGIN webmaild: security token incorrect


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.160.171.210
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=794941 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/mysql/symphony_live.sql||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/homedir/symphony_live.sql||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/homedir/etc/symphony-led.com/account.rcube.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.236.113.34
country_id: 1269750
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=19 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.166.251.251
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=7 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.165.118
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.165.222.152
country_id: 3469034
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=8&page_id=1&sub=13 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 152.201.206.151
country_id: 3686110
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/egulias/email-validator/EmailValidator/EmailParser.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.189.128.141
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.184.112.89
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=7&page_id=1&sub=42 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.227.55.27
country_id: 2464461
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=135803 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.148.34
country_id: 99237
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/teamwork.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/mysql.sql||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.196.201.145
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=308206 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/symphonyadmin/userdata/symphony-led.com||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.242.162.102
country_id: 953987
domain: www.aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.aoto.com.my/product-detail.php?id=1816520570 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.145.161
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=268452 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.175.76.148
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=697884 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/tptecadmin/mysql.sql||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 02:00:24 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:59064: 535 Incorrect authentication data (set_id=ldapauth)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.63.199
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=444310 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.165.211.149
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.188.79.205
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?page_id=27 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 02:00:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/webhost/mysql/webhost_wp_enoprint.sql||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.161.17.128
country_id: 3996063
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-detail.php?id=224566 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.84.216
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/product-category.php?id=5&page_id=1&sub=18 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/webhost/mysql/webhost_wp458.sql||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/languages/images/sliders/images/sliders/about.php||SC:/home/sutsbcom/public_html/wp-content/languages||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/thinkcloudadmin/mysql/thinkcloudadmin_db.sql||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.80.20.75
country_id: 3017382
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-03.151.80.20.75||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.111
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/egbwawasancom/mysql.sql||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 151.80.20.75
country_id: 3017382
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:02-04.151.80.20.75||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 98.156.153.241
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/backup/weekly/2026-01-03/accounts/chokeeintcom/mysql/chokeeintcom_wp_upuxy.sql||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.243.164.163
country_id: 1562822
domain: www.geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.geminiflourmill.com/oriental.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 72.44.31.170
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2856 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.229.168
country_id: 1269750
description:
Jan 25 02:08:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.229.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.229.168
country_id: 1269750
description:
2026-01-25 02:08:56 dovecot_login authenticator failed for H=(nsg-corporate-168.229.187.122.airtel.in) [122.187.229.168]:54406: 535 Incorrect authentication data (set_id=press@kimmark.com)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 95.181.233.161
country_id: 2993457
description:
Jan 25 02:10:39 sv3 pure-ftpd[3449879]: (?@95.181.233.161) [INFO] New connection from 95.181.233.161


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 95.134.63.74
country_id: 2921044
description:
2026-01-25  2:10:38 670612 [Warning] Aborted connection 670612 to db: 'unconnected' user: 'unauthenticated' host: '95.134.63.74' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 02:14:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 02:14:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64077: 535 Incorrect authentication data (set_id=pergamum)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.154.231.7
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=672005 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 196.198.13.105
country_id: 241170
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-17.196.198.13.105||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.255.47
country_id: 798544
description:
Jan 25 02:17:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.255.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 91.235.255.47
country_id: 798544
description:
Jan 25 02:18:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 91.235.255.47 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.198.123
country_id: 3996063
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=759894 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.126
country_id: 2300660
description:
Jan 25 02:18:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.139.28.126
country_id: 2300660
description:
Jan 25 02:18:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.139.28.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.24
country_id: 298795
description:
Jan 25 02:19:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.252
country_id: 690791
description:
Jan 25 02:21:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.147.252
country_id: 690791
description:
Jan 25 02:22:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.147.252 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 25 02:28:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 181.41.244.218
country_id: 3865483
description:
Jan 25 02:28:41 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 181.41.244.218 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/news.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 02:29:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 02:29:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63753: 535 Incorrect authentication data (set_id=jiang)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.2
country_id: 1269750
description:
Jan 25 02:29:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.2 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 195.49.212.124
country_id: 1522867
description:
Jan 25 02:29:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 195.49.212.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 109.248.48.112
country_id: 2017370
domain: nexuscollection.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:02-30.109.248.48.112||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.185.118.74
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22861516002507 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/career.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.154.113.158
country_id: 2510769
description:
Jan 25 02:34:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.154.113.158 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.180
country_id: 1269750
description:
Jan 25 02:36:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.249.41.218
country_id: 2542007
description:
Jan 25 02:37:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.249.41.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.249.41.218
country_id: 2542007
description:
2026-01-25 02:37:52 dovecot_plain authenticator failed for H=([192.168.1.7]) [41.249.41.218]:65422: 535 Incorrect authentication data (set_id=kitty.yap@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.87.207.149
country_id: 6252001
description:
Jan 25 02:38:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.87.207.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.212.51.241
country_id: 630336
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/product-detail.php?id=5080364288 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 02:42:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.174
country_id: 3469034
description:
Jan 25 02:43:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.174 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 02:44:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 02:44:56 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64164: 535 Incorrect authentication data (set_id=erdw)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 171.22.235.151
country_id: 3175395
description:
Jan 25 02:46:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 171.22.235.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.85
country_id: 2510769
description:
Jan 25 02:48:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.39.212.85
country_id: 2510769
description:
Jan 25 02:49:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.39.212.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.28.36
country_id: 798544
description:
Jan 25 02:49:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.28.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.119.250
country_id: 226074
description:
Jan 25 02:49:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.119.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.87.207.149
country_id: 6252001
description:
Jan 25 02:50:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.87.207.149 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 117.4.81.106
country_id: 1562822
description:
2026-01-25 02:52:08 dovecot_login authenticator failed for H=([117.4.81.106]) [117.4.81.106]:58900: 535 Incorrect authentication data (set_id=team@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.190.150.82
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=95561520648895 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 3.87.207.149
country_id: 6252001
description:
Jan 25 02:54:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 3.87.207.149 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.78.146
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-54.92.71.78.146||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 188.130.186.136
country_id: 2017370
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-55.188.130.186.136||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.70.109
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:02-56.142.111.70.109||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.19.247.63
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=91851514942605 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 147.185.132.51
country_id: 6252001
description:
Jan 25 02:57:49 sv3 pure-ftpd[3476361]: (?@147.185.132.51) [INFO] New connection from 147.185.132.51


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.183.86
country_id: 3469034
description:
Jan 25 02:58:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.183.86 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:00:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52710: 535 Incorrect authentication data (set_id=AB\023)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/home/residential.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 165.227.134.232
country_id: 2921044
description:
Jan 25 03:03:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 165.227.134.232 has been locked due to Imunify RBL


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.204.116.36
country_id: 6252001
domain: symphony-led.com
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/120.0.6099.224 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.197
country_id: 1269750
description:
Jan 25 03:05:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.197 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 36.64.30.151
country_id: 1643084
description:
Jan 25 03:05:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 36.64.30.151 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.132
country_id: 6290252
description:
Jan 25 03:05:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.132 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.213.168
country_id: 1819730
description:
2026-01-25  3:05:01 672416 [Warning] Aborted connection 672416 to db: 'unconnected' user: 'unauthenticated' host: '152.32.213.168' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.206.98.132
country_id: 6290252
description:
Jan 25 03:06:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.206.98.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 92.40.177.58
country_id: 2635167
domain: af-sb.com
description:
IM360 WAF: Track spam in PrestaShop||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.156.11.17
country_id: 6252001
description:
Jan 25 03:07:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.156.11.17 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/ways-to-develop-a-project-on-the-net-classroom/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/faq.php||SC:/home/sutsbcom/public_html/ways-to-develop-a-project-on-the-net-classroom||


plugin: modsec
rule: 77142097
name: IM360 WAF: Track spam via contactform for WordPress
abuser: 92.40.177.58
country_id: 2635167
domain: af-sb.com
description:
IM360 WAF: Track spam via contactform for WordPress||RSV:7.67||T:APACHE||MVN:REQUEST_URI||MV:/wp-json/contact-form-7/v1/contact-forms/6/feedback||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.18.30
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=739548 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 166.156.11.17
country_id: 6252001
description:
Jan 25 03:08:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 166.156.11.17 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 71.6.134.230
country_id: 6252001
description:
2026-01-25  3:10:43 672590 [Warning] Aborted connection 672590 to db: 'unconnected' user: 'unauthenticated' host: '71.6.134.230' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.207.17
country_id: 953987
description:
Jan 25 03:11:53 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.207.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 197.234.207.17
country_id: 953987
description:
Jan 25 03:12:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 197.234.207.17 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 213.74.192.74
country_id: 298795
description:
Jan 25 03:12:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 213.74.192.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 03:15:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:15:47 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51302: 535 Incorrect authentication data (set_id=fd)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.106.18
country_id: 226074
description:
Jan 25 03:15:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.106.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 196.0.106.18
country_id: 226074
description:
Jan 25 03:16:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 196.0.106.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.122.133.157
country_id: 3865483
description:
Jan 25 03:16:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.122.133.157 has been locked due to Imunify RBL


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 86.54.25.143
country_id: 458258
description:
86.54.25.143 - - [25/Jan/2026:03:22:26 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=7312582&pdata=https%253A%252F%252Fmail.tujusetia.my%253A2096%252Fwebmaillogout.cgi&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769282544 HTTP/2.0" 302 0 mail.tujusetia.my "https://mail.tujusetia.my:2096/webmaillogout.cgi" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:86.54.25.143


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 86.54.25.143
country_id: 458258
description:
[2026-01-25 03:22:29 +0800] info [webmaild] 86.54.25.143 - payment@tujusetia.my "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN webmaild: user password incorrect


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 91.208.197.125
country_id: 617790
domain: maalloys.com.my
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_66) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/94.0.4606.61 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 182.95.187.22
country_id: 1269750
description:
Jan 25 03:27:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 182.95.187.22 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 182.95.187.22
country_id: 1269750
description:
2026-01-25 03:27:28 dovecot_plain authenticator failed for H=(secia) [182.95.187.22]:46632: 535 Incorrect authentication data (set_id=hrd@kendek.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 03:29:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:29:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51205: 535 Incorrect authentication data (set_id=counter)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.177.36
country_id: 298795
description:
Jan 25 03:29:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.177.36 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/demos/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.104.199
country_id: 3469034
description:
Jan 25 03:30:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.104.199 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.173
country_id: 3469034
description:
Jan 25 03:30:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.30.177.36
country_id: 298795
description:
Jan 25 03:30:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.30.177.36 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.30.81.226
country_id: 1269750
description:
Jan 25 03:31:12 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.30.81.226 has been locked due to Imunify RBL


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 103.218.240.172
country_id: 1819730
description:
2026-01-25  3:32:22 673299 [Warning] Aborted connection 673299 to db: 'unconnected' user: 'unauthenticated' host: '103.218.240.172' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.18.166.168
country_id: 1269750
description:
Jan 25 03:33:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.18.166.168 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 50.117.73.127
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-33.50.117.73.127||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.107.168.5
country_id: 2635167
description:
Jan 25 03:34:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.107.168.5 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 109.107.168.5
country_id: 2635167
description:
2026-01-25 03:34:22 dovecot_plain authenticator failed for H=([109.107.168.5]) [109.107.168.5]:59590: 535 Incorrect authentication data (set_id=shutters@col.com.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.101
country_id: 6252001
description:
2026-01-25  3:35:55 673383 [Warning] Aborted connection 673383 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.101' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.79.238
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-42.92.71.79.238||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.174.230.40
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=234981 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 03:44:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:44:12 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61989: 535 Incorrect authentication data (set_id=serveur)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.121.11.105
country_id: 953987
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/chalk/13/172/1353973 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.132
country_id: 3469034
description:
Jan 25 03:45:57 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.132 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.15.171.9
country_id: 3175395
description:
Jan 25 03:46:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.15.171.9 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.132
country_id: 3469034
description:
Jan 25 03:46:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.132 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.162.58
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-us/images/sliders/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/about-us||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.236.149.194
country_id: 3658394
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/activity-details.php?id=526194 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 89.186.26.236
country_id: 798544
description:
Jan 25 03:47:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 89.186.26.236 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 196.206.48.164
country_id: 2542007
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=22681514863685 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/contact.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 46.174.73.235
country_id: 798544
description:
Jan 25 03:52:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 46.174.73.235 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.50.1
country_id: 953987
description:
Jan 25 03:52:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.50.1 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/images/luxury-interior-design-service-malaysia.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.126
country_id: 3469034
description:
Jan 25 03:54:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.126 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.126
country_id: 3469034
description:
Jan 25 03:55:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.126 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.92
country_id: 690791
description:
2026-01-25 03:55:30 H=([77.83.39.92]) [77.83.39.92]:57434 F=<MeshaMatar@proton.me> rejected RCPT <munch@nexuscollection.com>: Mailbox is full / Blocks limit exceeded / Inode limit exceeded


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 45.39.31.246
country_id: 3077311
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:03-56.45.39.31.246||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/malaysia-infinity-design-projects/images/video.php||SC:/home/indfinitydesign/public_html/malaysia-infinity-design-projects||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.58.220
country_id: 1269750
description:
Jan 25 03:58:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.58.220 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.172.11.153
country_id: 1269750
description:
Jan 25 03:58:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.172.11.153 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 03:59:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 03:59:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61347: 535 Incorrect authentication data (set_id=qw)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.121.51.247
country_id: 1668284
description:
2026-01-25 03:59:23 H=([45.121.51.247]) [45.121.51.247]:59776 F=<huntington-alerts@huntington.net> rejected RCPT <sales@webhosting2u.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 03:59:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.54.232.6
country_id: 6252001
domain: hmz.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-00.142.54.232.6||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/images/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 49.42.178.49
country_id: 1269750
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=185808 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/testimonial.php||SC:/home/indfinitydesign/public_html/images/testimonial.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 91.109.163.62
country_id: 3625428
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/hu/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.67.38.54
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/phpoffice/phpexcel/Classes/PHPExcel/locale/hu HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 106.75.164.40
country_id: 1814991
description:
2026-01-25  4:04:36 674378 [Warning] Aborted connection 674378 to db: 'unconnected' user: 'unauthenticated' host: '106.75.164.40' (This connection closed normally without authentication)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.227
country_id: 1269750
description:
2026-01-25 04:07:56 dovecot_login authenticator failed for H=(nsg-corporate-227.230.187.122.airtel.in) [122.187.230.227]:49331: 535 Incorrect authentication data (set_id=webmaster@tujusetia.my)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 205.210.31.193
country_id: 6252001
description:
2026-01-25  4:07:27 674459 [Warning] Aborted connection 674459 to db: 'unconnected' user: 'unauthenticated' host: '205.210.31.193' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.140.4
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 73.199.161.144
country_id: 6252001
description:
Jan 25 04:09:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 73.199.161.144 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 73.199.161.144
country_id: 6252001
description:
2026-01-25 04:09:50 dovecot_plain authenticator failed for H=c-73-199-161-144.hsd1.nj.comcast.net (terific) [73.199.161.144]:53468: 535 Incorrect authentication data (set_id=bak@kendek.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 116.96.57.220
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-11.116.96.57.220||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 131.255.220.193
country_id: 3469034
description:
Jan 25 04:12:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 131.255.220.193 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.177.200.216
country_id: 3865483
description:
Jan 25 04:13:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.177.200.216 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 04:14:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 04:14:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56917: 535 Incorrect authentication data (set_id=read)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.145.57.168
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/clients.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.191.189.219
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=898173 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 154.127.44.4
country_id: 2395170
description:
Jan 25 04:19:25 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 154.127.44.4 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.76.67
country_id: 3469034
description:
Jan 25 04:20:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.76.67 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.49.146
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-20.198.145.49.146||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 167.94.138.125
country_id: 6252001
description:
Jan 25 04:21:39 sv3 pure-ftpd[3530818]: (?@167.94.138.125) [INFO] New connection from 167.94.138.125


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.176.180.253
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=18 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.234.180.130
country_id: 3686110
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-foundation/Tests/ExpressionRequestMatcherTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 171.224.200.141
country_id: 1562822
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-25.171.224.200.141||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/services/images/sliders/cdn-cgi/l/cdn-cgi/l/osl.php||SC:/home/sutsbcom/public_html/services||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 194.165.16.166
country_id: 2993457
description:
Jan 25 04:28:08 sv3 pure-ftpd[3538834]: (?@194.165.16.166) [INFO] New connection from 194.165.16.166


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 04:29:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 04:29:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53168: 535 Incorrect authentication data (set_id=movil)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.136.174
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/images/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.153.56
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/sliders/monthly-report.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.63
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/themes/images/sliders/cdn-cgi/l/cdn-cgi/l/index.php||SC:/home/sutsbcom/public_html/wp-content/themes/images||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/images/sliders/cdn-cgi/l/Personal_Dosimetry_Service.php||SC:/home/sutsbcom/public_html/wp-content/images||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.79
country_id: 1269750
description:
Jan 25 04:37:51 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.216.25.43
country_id: 798544
description:
Jan 25 04:37:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.216.25.43 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.70.126.79
country_id: 1269750
description:
Jan 25 04:38:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.70.126.79 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 217.75.222.32
country_id: 3077311
description:
Jan 25 04:38:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 217.75.222.32 has been locked due to Imunify RBL


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 04:39:08 H=([45.144.212.242]) [45.144.212.242]:53839 F=<no_reply@admin.com> rejected RCPT <mustapa@astlog.com.my>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.96.241
country_id: 3469034
description:
Jan 25 04:39:30 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.96.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.70
country_id: 3865483
description:
Jan 25 04:39:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.70 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.202.97.209
country_id: 3865483
description:
Jan 25 04:40:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.202.97.209 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 223.123.126.174
country_id: 1168579
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/filp/whoops/src/Whoops/Run.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.146.195
country_id: 690791
description:
Jan 25 04:41:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.146.195 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.230
country_id: 3469034
description:
Jan 25 04:41:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.230 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.94.239.55
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravelcollective/html/src/FormBuilder.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 04:44:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/images/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 04:44:10 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57849: 535 Incorrect authentication data (set_id=cap)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/article.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.235
country_id: 3469034
description:
Jan 25 04:46:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.235 has been locked due to Imunify RBL


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 68.183.214.113
country_id: 2921044
description:
Jan 25 04:46:34 sv3 pure-ftpd[3553500]: (?@68.183.214.113) [INFO] New connection from 68.183.214.113


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.124.218.43
country_id: 3865483
description:
Jan 25 04:46:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.124.218.43 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/druma_photos/private-residence.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.84
country_id: 690791
description:
Jan 25 04:47:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.247.189.61
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=340379 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/about-sinaran-utama-teknologi/images/faq.php||SC:/home/sutsbcom/public_html/about-sinaran-utama-teknologi||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.0.84
country_id: 690791
description:
Jan 25 04:48:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.0.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 190.185.109.151
country_id: 6251999
domain: af-sb.com
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:04-49.190.185.109.151||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/project.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 134.122.88.178
country_id: 2921044
description:
Jan 25 04:51:53 sv3 pure-ftpd[3555876]: (?@134.122.88.178) [INFO] New connection from 134.122.88.178


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.155.44
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/esg.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 158.94.211.33
country_id: 6252001
description:
2026-01-25 04:53:29 H=([158.94.211.33]) [158.94.211.33]:55232 F=<Nencia1@outlook.com> rejected RCPT <cklee@ktlog.com.my>: SPF: 158.94.211.33 is not allowed to send mail from outlook.com


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.167.74.228
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=518721 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.104.207
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:04-56.146.103.104.207||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 04:57:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 04:57:33 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52140: 535 Incorrect authentication data (set_id=sda)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.129.199
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/cdn-cgi/l/Survey_Meter_Calibration.php||SC:/home/sutsbcom/public_html/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.79.19.141
country_id: 953987
description:
Jan 25 05:03:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.79.19.141 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.137.135
country_id: 3469034
description:
Jan 25 05:03:33 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.137.135 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.78
country_id: 3469034
description:
Jan 25 05:05:20 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.78 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:08:26 dovecot_login authenticator failed for H=(ULDgV4) [185.169.4.24]:57584: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 185.21.13.251
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-08.185.21.13.251||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.89.136.185
country_id: 3469034
description:
Jan 25 05:09:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.89.136.185 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.173
country_id: 3469034
description:
Jan 25 05:09:47 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.173 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:09:15 dovecot_login authenticator failed for H=(5I3sdq0Lwf) [185.169.4.24]:57343: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.128.173
country_id: 3469034
description:
Jan 25 05:10:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.128.173 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.214.29
country_id: 933860
description:
Jan 25 05:10:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.214.29 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:10:06 dovecot_login authenticator failed for H=(KnLDnLHsaI) [185.169.4.24]:50278: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 190.171.78.71
country_id: 3686110
description:
Jan 25 05:11:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 190.171.78.71 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:11:19 dovecot_login authenticator failed for H=(dBAwKVJW) [185.169.4.24]:61383: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 05:11:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 05:11:44 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56759: 535 Incorrect authentication data (set_id=lori)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.152.218
country_id: 690791
description:
Jan 25 05:11:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.152.218 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:12:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate_chaah@ajplantations.com.my has been locked for the attacker IP 185.169.4.24


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.208.156.158
country_id: 241170
description:
Jan 25 05:12:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.208.156.158 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:12:13 dovecot_login authenticator failed for H=(vzDYzK) [185.169.4.24]:62002: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.208.156.158
country_id: 241170
description:
2026-01-25 05:12:30 dovecot_login authenticator failed for H=(ADMIN) [185.208.156.158]:38258: 535 Incorrect authentication data (set_id=jasinpack@jpack.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.152.218
country_id: 690791
description:
Jan 25 05:12:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.152.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:13:02 dovecot_login authenticator failed for H=(Xo2MLUQY) [185.169.4.24]:55299: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:13:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6011
name: Imunify PAM. The account has been locked for the attacker IP
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:13:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_IPUL] The account corporate_chaah@ajplantations.com.my has been locked for the attacker IP 185.169.4.24


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 69.62.166.196
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/45-generic.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:14:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:14:17 dovecot_login authenticator failed for H=(PGQY2fL) [185.169.4.24]:55202: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:15:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:15:11 dovecot_login authenticator failed for H=(l8vjeFL9x) [185.169.4.24]:49718: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:16:04 dovecot_login authenticator failed for H=(jVyC6G) [185.169.4.24]:57120: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 05:16:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:16:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 73.188.82.95
country_id: 6252001
domain: ocned.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET https:/ocned.com/news.php?i=10 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:17:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:17:18 dovecot_login authenticator failed for H=(ZT6rQS) [185.169.4.24]:59216: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:18:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:18:09 dovecot_login authenticator failed for H=(I3RgmtT) [185.169.4.24]:56064: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:19:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:19:24 dovecot_login authenticator failed for H=(JxNkpWgP) [185.169.4.24]:51944: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.244
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-19.108.165.238.244||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:20:11 dovecot_login authenticator failed for H=(8ht2fYsg) [185.169.4.24]:53392: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:20:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:21:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:21:24 dovecot_login authenticator failed for H=(vSGs3vY) [185.169.4.24]:51476: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:22:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:22:13 dovecot_login authenticator failed for H=(Q6fh03jM) [185.169.4.24]:52764: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.240.128
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:root||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.57.69.227
country_id: 690791
description:
2026-01-25 05:23:09 dovecot_login authenticator failed for H=(227.69.57.37.triolan.net) [37.57.69.227]:42207: 535 Incorrect authentication data (set_id=security@tujusetia.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:23:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 3.101.240.128
country_id: 6252001
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/nice ports,/Trinity.txt.bak||User:tuju7822||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:23:02 dovecot_login authenticator failed for H=(8MXqfs) [185.169.4.24]:62977: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.57.69.227
country_id: 690791
description:
Jan 25 05:23:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.57.69.227 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:24:14 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:24:16 dovecot_login authenticator failed for H=(1BCDZyjP) [185.169.4.24]:54434: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:25:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:25:05 dovecot_login authenticator failed for H=(SwdSETG) [185.169.4.24]:51321: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 05:25:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 05:25:46 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60058: 535 Incorrect authentication data (set_id=aip)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:26:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:26:18 dovecot_login authenticator failed for H=(0byWCKwQPm) [185.169.4.24]:52763: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:27:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:27:07 dovecot_login authenticator failed for H=(kxlPDMwjs) [185.169.4.24]:60702: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:28:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:28:20 dovecot_login authenticator failed for H=(xypICUt0) [185.169.4.24]:53901: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:29:09 dovecot_login authenticator failed for H=(xuUfV7i) [185.169.4.24]:62842: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:29:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.169.4.24
country_id: 2635167
description:
Jan 25 05:30:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.169.4.24 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 185.169.4.24
country_id: 2635167
description:
2026-01-25 05:30:20 dovecot_login authenticator failed for H=(hc0qrFdo) [185.169.4.24]:62833: 535 Incorrect authentication data (set_id=corporate_chaah@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/imunify360/imunify360-ipsetlists.db||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 138.229.106.161
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-34.138.229.106.161||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 206.168.34.45
country_id: 6252001
description:
2026-01-25  5:35:28 677780 [Warning] Aborted connection 677780 to db: 'unconnected' user: 'unauthenticated' host: '206.168.34.45' (This connection closed normally without authentication)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/var/imunify360/proactive.db||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 142.111.54.114
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-37.142.111.54.114||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 05:39:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 05:39:04 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56303: 535 Incorrect authentication data (set_id=blah)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.50.50.1
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=8&sub=11 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.91.250.17
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/img/photos/index.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.187.112
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/img/photos/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.19.5.40
country_id: 2635167
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/bag/13/97/1316311 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.78.175
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=65&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.134.81.54
country_id: 1819730
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/company/csr/environment.htm HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.189
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/main.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 47.246.171.154
country_id: 1880251
domain: www.mckd.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mckd.com.my/en/css/common.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 57.129.81.152
country_id: 2921044
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/img/photos/news.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 05:52:14 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 05:52:16 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63981: 535 Incorrect authentication data (set_id=insta)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 82.22.235.233
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:05-55.82.22.235.233||RSV:7.67||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 185.190.140.132
country_id: 3017382
domain: kainanholding.com
description:
IM360 WAF: Found crawler not in whitelist||RSV:7.67||T:APACHE||RA:185.190.140.132||TA:185.190.140.132||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 37.19.216.146
country_id: 6252001
description:
37.19.216.146 - - [25/Jan/2026:06:00:21 +0800] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10013080&pdata=https%253A%252F%252Fwww.ds-staffing.com%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1769292017 HTTP/2.0" 302 0 www.ds-staffing.com "https://www.ds-staffing.com:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:37.19.216.146


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.210.254
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88361515570398 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 14.235.68.30
country_id: 1562822
domain: www.usfood.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/news-and-events.php||SC:/home2/usfoodcom/public_html/img/news-and-events.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.104.207
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-02.146.103.104.207||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 06:06:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 06:06:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53193: 535 Incorrect authentication data (set_id=astrid)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.28.243
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=286855 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.221.149.85
country_id: 690791
description:
Jan 25 06:11:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.221.149.85 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.84
country_id: 3469034
description:
Jan 25 06:11:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.84 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.185.147.84
country_id: 3469034
description:
Jan 25 06:11:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.185.147.84 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.162.74.9
country_id: 3658394
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=44841515043556 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.165.39.127
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=69&page=7 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 111.61.176.245
country_id: 1814991
description:
Jan 25 06:17:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 111.61.176.245 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 111.61.176.245
country_id: 1814991
description:
2026-01-25 06:17:15 dovecot_login authenticator failed for H=([111.61.176.245]) [111.61.176.245]:44570: 535 Incorrect authentication data (set_id=info@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.164.176.179
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/css/extralayers.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.181.181.45
country_id: 1210997
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/css/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 140.84.162.226
country_id: 3996063
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/css/style.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 37.131.104.165
country_id: 290291
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/bootstrap/js/bootstrap.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 64.43.154.240
country_id: 2963597
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/bootstrap/css/bootstrap.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.122.90.167
country_id: 3865483
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/moderniz.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.208.56.191
country_id: 3996063
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/font-awesome/fonts/fontawesome-webfont862f.woff?v=4.1.0 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.194.188.35
country_id: 3996063
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery-1.11.1.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 5.0.167.248
country_id: 163843
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/js/app.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.174.209.212
country_id: 831053
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.theme.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 95.57.235.98
country_id: 1522867
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.sticky.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.8.97.188
country_id: 3625428
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/js/jquery.themepunch.tools.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 151.244.153.86
country_id: 99237
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/font-awesome/css/font-awesome.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.56.208.29
country_id: 953987
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.mmenu.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.26.14.237
country_id: 3865483
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/feature.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.163.61.55
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.carousel.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.31.178.38
country_id: 1210997
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/owl/owl-carousel/owl.carousel.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.241.163
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/cube/jquery.cubeportfolio.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.171.60.42
country_id: 3625428
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/js/jquery.themepunch.revolution.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.189.241.59
country_id: 1562822
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/jquery.mmenu.min.js HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.148.180.232
country_id: 3686110
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/cube/cubeportfolio.min.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.45.156.48
country_id: 3895114
domain: solidfence.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/solidfence.com.my/assets/plugins/revolution/rs-plugin/css/settings.css HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 06:19:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 06:19:56 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:55359: 535 Incorrect authentication data (set_id=prints)


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 89.83.25.136
country_id: 3017382
description:
[2026-01-25 06:21:24 +0800] info [whostmgrd] 89.83.25.136 - root "GET /login/?login_only=1&user=root&pass=__HIDDEN__&goto_uri=%2F HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.222.12.180
country_id: 798544
description:
Jan 25 06:21:46 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.222.12.180 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.237.57.100
country_id: 1269750
description:
Jan 25 06:22:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.237.57.100 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 165.73.163.202
country_id: 953987
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/product-knowledge.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.51.121.102
country_id: 3625428
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/debug/Tests/Fixtures/FinalClasses.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.249.112
country_id: 3625428
domain: nmahir.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nmahir.com/index-3.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.177.129
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=62511515979613 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.33.67.229
country_id: 3469034
domain: www.usfood.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.usfood.com.my/product-details.php?id=602547 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 06:33:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 06:33:57 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57190: 535 Incorrect authentication data (set_id=recona)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 162.142.125.125
country_id: 6252001
description:
2026-01-25  6:33:40 679967 [Warning] Aborted connection 679967 to db: 'unconnected' user: 'unauthenticated' host: '162.142.125.125' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 06:35:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.163.154.54
country_id: 3895114
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=212395 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.239
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/img/img/demos/img/new-development.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.23.121
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-category.php?id=5&page_id=5 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.44.71.145
country_id: 3469034
description:
Jan 25 06:42:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.44.71.145 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.197.8.122
country_id: 3175395
description:
Jan 25 06:42:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.197.8.122 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.226.154.124
country_id: 3469034
description:
Jan 25 06:42:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.226.154.124 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.175
country_id: 732800
description:
Jan 25 06:42:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.175 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.226.154.124
country_id: 3469034
description:
Jan 25 06:43:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.226.154.124 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 167.250.138.60
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/number/141/242150 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.49.146
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:06-46.198.145.49.146||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 06:47:24 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63463: 535 Incorrect authentication data (set_id=alexandr)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 06:47:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.99.74.247
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/maennchen/zipstream-php/test/BigintTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.161.146.46
country_id: 1562822
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=3087 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.25.239.39
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73301515047031 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.0.95.215
country_id: 3508796
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=93811516691972 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:01:03 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:58335: 535 Incorrect authentication data (set_id=vm01)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:01:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 46.143.155.64
country_id: 102358
domain: aoto.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aoto.com.my/contact.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 45.238.106.159
country_id: 3865483
description:
Jan 25 07:03:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 45.238.106.159 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.133
country_id: 2510769
description:
Jan 25 07:03:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 176.103.4.239
country_id: 690791
description:
Jan 25 07:03:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 176.103.4.239 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 73.130.145.198
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/35-lang-normalize.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.145.43.133
country_id: 2510769
description:
Jan 25 07:03:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.145.43.133 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.11.251.78
country_id: 3469034
description:
Jan 25 07:04:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.11.251.78 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.115.171.157
country_id: 3923057
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/templates/32readwriteSurfaceChart1.xlsx HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 61.3.24.69
country_id: 1269750
description:
Jan 25 07:12:45 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 61.3.24.69 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.124.240.66
country_id: 1835841
description:
Jan 25 07:13:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.124.240.66 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.89.94.7
country_id: 192950
description:
Jan 25 07:13:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.89.94.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.227.168
country_id: 1269750
description:
Jan 25 07:13:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.227.168 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:14:12 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.89.94.7
country_id: 192950
description:
Jan 25 07:14:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.89.94.7 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:14:14 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60532: 535 Incorrect authentication data (set_id=testing3)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 31.141.216.143
country_id: 298795
description:
Jan 25 07:16:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 31.141.216.143 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 78.186.54.65
country_id: 298795
description:
Jan 25 07:16:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 78.186.54.65 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 31.141.216.143
country_id: 298795
description:
2026-01-25 07:16:02 dovecot_login authenticator failed for H=([31.141.216.143]) [31.141.216.143]:53124: 535 Incorrect authentication data (set_id=sales@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.168.48.12
country_id: 1562822
domain: vc-b.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/vc-b.com.my/images/son.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.83.101.114
country_id: 2245662
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Foundation HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 212.70.109.7
country_id: 289688
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/laravel/framework/src/Illuminate/Foundation/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 198.235.24.249
country_id: 6252001
description:
Jan 25 07:23:50 sv3 pure-ftpd[3642853]: (?@198.235.24.249) [INFO] New connection from 198.235.24.249


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.136.132
country_id: 1562822
domain: fkr.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/fkr.com.my/about.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.120.46.79
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=73401515569897 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:27:58 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:57559: 535 Incorrect authentication data (set_id=saundra)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:27:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 146.103.104.207
country_id: 2750405
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-32.146.103.104.207||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.234.132.85
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/press.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/druma.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 92.71.74.134
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:07-38.92.71.74.134||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.213.184
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=85611515979972 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/press.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:41:04 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:41:06 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56461: 535 Incorrect authentication data (set_id=ea)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 191.82.78.195
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/symfony/http-kernel/EventListener/AbstractTestSessionListener.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.31.171.169
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&sub=23 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 07:53:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 174.66.50.72
country_id: 6252001
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/10-sub-pixel-bgr.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.24.101.120
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=36&page=87 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 07:54:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 07:54:26 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61585: 535 Incorrect authentication data (set_id=velenje)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.71.45.187
country_id: 3469034
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/Tests/ImmutableEventDispatcherTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.188.87.82
country_id: 1562822
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/services.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 67.230.43.8
country_id: 3489940
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/thumb.php?src=img/photos/1191009474.jpg&size=1000x1000 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 34.1.19.187
country_id: 6252001
description:
[2026-01-25 08:05:39 +0800] info [webmaild] 34.1.19.187 - - "GET /ads.txt HTTP/1.1" FAILED LOGIN webmaild: login attempt without username


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 08:08:11 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:60394: 535 Incorrect authentication data (set_id=sz)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 08:08:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/index.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.137.160
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.114.255
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-includes/css/dist/block-library/style.min.css?ver=6.9 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.208.141.147
country_id: 2245662
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=6.1.4 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 79.117.235.16
country_id: 2510769
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/woocommerce/assets/js/frontend/add-to-cart.min.js?ver=10.4.3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.53.231.232
country_id: 1527747
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/main.min.css?ver=4.12.1 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.183.86.224
country_id: 1562822
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/jetpack/jetpack_vendor/automattic/woocommerce-analytics/build/956.js?minify=false&ver=409e67b93e15d69e7918 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.95.114.136
country_id: 3865483
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/plugins/woocommerce-menu-bar-cart/assets/css/wpmenucart-main.min.css?ver=2.14.12 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 143.208.15.92
country_id: 3469034
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/wp-content/themes/astra/assets/css/minified/compatibility/contact-form-7-main.min.css?ver=4.12.1 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 08:21:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 08:21:19 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:53448: 535 Incorrect authentication data (set_id=laposte)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.169.12
country_id: 2328926
description:
Jan 25 08:27:22 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.169.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 41.216.169.12
country_id: 2328926
description:
2026-01-25 08:27:24 dovecot_login authenticator failed for H=([41.216.169.12]) [41.216.169.12]:47312: 535 Incorrect authentication data (set_id=promo@tujusetia.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 120.238.23.168
country_id: 1814991
description:
Jan 25 08:29:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 120.238.23.168 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 120.238.23.168
country_id: 1814991
description:
2026-01-25 08:29:05 dovecot_login authenticator failed for H=([120.238.23.168]) [120.238.23.168]:57816: 535 Incorrect authentication data (set_id=promo@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.240.222.49
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product.php?id=81&page=2 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 167.94.138.55
country_id: 6252001
description:
2026-01-25  8:30:24 684806 [Warning] Aborted connection 684806 to db: 'unconnected' user: 'unauthenticated' host: '167.94.138.55' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.119
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/img/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.107.202
country_id: 3469034
description:
Jan 25 08:34:42 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.107.202 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 08:34:50 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.212
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/img/druma_photos/video.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 187.120.73.237
country_id: 3469034
description:
Jan 25 08:34:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 187.120.73.237 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 08:34:52 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:56661: 535 Incorrect authentication data (set_id=pl)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.157.111
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/commercial/images/img/photos/images/csr.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/images/img/druma_photos/blog.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.133.34
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/photos/images/press.php||SC:/home/indfinitydesign/public_html/img/photos/images||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.239.40.180
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=448567 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 91.238.181.93
country_id: 3017382
description:
2026-01-25  8:44:52 685377 [Warning] Aborted connection 685377 to db: 'unconnected' user: 'unauthenticated' host: '91.238.181.93' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.162.176.30
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=208488 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: www.indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/malaysia-infinity-design-projects/residential/images/img/photos/awards.php||SC:/home/indfinitydesign/public_html/index.php||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 08:48:40 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 08:48:42 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:65502: 535 Incorrect authentication data (set_id=bender)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
description:
2026-01-25  8:51:37 685611 [Warning] Aborted connection 685611 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 64.89.163.158
description:
2026-01-25  8:55:21 685782 [Warning] Aborted connection 685782 to db: 'unconnected' user: 'unauthenticated' host: '64.89.163.158' (This connection closed normally without authentication)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.249.52.227
country_id: 2921044
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:08-58.104.249.52.227||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.162.57.109
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=28901516696291 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 09:01:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:01:34 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61350: 535 Incorrect authentication data (set_id=monomono)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.187.161
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=457703 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.227.192
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=97051516695307 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.227.173.161
country_id: 1562822
domain: www.cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cofreth.com.my/Backup/contact.html HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.29.238.66
country_id: 1210997
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/routing/Matcher/RedirectableUrlMatcherInterface.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.222
country_id: 1269750
description:
Jan 25 09:11:26 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.222 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.222
country_id: 1269750
description:
2026-01-25 09:11:28 dovecot_login authenticator failed for H=([122.187.230.222]) [122.187.230.222]:50457: 535 Incorrect authentication data (set_id=alert@kimmark.com)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 158.140.217.21
country_id: 2510769
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:09-13.158.140.217.21||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:14:23 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:50476: 535 Incorrect authentication data (set_id=tss)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 37.210.246.54
country_id: 289688
description:
Jan 25 09:14:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 37.210.246.54 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 37.210.246.54
country_id: 289688
description:
2026-01-25 09:14:54 dovecot_login authenticator failed for H=([37.210.246.54]) [37.210.246.54]:54926: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 09:14:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 09:14:21 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.135.241.146
country_id: 6252001
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/Products 061-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 148.135.241.146
country_id: 6252001
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/Products 061-150x150.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 147.182.130.10
country_id: 6252001
description:
2026-01-25  9:19:55 686805 [Warning] Aborted connection 686805 to db: 'unconnected' user: 'unauthenticated' host: '147.182.130.10' (This connection closed normally without authentication)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.150.65
country_id: 1880251
domain: indfinitydesign.com
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/keyword/images/home/csr.php||SC:/home/indfinitydesign/public_html/keyword||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:27:40 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52120: 535 Incorrect authentication data (set_id=romario)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 185.187.78.146
country_id: 99237
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/tests/vendor/symfony/translation/Loader/ArrayLoader.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 122.187.230.130
country_id: 1269750
description:
Jan 25 09:30:54 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 122.187.230.130 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 122.187.230.130
country_id: 1269750
description:
2026-01-25 09:30:56 dovecot_login authenticator failed for H=(nsg-corporate-130.230.187.122.airtel.in) [122.187.230.130]:55602: 535 Incorrect authentication data (set_id=no-reply@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.59.213.100
country_id: 3865483
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/hamcrest/hamcrest-php/generator/FactoryFile.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.173.168.232
country_id: 1562822
domain: kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/kendek.com/customers.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 77.83.39.167
country_id: 690791
description:
2026-01-25 09:35:07 H=([77.83.39.167]) [77.83.39.167]:59290 F=<stevenwelboun@op.pl> rejected RCPT <cky@ahfengineering.com>: SPF: 77.83.39.167 is not allowed to send mail from op.pl


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.52.147.182
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=61961516695189 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 201.189.36.171
country_id: 3895114
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88931514863850 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 113.187.198.163
country_id: 1562822
description:
2026-01-25 09:37:03 dovecot_login authenticator failed for H=(213.5.130.152) [113.187.198.163]:37314: 535 Incorrect authentication data (set_id=hadzrizan@manforce.net)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 43.134.181.38
country_id: 1880251
description:
2026-01-25 09:37:36 dovecot_login authenticator failed for H=(190.2.145.187) [43.134.181.38]:37624: 535 Incorrect authentication data (set_id=nurhayat@manforce.net)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 09:41:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:41:12 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:58744: 535 Incorrect authentication data (set_id=yamasaki)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.134.58.201
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/hotel.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.169.66.132
country_id: 1562822
domain: www.cabe.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.cabe.com.my/product-detail.php?id=993425 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 181.189.36.4
country_id: 3469034
description:
[2026-01-25 09:46:26 +0800] info [cpaneld] 181.189.36.4 - kimmark "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: access denied for root, reseller, and user password


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.183.86
country_id: 3469034
description:
Jan 25 09:47:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.183.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 178.219.98.26
country_id: 798544
description:
Jan 25 09:48:17 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 178.219.98.26 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 191.53.183.86
country_id: 3469034
description:
Jan 25 09:48:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 191.53.183.86 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 09:54:29 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 09:54:31 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:64379: 535 Incorrect authentication data (set_id=vladimir)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 103.197.57.71
country_id: 1733045
description:
2026-01-25 10:00:01 H=([127.0.0.1]) [103.197.57.71]:49822 X=TLS1.3:TLS_AES_256_GCM_SHA384:256 F=<etenancy@manforce.my> A=dovecot_plain:etenancy@manforce.my rejected RCPT <manager@example.com>: The mail server could not deliver mail to manager@example.com.  The account or domain may not exist, they may be blacklisted, or missing the proper dns entries.


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.153.215.83
country_id: 146669
domain: www.box.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.my/image/cache/catalog/OPP Tape 1-1-250x250.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 82.153.215.83
country_id: 146669
domain: www.box.com.myhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.box.com.myhttp/www.box.com.my/image/cache/catalog/OPP Tape 1-1-250x250.JPG HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 25 10:06:44 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 10:07:24 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 10:07:26 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:54001: 535 Incorrect authentication data (set_id=brandon)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 27.151.13.55
country_id: 1814991
description:
Jan 25 10:08:32 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 27.151.13.55 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 27.151.13.55
country_id: 1814991
description:
2026-01-25 10:08:34 dovecot_login authenticator failed for H=([27.151.13.55]) [27.151.13.55]:39824: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/flagallery/flexible-packaging/img/img/news.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.146.179
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/index.php||SC:/home2/pspolycom/public_html/plug||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.65
country_id: 2921044
description:
Jan 25 10:10:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.65 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/news.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 192.34.128.202
country_id: 6252001
description:
Jan 25 10:11:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 192.34.128.202 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 192.34.128.202
country_id: 6252001
description:
2026-01-25 10:11:58 dovecot_login authenticator failed for H=([192.34.128.202]) [192.34.128.202]:42900: 535 Incorrect authentication data (set_id=partners@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 187.90.153.179
country_id: 3469034
domain: www.tschuan.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tschuan.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 220.246.33.79
country_id: 1819730
description:
Jan 25 10:15:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 220.246.33.79 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 220.246.33.79
country_id: 1819730
description:
2026-01-25 10:15:17 dovecot_login authenticator failed for H=079.33.246.220.static.netvigator.com [220.246.33.79]:49631: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 10:16:24 H=([45.144.212.242]) [45.144.212.242]:64156 F=<no_reply@admin.com> rejected RCPT <tst@tst-ma.com>: Sender verify failed


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:16:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:16:38 dovecot_login authenticator failed for H=(5q2ei4Fj) [77.83.39.224]:57318: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:17:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:17:15 dovecot_login authenticator failed for H=(NVugqE7Zm7) [77.83.39.224]:61483: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:18:08 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:18:10 dovecot_login authenticator failed for H=(8QC4Arn) [77.83.39.224]:52257: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:19:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:19:07 dovecot_login authenticator failed for H=(eEmS82) [77.83.39.224]:52724: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.170.72.175
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=594602 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:20:21 dovecot_login authenticator failed for H=(4ysC2z) [77.83.39.224]:63389: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 10:20:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 10:20:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:61302: 535 Incorrect authentication data (set_id=tmn)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:20:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:20:03 dovecot_login authenticator failed for H=(CPeLmemYz) [77.83.39.224]:49949: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:21:15 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:21:17 dovecot_login authenticator failed for H=(Fq1yaE) [77.83.39.224]:60579: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:22:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:22:13 dovecot_login authenticator failed for H=(rYlNm9k) [77.83.39.224]:54255: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:23:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:23:09 dovecot_login authenticator failed for H=(0g6PQl) [77.83.39.224]:56643: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:23:15 dovecot_login authenticator failed for H=(B5t1Neu) [77.83.39.224]:54011: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 51.38.187.130
country_id: 3017382
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/img/img/img/photos/img/photos/img/product.php||SC:/home2/pspolycom/public_html/img/img||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:24:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:24:04 dovecot_login authenticator failed for H=(skR1ntWt6) [77.83.39.224]:62261: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:25:00 dovecot_login authenticator failed for H=(bWYpqYUUL) [77.83.39.224]:65290: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:25:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:25:18 dovecot_login authenticator failed for H=(WIRBMtgB) [77.83.39.224]:49907: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:26:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:26:03 dovecot_login authenticator failed for H=(WOX6xeDUXX) [77.83.39.224]:60441: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.172.108.227
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=656790 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:26:59 dovecot_login authenticator failed for H=(aHCOdJtgGh) [77.83.39.224]:57952: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:27:09 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:27:29 dovecot_login authenticator failed for H=(4BvDDoUcbD) [77.83.39.224]:52675: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.7
country_id: 1880251
domain: www.sutsb.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/hilfen-zur-wahl-eines-webhosts/images/cdn-cgi/l/cdn-cgi/l/products.php||SC:/home/sutsbcom/public_html/hilfen-zur-wahl-eines-webhosts||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:28:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:28:07 dovecot_login authenticator failed for H=(qOR4E6Gr) [77.83.39.224]:53155: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:29:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:29:03 dovecot_login authenticator failed for H=(BXWNCi) [77.83.39.224]:51923: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:29:40 dovecot_login authenticator failed for H=(y49qUxNE) [77.83.39.224]:57194: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:30:07 dovecot_login authenticator failed for H=(e0V1IJC) [77.83.39.224]:58065: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:30:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:31:50 dovecot_login authenticator failed for H=(xOOcliAfg) [77.83.39.224]:64090: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:31:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:31:02 dovecot_login authenticator failed for H=(0Cpm1kRF) [77.83.39.224]:50339: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 85.19.195.12
country_id: 3144096
description:
Jan 25 10:31:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 85.19.195.12 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 85.19.195.12
country_id: 3144096
description:
2026-01-25 10:31:09 dovecot_login authenticator failed for H=(85-19-195-12.telia-isp.no) [85.19.195.12]:54288: 535 Incorrect authentication data (set_id=partners@cofreth.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:32:06 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:32:08 dovecot_login authenticator failed for H=(xlzFvxs8) [77.83.39.224]:49519: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:33:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:33:05 dovecot_login authenticator failed for H=(ESYVvW9j) [77.83.39.224]:55338: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 10:33:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 10:33:54 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63015: 535 Incorrect authentication data (set_id=titans)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:33:59 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:34:01 dovecot_login authenticator failed for H=(MdDdkK) [77.83.39.224]:62600: 535 Incorrect authentication data (set_id=bktan@kimmark.com)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:34:08 dovecot_login authenticator failed for H=(rhoSqONsVv) [77.83.39.224]:55545: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.74.230.176
country_id: 1210997
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/listing-details.php?id=84605649 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 10:35:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:35:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:35:04 dovecot_login authenticator failed for H=(HywWJSfc) [77.83.39.224]:57663: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 108.165.238.82
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:10-35.108.165.238.82||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:36:00 dovecot_login authenticator failed for H=(WtsPsYKkk) [77.83.39.224]:57226: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:36:11 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:36:13 dovecot_login authenticator failed for H=(YozchmB) [77.83.39.224]:58802: 535 Incorrect authentication data (set_id=bktan)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.60.172.144
country_id: 3469034
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/stamp/37/462682 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:37:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:37:09 dovecot_login authenticator failed for H=(n4wgbJKQL) [77.83.39.224]:63130: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:38:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:38:05 dovecot_login authenticator failed for H=(kTXMks) [77.83.39.224]:55099: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:38:24 dovecot_login authenticator failed for H=(oYoSOFh0OF) [77.83.39.224]:57258: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 152.32.188.207
country_id: 1819730
description:
2026-01-25 10:38:46 689815 [Warning] Aborted connection 689815 to db: 'unconnected' user: 'unauthenticated' host: '152.32.188.207' (This connection closed normally without authentication)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.247.127.249
country_id: 3865483
domain: www.tptec.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.tptec.com.my/paving-breaker.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:39:01 dovecot_login authenticator failed for H=(aYh6u2) [77.83.39.224]:52099: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:39:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:40:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:40:03 dovecot_login authenticator failed for H=(IlqB96YD) [77.83.39.224]:56432: 535 Incorrect authentication data (set_id=bwyou.vpb@vc-b.com.my)


plugin: ossec
rule: 13006
name: Active Response. SMTP brute force attack (SMTP ports are protected)
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:40:35 dovecot_login authenticator failed for H=(ADZiS5zw) [77.83.39.224]:55110: 535 Incorrect authentication data (set_id=bktan)


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 77.83.39.224
country_id: 690791
description:
2026-01-25 10:41:01 dovecot_login authenticator failed for H=(ftMMD7W) [77.83.39.224]:52914: 535 Incorrect authentication data (set_id=bwyou.vpb)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.83.39.224
country_id: 690791
description:
Jan 25 10:41:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.83.39.224 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.33.144.68
country_id: 2017370
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/images/ourmarkets_001.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 10:47:16 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 10:47:18 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:50860: 535 Incorrect authentication data (set_id=sac)


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.64
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/plug/sms/img/img/product.php||SC:/home2/pspolycom/public_html/plug||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 168.227.166.67
country_id: 3469034
domain: www.kendek.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.kendek.com/product-detail.php?id=744397 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.142.140
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/wp-content/plugins/flagallery-skins/default_int/img/img/demos/img/index.php||SC:/home2/pspolycom/public_html/wp-content||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/demos/img/img/img/img/img/img/new-development.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/index.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.183.19.156
country_id: 3865483
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/training-details.php?id=365736 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/X11/xorg.conf.d/00-keyboard.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/alsa/conf.d/50-pipewire.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.82.131.252
country_id: 3469034
domain: www.maalloys.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.maalloys.com.my/capability.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/access_checker.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.d/php.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.modules.d/105_mod_authz_user.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/apache2/conf.modules.d/420_mod_socache_shmcb.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:00:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:00:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:63010: 535 Incorrect authentication data (set_id=eu-de)


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 168.91.32.75
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-01.168.91.32.75||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.167.54.7
country_id: 1562822
domain: u-net.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/u-net.com.my/products HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cagefs/conf.d/ai-bolit.cfg||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/img/about.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/cl.selector/php.extensions.d/i360.cfg||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.144.17
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/img/img/img/img/img/img/img/news.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/demos/img/img/contact-us.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/img/demos/contact-us.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 24.105.248.218
country_id: 6252001
description:
Jan 25 11:11:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 24.105.248.218 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 24.105.248.218
country_id: 6252001
description:
2026-01-25 11:11:09 dovecot_plain authenticator failed for H=(promendal) [24.105.248.218]:46866: 535 Incorrect authentication data (set_id=muhdfauzan@ajplantations.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/crypto-policies/back-ends/bind.config||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/crypto-policies/back-ends/nss.config||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 186.250.201.45
country_id: 3469034
description:
Jan 25 11:12:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 186.250.201.45 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.129.56.216
country_id: 953987
description:
Jan 25 11:12:28 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.129.56.216 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.1.245.106
country_id: 3865483
domain: geminiflourmill.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/geminiflourmill.com/resize.php?h=463&img=img/product_photos/942456.jpg&w=555 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:13:47 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:13:49 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:54121: 535 Incorrect authentication data (set_id=autumn)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/crypto-policies/local.d/nss-p11-kit.config||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 219.129.105.50
country_id: 1814991
description:
Jan 25 11:14:38 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 219.129.105.50 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 219.129.105.50
country_id: 1814991
description:
2026-01-25 11:14:40 dovecot_login authenticator failed for H=([219.129.105.50]) [219.129.105.50]:49509: 535 Incorrect authentication data (set_id=salesi@chs.com.my)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dbus-1/system.d/org.freedesktop.Flatpak.SystemHelper.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.215
country_id: 3469034
description:
Jan 25 11:16:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.87.74
country_id: 3469034
description:
Jan 25 11:16:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.87.74 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.1.77
country_id: 953987
description:
Jan 25 11:16:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.1.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.216.211.237
country_id: 933860
description:
Jan 25 11:16:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.216.211.237 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 143.208.250.102
country_id: 3469034
description:
Jan 25 11:16:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 143.208.250.102 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.75.10
country_id: 3469034
description:
Jan 25 11:16:55 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.75.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.241
country_id: 3175395
description:
Jan 25 11:16:56 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.58
country_id: 298795
description:
Jan 25 11:16:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.230.250
country_id: 798544
description:
Jan 25 11:16:58 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.230.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 5.45.167.121
country_id: 2510769
description:
Jan 25 11:16:34 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 5.45.167.121 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.36.202.47
country_id: 3469034
description:
Jan 25 11:16:36 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.36.202.47 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 138.255.206.215
country_id: 3469034
description:
Jan 25 11:17:02 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 138.255.206.215 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 177.70.75.10
country_id: 3469034
description:
Jan 25 11:17:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 177.70.75.10 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.77.177.105
country_id: 3469034
description:
Jan 25 11:17:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.77.177.105 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 109.125.230.250
country_id: 798544
description:
Jan 25 11:17:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 109.125.230.250 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 95.0.171.58
country_id: 298795
description:
Jan 25 11:17:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 95.0.171.58 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 102.66.1.77
country_id: 953987
description:
Jan 25 11:17:05 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 102.66.1.77 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.17.124.88
country_id: 690791
description:
Jan 25 11:17:10 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.17.124.88 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.30.113.241
country_id: 3175395
description:
Jan 25 11:17:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.30.113.241 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 200.237.87.74
country_id: 3469034
description:
Jan 25 11:17:03 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 200.237.87.74 has been locked due to Imunify RBL


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.143.101
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/portfolio/img/img/img/img/img/img/clientele.php||SC:/home2/pspolycom/public_html/portfolio||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 204.144.187.196
country_id: 6252001
description:
Jan 25 11:18:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 204.144.187.196 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 204.144.187.196
country_id: 6252001
description:
2026-01-25 11:18:20 dovecot_plain authenticator failed for H=(lamproa) [204.144.187.196]:49162: 535 Incorrect authentication data (set_id=munch@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.145.113.228
country_id: 1210997
description:
Jan 25 11:19:48 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.145.113.228 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 103.145.113.228
country_id: 1210997
description:
2026-01-25 11:19:50 dovecot_plain authenticator failed for H=(1J0G627F) [103.145.113.228]:51523: 535 Incorrect authentication data (set_id=facebook.comrnd@plomalite.com)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dnf/plugins/copr.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/dnf/protected.d/grub2-tools-minimal.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 147.235.212.228
country_id: 294640
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/sebastian/global-state/src/CodeExporter.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 185.255.215.12
country_id: 732800
description:
Jan 25 11:26:19 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 185.255.215.12 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 103.8.118.18
country_id: 1269750
description:
Jan 25 11:26:39 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 103.8.118.18 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:26:47 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:26:49 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62413: 535 Incorrect authentication data (set_id=toml)


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/10-hinting-slight.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.203.6.87
country_id: 3996063
domain: task.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/task.visoft.com.my/vendor/symfony/event-dispatcher/Tests/EventTest.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/48-spacing.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/fonts/conf.d/61-urw-nimbus-sans.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/gss/mech.d/gssproxy.conf||User:root||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.145.116
country_id: 1880251
domain: www.pspoly.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/news-n-events/img/img/img/img/demos/img/img/img/img/product.php||SC:/home2/pspolycom/public_html/news-n-events||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/captcha/lang.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/imunify360-webshield/webshield-http.conf.d/resolver.conf||User:root||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 66.180.131.196
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-38.66.180.131.196||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:40:35 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:40:37 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62321: 535 Incorrect authentication data (set_id=constanta)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 123.18.63.31
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88451514882760 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.111.227.152
country_id: 1210997
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=12581514861377 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/libreport/events.d/collect_dnf.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.41.231
country_id: 1562822
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=899701 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.145.50.180
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:11-49.198.145.50.180||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/access-logs/pftfood.com||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 38.25.50.14
country_id: 3932488
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/nikic/php-parser/lib/bootstrap.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 11:53:20 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51980: 535 Incorrect authentication data (set_id=user001)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 11:53:18 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 41.200.114.248
country_id: 2589581
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/img-sys/powered_by_cpanel.svg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.123.150.170
country_id: 3865483
domain: af-sb.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.com/img-sys/server_misconfigured.png HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.184.71.208
country_id: 1562822
domain: af-sb.comhttp
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/af-sb.comhttp/af-sb.com/ HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/etc/pftfood.rcube.db||User:pftfood||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.90.185.238
country_id: 2921044
description:
Jan 25 11:57:52 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.90.185.238 has been locked due to Imunify RBL


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/home3.ori/pftfood/ssl/ssl.db||User:pftfood||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.48.95.101
country_id: 3469034
domain: appointment.visoft.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/appointment.visoft.com.my/vendor/phpoffice/phpexcel/Examples/11documentsecurity-xls.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 190.97.244.174
country_id: 3625428
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=27331514528878 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 12:06:51 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:52156: 535 Incorrect authentication data (set_id=amalia)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 12:06:49 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 116.114.84.246
country_id: 1814991
description:
Jan 25 12:08:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 116.114.84.246 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 116.114.84.246
country_id: 1814991
description:
2026-01-25 12:08:29 dovecot_login authenticator failed for H=([116.114.84.246]) [116.114.84.246]:53772: 535 Incorrect authentication data (set_id=careers@nexuscollection.com)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 60.174.39.82
country_id: 1814991
description:
Jan 25 12:09:07 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 60.174.39.82 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 60.174.39.82
country_id: 1814991
description:
2026-01-25 12:09:09 dovecot_login authenticator failed for H=([60.174.39.82]) [60.174.39.82]:39823: 535 Incorrect authentication data (set_id=careers)


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.201
country_id: 6252001
description:
Jan 25 12:09:54 sv3 pure-ftpd[3821469]: (?@91.230.168.201) [INFO] New connection from 91.230.168.201


plugin: ossec
rule: 11301
name: New FTP connection.
abuser: 91.230.168.111
country_id: 6252001
description:
Jan 25 12:09:54 sv3 pure-ftpd[3821471]: (?@91.230.168.111) [INFO] New connection from 91.230.168.111


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.57.171.147
country_id: 3895114
domain: dsc-expat.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/dsc-expat.com/index.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 181.117.137.189
country_id: 3865483
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/usr/share/fontconfig/conf.avail/65-fonts-persian.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 179.63.55.192
country_id: 3865483
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/smart.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 50145
name: Failed login to SQL database
abuser: 198.199.80.113
country_id: 6252001
description:
2026-01-25 12:14:08 693378 [Warning] Aborted connection 693378 to db: 'unconnected' user: 'unauthenticated' host: '198.199.80.113' (This connection closed normally without authentication)


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 77.120.129.7
country_id: 690791
description:
Jan 25 12:18:01 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 77.120.129.7 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 41.211.4.233
country_id: 2300660
description:
Jan 25 12:18:31 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 41.211.4.233 has been locked due to Imunify RBL


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 12:20:00 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 12:20:02 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:51851: 535 Incorrect authentication data (set_id=104)


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 103.110.251.37
country_id: 1269750
domain: maalloys.com.my
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:23227.maalloys.com.my||ServerName:maalloys.com.my||Method:metaWeblog.newPost||BlogID:1||TitleSHA:541b25d14ff044c1972ed07faeead37985fb07fb||Title:0xc3d775dc||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 102.107.134.161
country_id: 2464461
domain: figofoods.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/figofoods.com.my/img/photos/278855.jpg HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 114.119.134.79
country_id: 1880251
domain: mail.fkr.com.my
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:7.67||T:APACHE||MV:/index.php/asia/images/contact.php||SC:/home2/fkrcom/public_html/index.php||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.255.143.93
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=87911523583434 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 84.115.226.120
country_id: 2782113
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=88061522226299 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 103.87.251.155
country_id: 1210997
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-detail.php?id=211364 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 12:33:27 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 12:33:29 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:58256: 535 Incorrect authentication data (set_id=pac)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 177.223.76.27
country_id: 3469034
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=37401514884338 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 12:33:46 H=([45.144.212.242]) [45.144.212.242]:55480 F=<no_reply@admin.com> rejected RCPT <inquiries@ktlog.com.my>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.172.144.68
country_id: 1562822
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=46061514946811 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.201.234.171
country_id: 3469034
domain: evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/evergrown.com.my/quality.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pcp/derived/cpu-util.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 181.68.10.126
country_id: 3686110
domain: aaa.krisfood.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/aaa.krisfood.com/product-category.php?id=3 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pki/ca-trust/ca-legacy.conf||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/pki/nssdb/cert9.db||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 183.171.102.224
country_id: 1733045
domain: www.evergrown.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.evergrown.com.my/product-details.php?id=24461515983341 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 12:45:15 H=([45.144.212.242]) [45.144.212.242]:60465 F=<no_reply@admin.com> rejected RCPT <julie@nobledec.com>: Sender verify failed


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.239.238.50
country_id: 6252001
domain: manforce.net
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.0.0 Safari/537.36||RSV:7.67||T:APACHE||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 12:46:43 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 12:46:45 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:62883: 535 Incorrect authentication data (set_id=cong)


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 45.144.212.242
country_id: 690791
description:
2026-01-25 12:47:19 H=([45.144.212.242]) [45.144.212.242]:54154 F=<no_reply@admin.com> rejected RCPT <info@oxbold.com>: Sender verify failed


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 200.164.34.142
country_id: 3469034
domain: cofreth.com.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/cofreth.com.my/admin/assets/ashrae.pdf HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.254.195.83
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/press.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 14.191.174.62
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/news.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-25 12:50:45 H=([31.145.189.54]) [31.145.189.54]:60296 F=<dse_NA2@docusign.net> rejected RCPT <fkr@fkr.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 189.145.6.15
country_id: 3996063
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/index.php/uk/history.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 113.191.123.62
country_id: 1562822
domain: www.mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/www.mssa.org.my/facilities.php HTTP/1.1||RSV:7.67||T:APACHE||


plugin: ossec
rule: 13008
name: Mail Recipient rejected
abuser: 31.145.189.54
country_id: 298795
description:
2026-01-25 12:57:47 H=([31.145.189.54]) [31.145.189.54]:56555 F=<dse_NA2@docusign.net> rejected RCPT <sales@cordage.com.my>: SPF: 31.145.189.54 is not allowed to send mail from docusign.net


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/security/limits.d/25-pw-rlimits.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 138.0.102.109
country_id: 3469034
domain: mssa.org.my
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/mssa.org.my/product-category.php?id=5&page_id=1&sub=19 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/selinux/targeted/setrans.conf||User:root||


plugin: ossec
rule: 6013
name: Imunify PAM. The IP has been locked by RBL
abuser: 62.60.130.198
country_id: 130758
description:
Jan 25 13:00:13 sv3 auth[3200657]: pam_imunify(dovecot_imunify:auth): [IM360_RBL] The IP 62.60.130.198 has been locked due to Imunify RBL


plugin: ossec
rule: 13001
name: Exim Auth failed
abuser: 62.60.130.198
country_id: 130758
description:
2026-01-25 13:00:15 dovecot_login authenticator failed for H=(localhost) [62.60.130.198]:59733: 535 Incorrect authentication data (set_id=chou)


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 186.139.74.246
country_id: 3865483
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/product.php?id=33&sub=90 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:70081.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3a0534817ee105cb5cef7b539b38f5f0924ae998||Title:0x3607aeb4||RSV:7.67||T:APACHE||


plugin: modsec
rule: 33375
name: IM360 WAF: XMLRPC fault response
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XMLRPC fault response||MV:<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<methodResponse>\n  <fault>\n    <value>\n      <struct>\n        <member>\n          <name>faultCode</name>\n          <value><int>403</int></value>\n        </member>\n        <member>\n          <name>faultString</name>\n          <value><string>Incorrect username or password.</string></value>\n        </member>\n      </struct>\n    </value>\n  </fault>\n</methodResponse>\n||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/ssh/ssh_config.d/50-redhat.conf||User:root||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.232.224.186
country_id: 3469034
domain: nobledec.com
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET http:/nobledec.com/productdetails.php?id=2300 HTTP/1.1||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:c5f97e63f07f497dff90c49889e3a3405462df87||Title:0x1d1e9f14||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sw-engine/pool.d/default.conf||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:3dc75861a4826c4974c058cbf6e4ee6ca3815f42||Title:0xd1328928||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 198.37.118.179
country_id: 6252001
domain: agsaintifik.com.my
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309r77140835r77140736||MV:13-07.198.37.118.179||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysconfig/imunify360/custom_billing.config||User:root||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 65.108.99.114
country_id: 660013
domain: pftfood.com
description:
IM360 WAF: Bad file extension||RSV:7.67||T:APACHE||MVN:REQUEST_FILENAME||MV:/home/000~ROOT~000/etc/sysconfig/kcare/kcare.conf||User:root||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:44a1073ae57805ce7b4cee4a41a0bf98d41337f3||Title:0xb5d3cdf0||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:992a27fb13885ccb1a1839d0681bd2f6cfeed12e||Title:0x65c220bb||RSV:7.67||T:APACHE||


plugin: modsec
rule: 77839622
name: IM360 WAF: XML-RPC Suspicious blog attempt
abuser: 202.47.38.191
country_id: 1168579
domain: masaakisb.com
description:
IM360 WAF: XML-RPC Suspicious blog attempt||Username:admin.masaakisb.com||ServerName:masaakisb.com||Method:metaWeblog.newPost||BlogID:1||TitleSHA:b2497167e2d0b755315ed584814adb1b365d0292||Title:0x6369f56c||RSV:7.67||T:APACHE||


